CitedBy
Privacy policy
Last updated: 7 September 2026
CitedBy (“we”, “us”) helps UK local service businesses get found on Google and in AI answers. This page explains what data we collect, why, and what we do with it — in plain English. CitedBy is operated as a sole trader business. Contact: hello@citedby.co.uk · CitedBy, 124 City Road, London, EC1V 2NX, United Kingdom.
What we collect
- Account details — your name, email address, business name, trade, town and website address, given when you run a free check or sign up.
- Billing — handled by Stripe. We never see or store your card number.
- Your website’s public content — we read your site to check and improve how it performs in search and AI answers.
- Search and AI visibility data — real search volumes, search results and AI assistant answers relating to your business and the searches you target.
- Leads — when someone fills in an enquiry form we placed on your website, we pass their name, contact details and message to you, and keep a copy so you can see them in your dashboard.
- Usage — basic records of how the service is used, to keep it working and improve it.
Google data — what we access and how we use it
If you choose to connect your Google account, you grant CitedBy access through Google’s official sign-in (OAuth). We request the minimum scopes needed:
- Google Business Profile (
business.manage) — we read your listing’s details (description, address, phone, opening hours) to keep your website consistent with it and to show you what’s missing; we read your reviews and draft replies for you, and we never publish a reply to Google without you approving it first; and when you publish an article with us we can post it to your profile, which happens automatically only if you’ve switched autopilot on. - Google Search Console (
webmasters.readonly) — read-only access to your site’s search performance (clicks, impressions, positions) so your dashboard shows real results.
CitedBy’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we only use Google data to provide the features described above to you; we do not sell it; we do not use it for advertising; we do not allow humans to read it except with your permission, where needed for security, or to comply with law. You can disconnect your Google account at any time from your dashboard or at myaccount.google.com/permissions, which revokes our access.
Who we share data with
We don’t sell your data to anyone. We use a small number of service providers to run CitedBy, each only receiving what they need: Vercel and Supabase (hosting and database), Inngest (runs our scheduled work, like your monthly content), Stripe (payments), Resend and Loops (email), ClickSend (text-message lead alerts you switch on), Cloudflare (the are-you-human check on our forms), Anthropic (drafting your content — inputs are not used to train their models), and search-data providers for the public search volumes and results shown in your dashboard. Meta gets a scrambled (hashed) version of an email address in two cases: if you subscribe after clicking one of our ads, so we can see the ad worked; and, for businesses on our outreach list, so our ads reach the same people (see Businesses we contact below). Meta cannot read the address, only match it against its own users. We never share Google data with data brokers, and we never sell it. There is one place Google data reaches an AI provider, and it’s worth being straight about: when we draft a reply to one of your reviews, that review’s text is sent to Anthropic so it can write the draft. Anthropic doesn’t use it to train their models, it isn’t used for anything else, and nothing is published to Google until you approve it.
How long we keep data
For as long as you have an account, so your history and results keep working for you. If you cancel, we delete or anonymise your account data within 90 days of your subscription ending, except records we must keep for tax and accounting. Connected-Google data is deleted when you disconnect or when your account is deleted, whichever comes first. One more exception: we keep a log of the changes we make to your website (what was changed, when, and on which page — not your name or email) for up to 12 months after your account closes, or until any open dispute is resolved, so we can show exactly what we did if a question about our work ever comes up. After that it’s deleted too.
Businesses we contact
This section is for you if an email about CitedBy reached you and you have never had an account or run a check with us. Local trades get one email from us about what CitedBy does, with a follow-up if they reply. Here is what that involves.
- What we hold — your business name, a contact name where it is public, an email address, a phone number, your website address, your town and your trade.
- Where it came from — public business listings, your own website, and Companies House.
- Why — to write to you about CitedBy once, and to follow up if you reply. That is our legitimate interest in telling local businesses about a service built for them, and we have weighed it against your interests: it is work contact details, used for one email, with an easy way out.
- Ads — we may also give Meta a scrambled (hashed) version of your email address so that our ads are shown to you rather than to strangers. Meta cannot read the address; it only matches it against its own users. Objecting (below) stops this as well as the email.
- How long — for up to 12 months after we last wrote to you, then it is deleted. If you object, your details stay on our do-not-contact list only, so we never write to you again, and are used for nothing else.
- How to object — reply to any email from us, or write to hello@citedby.co.uk. You do not need a reason. We stop the emails and remove you from the ad list, usually the same day and at most within a month.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, or take your data elsewhere. Email hello@citedby.co.uk and we’ll sort it — usually within a few days, at most within a month. You can also complain to the ICO (ico.org.uk) if you think we’ve got something wrong.
Cookies
We use strictly necessary cookies to keep you signed in and remember choices you make (like which version of a page you saw). We don’t run third-party advertising cookies on the dashboard. Marketing pages may use measurement cookies (for example Meta’s pixel) to know whether our own ads worked.
Changes
If we change this policy in a way that matters, we’ll email account holders before it takes effect.