Privacy policy

Account information

Your username and email address, received from the identity provider you sign in through. We request only the standard openid, profile and email scopes. We never see or store your password.

Billing information

We pass your email address to Stripe to create or find your customer record, and store the Stripe customer and subscription identifiers Stripe gives back, along with your subscription status and credit balance. Card and bank details are entered on Stripe's own hosted checkout and never reach our servers.

Your configuration

The brand name, domains and brand keywords you enter; the competitors you choose to track, with their domains and keywords; and the prompts and prompt sets you create. Some prompts may be drafted for you on request, from the brand and competitor details already on your account.

Measurement data

Each time a run happens we store, for every prompt and every model: the complete text of the model's answer, the URLs it cited, and the scores calculated from them. Model answers are generated text and can mention anyone or anything, including named individuals, so this is the field most likely to contain personal information we did not ask for.

Readiness audit data

When you run an audit we store what was fetched from the homepage you nominate: the page content, robots.txt, the sitemap, llms.txt, and how five AI crawler user-agents were responded to, together with the username of whoever ran it. If your firewall blocks our fetcher you may instead paste the page source yourself, and that pasted content is stored the same way. Audits only run against domains on your own account.

Operational logs

Our servers record errors and diagnostic events, which can include account identifiers, URLs and timestamps. These exist so faults can be diagnosed, not to build a profile of you.

We do not use analytics, advertising, or session-replay services, and there are no third-party trackers on this site. We do not collect special category data, and Citation is not intended for that use.

Citation sets two cookies, both first-party. There are no others.

session

Keeps you signed in. It is encrypted, marked httpOnly so scripts cannot read it, and expires after seven days. It contains your username and email address, and the identity token used to sign you out cleanly at your identity provider. Strictly necessary: the application cannot work without it.

theme

Remembers whether you chose the light or dark appearance. A display preference and nothing more.

Because we set no analytics or advertising cookies, there is no consent banner to click through.

To provide the service (contract)

Creating your account, running your prompts against the AI models, scoring and storing the results, running audits, and showing you the dashboard.

To take payment (contract)

Managing your subscription and credit purchases through Stripe.

To keep the service working and secure (legitimate interests)

Diagnosing faults, preventing abuse of runs and audits, and improving the product. We consider this proportionate because the data involved is operational rather than sensitive, and the alternative is a service we cannot debug.

To meet legal obligations

Retaining billing and tax records for the period the law requires.

We do not currently send marketing email, and we do not rely on consent as a basis for anything described here. If that changes, this policy will change first.

We share information with the following service providers, each only with what they need to do their part:

Our identity provider

Authenticates your sign-in and holds your credentials. Operated by MOSAIC.

Stripe

Takes payment. Stripe receives your email address from us, and your payment details directly from you. Stripe handles that information under its own privacy policy.

Our workflow runner and database

Orchestrate runs and audits and store everything described above. Operated by MOSAIC.

OpenAI, Anthropic and Perplexity

Receive your prompts, and your brand and competitor names, in order to answer them, which is what Citation measures. They do not receive your account details, your email address, or anything about your billing.

Because your prompts are sent to those AI providers, please do not put personal information, customer data, or anything confidential into a prompt. Prompts should read like the questions your buyers ask.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We may disclose information if the law requires it, or to establish or defend legal claims. If MOSAIC is ever involved in a merger or acquisition, information may transfer as part of it, and we will say so before it takes effect.

Mosaic Data Services, Inc. is incorporated in the United States, and the AI providers we send prompts to are based there as well. Personal information originating in the UK or EEA is therefore transferred outside it.

We rely on [TRANSFER MECHANISM, e.g. UK IDTA / EU Standard Contractual Clauses] for those transfers. You can ask us for a copy of the safeguards in place using the contact details below.

We keep your account information, configuration, runs and audits for as long as your account exists, and we delete them when you ask us to.

We do not currently operate a fixed deletion schedule, and we would rather tell you that than publish a timetable we do not follow. Historical runs are kept deliberately: the product's value is the trend, and a score is only comparable against the ones before it. Billing records are kept for as long as tax and accounting law requires.

If you would like your data removed sooner, ask; see below. We will introduce defined retention periods in a future version of this policy, and will publish them here when we do.

If you are in the UK or EEA, you have the right to ask us for a copy of your personal information; to have it corrected or erased; to restrict or object to how we use it; and to receive it in a portable form. Citation also has a CSV export in the app, which covers all of your runs and scores and needs no request at all.

If you are in California or another US state with comparable law, you have the right to know what we collect and why, to have it deleted or corrected, and not to be treated differently for asking. You also have a right to opt out of the sale or sharing of personal information for targeted advertising. We do neither, so there is nothing to opt out of.

To exercise any of these, email [PRIVACY CONTACT EMAIL]. Requests are handled by a person rather than by a self-service control in the app, so please allow us a little time; we will respond within the period the applicable law sets. We may need to confirm who you are before we act.

If you think we have handled your information badly, please tell us first, but you can complain to a regulator regardless. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA, your national data protection authority.

Session cookies are encrypted and inaccessible to scripts. Traffic is served over HTTPS. The database is never reachable from the browser: every read and write goes through the server, which checks on each request that the account asking is the account the data belongs to, rather than trusting anything the page sent.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information we will notify you and the relevant regulator as the law requires.

Citation is a business product and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

When this policy changes we update the date at the top of the page. If a change materially affects how we use your personal information, we will tell account holders directly rather than relying on you to notice.

Questions about this policy, or about anything above: email [PRIVACY CONTACT EMAIL], or write to Mosaic Data Services, Inc., [REGISTERED ADDRESS].