Privacy Policy

1. Who we are

Citeon ("Citeon", "we", "us", "our") is a registered business name (ABN 36 638 859 989) of Zac Antony Apostolopoulos, a sole trader based in Victoria, Australia, and provides a generative search visibility platform accessible at citeon.dev. For the purposes of the UK GDPR we act as a data controller for account data and as a data processor for content you submit into the service. Citeon is not offered in the European Union or the European Economic Area: access from those countries is blocked, and we do not knowingly collect personal data from people located there. You can reach us at support@citeon.dev.

2. Information we collect

Early-access list data: if you joined our early-access list before Citeon opened, your email address, the website address you optionally gave us, and how you reached us (the referring page or campaign). We use it to tell you about Citeon and to prepare something relevant to your site. You can ask us to remove you at any time by emailing support@citeon.dev.

Messages you send us: if you use the contact form, your name, email address, company name if given, the topic and the message itself. We use it to answer you, and we send you an automatic confirmation that your message arrived. We keep the correspondence so we have a record of what was asked and answered.

Account data: name, email, password hash, company name, billing details processed by our payment provider.

Workspace content: the domains, competitors, prompts, schema and other configuration you submit.

Usage data: IP address, browser, device, pages viewed, feature interactions, error logs, approximate location derived from IP.

Cookies and similar technologies: strictly necessary cookies for authentication and session management, and, only if you accept analytics in the cookie banner, PostHog product analytics: the pages you visit, the buttons you click and the sign-up steps you complete, linked to a random identifier and, if you have an account, your account id (never your email). We do not record your screen. Cloudflare Web Analytics counts page views without cookies.

AI traffic tracking (optional): if you choose to add our AI traffic snippet to your own website, we receive, on your behalf, the AI assistant a visitor arrived from, the page they landed on, the referring address, and a one-way code made from the visitor's IP address and browser that changes every day, used only to avoid counting the same visit twice. The IP address itself is not stored. We process this data as your data processor under a Data Processing Agreement. You remain responsible for disclosing this collection in your own website's privacy and cookie notices.

3. Legal bases for processing (UK users)

We rely on (a) performance of a contract to operate the service you subscribed to, (b) legitimate interests to secure, improve and market the service in a proportionate way, (c) consent for non-essential cookies and marketing emails, and (d) compliance with legal obligations such as tax, accounting and responding to lawful requests.

4. How we use your information

To create and operate your account, run scans against AI engines on your behalf, deliver insights, send transactional and (with consent) marketing email, prevent fraud and abuse, comply with law, and improve the product. We do not sell your personal data, and we do not use your workspace content to train any model of our own. Running a scan necessarily sends your configured prompts to the third-party AI providers listed in our Data Processing Agreement, where they are handled under that provider's own terms. Those terms differ between providers, and some may use API inputs to improve their services. We do not send your customers' personal data to any AI provider.

5. Sub-processors and third parties

We rely on vetted sub-processors for hosting, database, email delivery, analytics (PostHog, United States, only with your consent), error monitoring and payments (Stripe and its Link service, which acts as merchant of record for purchases and processes your payment details; Citeon never sees or stores your full card number). When you run a scan, the prompts you configure are transmitted to the relevant AI providers (such as OpenAI, Anthropic, Google, Perplexity and DeepSeek) under their terms. When you use the in-app assistant, your question, the last few messages of the conversation and a summary of your account data (business details, scores, competitors and open content gaps) are sent to Anthropic to generate the answer; nothing is sent unless you ask it something. A current list of sub-processors is available on request at support@citeon.dev.

6. International transfers

Your data may be processed in the United States and other countries outside the UK and Australia. Where required, we rely on the UK International Data Transfer Agreement or Addendum and other lawful transfer mechanisms.

7. Retention

We retain account and workspace data for as long as your account is active and for a limited period afterwards to meet legal, tax and dispute-resolution obligations. You can request deletion at any time as described below.

8. Your rights

Depending on your location you may have the right to access, rectify, delete, restrict or object to processing, withdraw consent, port your data, and lodge a complaint with a supervisory authority. California residents have rights under the CCPA/CPRA including the right to know, delete and opt out of sale or sharing of personal information; we do not sell or share personal information as defined by the CCPA. If you have an account, you can download everything we hold about you, or delete your account and all its data, at any time from Settings → Data. To exercise any other right, email support@citeon.dev.

9. Australian Privacy Principles

For Australian users, we handle personal data in line with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth), and we apply them as our standard whether or not the Act applies to a business of our size. If you are an Australian resident and believe we have breached your privacy, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

10. Security

We use industry-standard administrative, technical and physical safeguards including encryption in transit and at rest. No internet service is perfectly secure and we cannot guarantee absolute security.

11. Children

Citeon is not intended for and is not directed at anyone under 18, the minimum age in our Terms. We do not knowingly collect personal data from children.

12. Changes

We may update this policy from time to time. Material changes will be communicated by email or in-product notice. Continued use of the service after the effective date constitutes acceptance.

13. Contact

Privacy questions and requests: support@citeon.dev, or by post to Citeon, PO Box 661, Brentford Square VIC 3131, Australia.