Privacy Policy

Cituna (“Cituna”, “we”, “us”) is a product of Eternum Capital FZE LLC, the company that operates cituna.com and is the controller of the data described below. Cituna is a tool that measures how AI answer engines and search reference your brand. This policy explains what we collect, how we use it, and the choices you have.

Information we collect

• Account information. When you create an account we collect your name, email address, and a securely hashed password. If you sign in with Google, we receive your name, email address, and Google account ID from Google (we never see your Google password).
• Scan data. The domains and URLs you submit for analysis, and the results we generate for them (visibility scores, AI-engine citations, competitor comparisons, and recommendations).
• Usage & technical data. Your IP address (used for rate-limiting and abuse prevention, and to look up which country you are visiting from), basic device/browser information, and a session cookie. While you are signed in, we also record which pages of the app you visit, linked to your account, so we can support you and improve the product. Visits to our public site before you sign in are recorded anonymously (page, coarse device type, country, and the channel you arrived by) and are never linked to an account. When you sign up or give us your email address, we note the country you were visiting from alongside how you first reached us. We store the country only, never the IP address, and we look it up on our own servers with the DB-IP IP to Country Lite database, so your address is not sent to anyone for this.
• Communications. If you email us or submit your address through the site, we keep that correspondence.
• Billing information. Stripe processes subscription payments for us. We receive billing contact details, subscription status, invoice and transaction identifiers, and limited payment-method details such as card brand, last four digits, and billing country. We do not receive or store your full card number or security code.

Cookies

The Google Ads tag measures visits from our ads using cookies and ad click identifiers. Google receives browser and page information for ad measurement. We keep ad personalization disabled. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked first; everywhere else, ad measurement is on unless you turn it off with the control below. Your choice is stored in your browser.

We use an essential, HTTP-only session cookie (cituna_token) to keep you signed in, and a first-party cookie (cituna_ft) that records how you first reached us so we can tell which channels bring people here.

When you arrive from a ChatGPT ad, we store its ad click reference in a first-party measurement record. When you start a verified trial or make your first collected subscription payment, we send OpenAI its time and type, the plan, payment amount and currency when applicable, a public landing-page URL, the ad click reference when available, and, so the event can be matched to the ad, a SHA-256 hash of your email address, your IP address, browser type and country. We do not include your card details, article content, prompts, reports, or Google Search Console data. In the European Economic Area, the United Kingdom and Switzerland we ask permission first.

Measurement cookies and attribution records expire after 30 days. We remove detailed event payloads after 30 days and retain a minimal delivery and duplicate-prevention record until account deletion. Use the control below to turn ad measurement off. Turning it off stops future delivery and removes stored attribution; it cannot recall events already received by OpenAI. These choices do not affect access to Cituna. Your browser keeps the date of your answer for 12 months so we do not ask again.

Manage cookie preferences

Email measurement

Marketing and product-update emails we send you contain a small tracking image and links that pass through our own domain, so we can record whether a message was opened and which links were followed. We use this only to see whether our emails are useful and to stop sending ones that are not. You can opt out of these emails at any time using the unsubscribe link in any of them, or from your notification settings.

Essential account emails are not measured this way and carry no tracking image or redirect links. That covers sign-in codes, password resets, billing receipts and security notices.

How we use your information

• To provide and operate the service and generate your scans and reports.
• To create and maintain your account and keep you signed in.
• To prevent abuse, enforce limits, and keep the service secure.
• To improve our features and respond to your requests.

Google Search Console

Connecting Google Search Console is optional and uses Google’s read-only https://www.googleapis.com/auth/webmasters.readonly permission. This lets Cituna list the Search Console properties you can access and read their search-performance data, including queries, pages, clicks, impressions, click-through rate, average position, and any dimensions you ask Cituna to report. It does not let Cituna submit sitemaps, request indexing, edit a property, or change your Google account.

We retain the connection token, the connected account email, accessible property list, and reports or derived results needed to provide the integration. Search Console data is used only to provide Cituna’s reporting, recommendations, and features you invoke, including read-only access through your Cituna MCP connection. It is not sent to AI answer engines as prompt input, used for advertising, or sold. You can disconnect Search Console in Cituna at any time and can also revoke Cituna from your Google account permissions.

AI processing & service providers

To produce results, we send the domain you submit and the queries we generate to third-party AI providers, OpenAI, Anthropic, Google (Gemini), Perplexity, and xAI. We also use third-party search-data providers to obtain search, ranking, and backlink data for domains and queries when those features are used.

Our other service providers are MongoDB for data storage, Hostinger for cloud infrastructure and transactional email, Stripe for subscription billing and payment processing, and Google for optional account sign-in and the optional Search Console connection described above. These providers process only the data needed for their role. We do not sell your personal information.

Data retention

We retain your account and scan data while your account is active. You can ask us to delete your account and associated data at any time (see “Your rights”).

To apply the one-trial rule, we keep a one-way hash of your email address and the card fingerprint our payment processor provides (never the card number), including after an account is deleted.

Security

Passwords are hashed, session cookies are HTTP-only, and traffic is served over HTTPS. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, contact us at support@cituna.com.

Children

Cituna is not directed to children under 16 and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you.

Contact

Questions about this policy or your data? Email support@cituna.com. The controller is Eternum Capital FZE LLC, which operates Cituna.