Privacy policy

This policy covers the public website, owner dashboard, APIs we operate, emails we send, optional website integration beacons, and AI-visibility probes we run on your behalf. It does not cover third-party sites linked from listings (for example Google Business Profile or Yelp), or the privacy practices of AI assistants we query through providers.

Account data: name, email address, password (stored as a hash), locale preference, and email verification status.

Business profile data: NAP (name, address, phone), descriptions, services, Q&A, hours, credentials, media/photos, website URLs, and claim/verification records for listings you own or claim.

Usage and security data: pages viewed, search queries, snapshot and scan requests, approximate IP address (including for rate limiting), browser type, session cookies, and diagnostic logs needed to operate and secure the Service.

AI-visibility probe data: when you (or your plan’s scheduled jobs) run a snapshot or full scan, we store engineered prompts, assistant answers, mention/citation signals, competitors named, accuracy flags, and related metrics. Cached probe results may be retained for a limited time to reduce repeat API calls.

Reviews without an account: if a claimed listing accepts a public review, we store the name you type, the review text, the star rating, and the IP address used to submit it, so the owner can moderate it and we can limit spam. You do not need an account. Those reviews are not marked up as Google aggregate ratings.

Support messages: subjects and message content you send through in-app support tickets.

Billing data: handled by our payment processor. We receive subscription status, customer and subscription IDs, and limited payment metadata — not full card numbers.

Website snippet (Grow): if you install our optional website integration, we may receive referral events you configure (such as referrer host and landing path) for AI-referral analytics.

• Operate the directory and owner tools
• Authenticate users, verify claims, and prevent abuse (including rate limits and scan quotas)
• Run AI-visibility snapshots/scans you request or that your plan includes, and show you ask/answer probe logs and suggested actions
• Process subscriptions and send transactional email (verification, resets, notices)
• Provide owner support and improve reliability, security, and product quality
• Publish and update our accessibility evaluation materials
• Comply with law and enforce our Terms of use

We do not sell your personal information. Public listing fields you publish are intentionally visible to visitors and may be consumed by search engines and AI assistants.

We use vendors to run the Service. Key categories include:

• Hosting / infrastructure for application, database, and media storage
• Payments for checkout, subscriptions, and the billing portal
• Email for transactional messages when configured
• AI visibility monitoring to obtain live probe responses from assistants; prompts may include business name, category, city, and related public profile context
• Optional search assist when configured for search-intent helpers (falls back to rules if unset)
• Accessibility evaluation tooling that may crawl or evaluate public pages to produce our accessibility statement

Providers process data under contracts or terms that limit use to providing services to us, except where you interact with them directly (for example the payment checkout flow).

We may also share information with:

• Syndication targets you enable (for example Google, Bing, Apple, Yelp) to update external listings
• Legal / safety recipients when required by law or to protect rights, users, or the Service

We use essential cookies (or similar storage) to keep you signed in and to protect sessions. We do not use these essential cookies for third-party advertising. You can clear cookies in your browser; doing so will sign you out.

We keep personal and listing data only as long as needed to run the Service:

• Account and listing data: while your account is active. When you delete your account or permanently delete a business in Settings, we remove that data from our primary systems promptly (subject to short processing delays).
• AI check / visibility history: about 8 weeks of probe history on paid plans for your reports; free snapshots may be shorter. Older rows may be purged on a rolling basis.
• Probe cache: short-lived (typically days) to avoid repeat AI API calls.
• Support tickets: until resolved, then up to 24 months for service records unless you ask us to delete them sooner where allowed.
• Billing records: retained as required by tax, accounting, and payment-processor rules (via Stripe).
• Backups and logs: overwritten on a rolling schedule (typically ≤ 30 days for backups; security logs may be kept longer when needed to investigate abuse).

If you only remove a business from your account (unclaim) without permanent deletion, a public directory listing may remain as unclaimed. Information already copied to search engines, AI assistants, or syndication partners may persist until those parties update or remove it.

We use industry-standard measures such as hashed passwords, HTTPS, rate limits on sensitive actions (password changes, deletions), and access controls. You can change your password and sign out from Settings. No method of transmission or storage is 100% secure.

Depending on where you live (including California and certain other jurisdictions), you may have rights to access, correct, delete, or export personal information, or to opt out of certain processing. In the owner dashboard under Settings, you can:

• Update your name and language preference
• Change your password
• Remove a business from your account or permanently delete a business
• Delete your entire account (requires password confirmation)

Contact privacy@cita-me.app for other privacy requests. You can unsubscribe from non-essential emails via message links where provided.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them.

Cítame is operated from Ensenada, Baja California, Mexico. Hosting, payments, and AI providers may process data in the United States and other countries where those vendors run. If you use the Service from the United States, Mexico, or elsewhere, your information may be transferred to those locations.

We may update this policy and will revise the “Last updated” date above. Material changes may also be communicated by email or in-product notice when appropriate.

Privacy requests: privacy@cita-me.app. Accessibility feedback: accessibility@cita-me.app.