DRAFT, not legal advice, pending owner approval. To approve: delete this banner and its review notes, and fill in every
[PLACEHOLDER].Review notes for the owner (checked against the code on 2026-10-04):
- Retention isn't enforced by code yet. The 7 days for visitor hashes and the 30 days for queue emails match the code's settings (
IP_HASH_RETENTION_DAYS,QUEUED_EMAIL_RETENTION_DAYS), but nothing in the code deletes them, and no ticket does it (ticket 22 only covers Customer and Lead data). A job that deletes old visitor hashes, daily salts and queue emails must exist before the soft deploy, or these two figures are false promises.- Promises that need your manual work: deletions on request, and Customer and Lead deletions after 12 months, until ticket 22 ships; acting on "unsubscribe" replies, which reach the outbound mailbox and aren't handled by code.
- "We have assessed..." (If we emailed you) is only true once ticket 03's legitimate-interests assessment is done.
- Added beyond the grilling, check them: the
[DATE]and mailbox[LOCATION]placeholders; Stripe as "United States / Ireland" (its EU contracting entity is Irish); opting out by replying "unsubscribe".[PostHog retention]: the retention set in your PostHog project (for example, 1 year).- Describes the site after the switch to the Category Free Check (roadmap task 3 of the paid MVP): the current code still has a Waitlist with its own emails, which this policy doesn't cover. Publish it only once the Waitlist is removed.
Privacy Policy
Last updated: [DATE]
Who we are
CitedRate (citedrate.com) is run by [LEGAL NAME], a sole trader in Spain (NIF [TAX ID / NIF]), [POSTAL ADDRESS]. We are the controller of your personal data under the GDPR. Contact for anything in this policy: [CONTACT EMAIL] (privacy@citedrate.com).
What we collect, why, and for how long
When you run a Free Check
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| The Brand and Category you type, and the Result | To answer your check | Your request | Kept. They describe businesses, not people, and may appear in our public Category data. Anyone who has a Result's link can view it. |
Your IP address and a random id from the visitor cookie, both stored only as hashes with a salt that changes every day | To allow one Free Check per visitor per day and stop abuse | Legitimate interests (preventing abuse) | Hashes: 7 days. The raw IP and id aren't stored. |
| What Cloudflare Turnstile sees (your IP address and browser signals) | To tell people from bots | Legitimate interests (preventing abuse) | Handled by Cloudflare under its own terms |
| Your email, if you ask to get a queued Result by email | To send you that Result, and nothing else | Your request | 30 days |
Analytics
We count page views and the steps of the check and purchase (for example, "check requested" or "payment succeeded") in PostHog, hosted in the EU. Analytics use no cookies and no device storage: a visit gets a random id that lives only in the open page, so separate visits aren't linked and we build no profiles. When you buy, we link the purchase to that visit to learn which pages lead to payments. Legal basis: legitimate interests (improving the site). Kept: [PostHog retention].
Cookies
We set one cookie, and only when you run a Free Check:
| Name | What it holds | Purpose | Lifetime |
|---|---|---|---|
visitor | A random id | Enforces the one-Free-Check-a-day limit | 24 hours |
It is strictly necessary for the Free Check, so it doesn't need consent, and we show no cookie banner. We set no advertising or analytics cookies.
When you buy a plan
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Your email (from Stripe, kept in sync if you change it in billing) | To send the welcome email and Weekly Reports | Contract | Until 12 months after your subscription ends, or sooner on request |
| Your card and billing details | Payment | Contract | Held by Stripe; we never see your card number |
| Invoices | Accounting | Legal obligation | As long as tax law requires, held by Stripe |
| Your Own Buyer Prompts | To ask them every day for your report | Contract | Until 12 months after your subscription ends, or sooner on request |
| Your feedback answers (only sent when you press Send) | To improve the report | Contract | Until 12 months after your subscription ends, or sooner on request |
| Your report history | To show trends | Contract | Until 12 months after your subscription ends, or sooner on request |
We only send Customers service emails (the welcome email and the Weekly Report). We send no marketing emails.
If we emailed you
We sometimes email people at companies that could use CitedRate, a few at a time.
- What we hold: your name, role, work email address, company and country, and where we found them.
- Where it came from: your company's public web pages and Hunter (hunter.io), an email-finding service. We check the address with Hunter before writing.
- Legal basis: legitimate interests (telling businesses about a service relevant to their work). We have assessed that this doesn't override your interests, and we only write to work addresses about your job.
- Your right to object: you can object at any time, for free. Use the unsubscribe link in the email or reply "unsubscribe". We stop and never email you again.
- How long: if you don't reply, we delete your details 12 months after our last email. If you reply, we keep them while the conversation is active and delete them 12 months after the last message either way. If you become a Customer, the Customer rules above apply.
- The Suppression List: if you object or unsubscribe, we keep your email address and your company's domain on a list permanently. It's the only way to make sure we never email you again.
Who processes your data for us
| Processor | What for | Where |
|---|---|---|
| Supabase | Database | [REGION] |
| Amazon Web Services | Running the site and our processing | [REGION] |
| OpenAI | Asking AI models our questions. It receives Brands, Categories and questions (including Own Buyer Prompts), never your email | United States |
| Stripe | Payments, invoices and billing | United States / Ireland |
| Resend | Sending the welcome, Weekly Report and queued Result emails | United States |
| PostHog | Analytics | European Union |
| Cloudflare (Turnstile) | Telling people from bots | United States |
| Hunter | Finding and checking work email addresses | France |
| [OUTBOUND MAILBOX PROVIDER] | Sending emails to companies and receiving replies | [LOCATION] |
Where data goes to the United States, the transfer relies on the EU–US Data Privacy Framework where the processor is certified, and otherwise on the European Commission's Standard Contractual Clauses.
We don't sell your data. We make no automated decisions with legal or similar effects about you.
Your rights
Under the GDPR you can ask us to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. Write to [CONTACT EMAIL] (privacy@citedrate.com). We answer within one month.
If you think we've got it wrong, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es) or to the authority where you live.
Children
CitedRate is a business service and isn't meant for children.
Changes
If we change this policy, we update the date at the top. If the change matters for Customers, we tell them by email first.