CitedBy
Privacy policy
Last updated: 10 July 2026
CitedBy (“we”, “us”) helps UK local service businesses get found on Google and in AI answers. This page explains what data we collect, why, and what we do with it — in plain English. CitedBy is operated as a sole trader business. Contact: hello@citedby.co.uk · CitedBy, 124 City Road, London, EC1V 2NX, United Kingdom.
What we collect
- Account details — your name, email address, business name, trade, town and website address, given when you run a free check or sign up.
- Billing — handled by Stripe. We never see or store your card number.
- Your website’s public content — we read your site to check and improve how it performs in search and AI answers.
- Search and AI visibility data — real search volumes, search results and AI assistant answers relating to your business and the searches you target.
- Leads — when someone fills in an enquiry form we placed on your website, we pass their name, contact details and message to you, and keep a copy so you can see them in your dashboard.
- Usage — basic records of how the service is used, to keep it working and improve it.
Google data — what we access and how we use it
If you choose to connect your Google account, you grant CitedBy access through Google’s official sign-in (OAuth). We request the minimum scopes needed:
- Google Business Profile (
business.manage) — we read your listing’s details (name, address, phone, hours, categories) to keep your website consistent with it; we read your reviews to draft replies which only publish when you approve them; and we publish posts to your profile only when you approve them. - Google Search Console (
webmasters.readonly) — read-only access to your site’s search performance (clicks, impressions, positions) so your dashboard shows real results.
CitedBy’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we only use Google data to provide the features described above to you; we do not sell it; we do not use it for advertising; we do not allow humans to read it except with your permission, where needed for security, or to comply with law. You can disconnect your Google account at any time from your dashboard or at myaccount.google.com/permissions, which revokes our access.
Who we share data with
We don’t sell your data to anyone. We use a small number of service providers to run CitedBy, each only receiving what they need: Vercel and Supabase (hosting and database), Stripe (payments), Resend (email), ClickSend (text-message lead alerts you switch on), Anthropic (drafting your content — inputs are not used to train their models), and search-data providers for the public search volumes and results shown in your dashboard. Google data is never shared with AI model providers or data brokers.
How long we keep data
For as long as you have an account, so your history and results keep working for you. If you cancel, we delete or anonymise your account data within 90 days of your subscription ending, except records we must keep for tax and accounting. Connected-Google data is deleted when you disconnect or when your account is deleted, whichever comes first. One more exception: we keep a log of the changes we make to your website (what was changed, when, and on which page — not your name or email) for up to 12 months after your account closes, or until any open dispute is resolved, so we can show exactly what we did if a question about our work ever comes up. After that it’s deleted too.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, or take your data elsewhere. Email hello@citedby.co.ukand we’ll sort it — usually within a few days, at most within a month. You can also complain to the ICO (ico.org.uk) if you think we’ve got something wrong.
Cookies
We use strictly necessary cookies to keep you signed in and remember choices you make (like which version of a page you saw). We don’t run third-party advertising cookies on the dashboard. Marketing pages may use measurement cookies (for example Meta’s pixel) to know whether our own ads worked.
Changes
If we change this policy in a way that matters, we’ll email account holders before it takes effect.