DPA / GDPR

CiteTrack AI is designed to support GDPR and similar privacy regimes.

Data residency

Plugin analytics are stored entirely within your own WordPress database, you remain the data controller and retain full ownership.

Data minimisation & pseudonymisation

IP addresses are hashed (SHA-256 with your site salt) before storage. Retention is configurable with a 30-day minimum, and a daily cleanup enforces it.

Data subject requests

The plugin integrates with WordPress’ privacy export and erase tools, and provides REST endpoints and a settings action to delete analytics by date range or in full.

Sub-processors

Our website uses Stripe (payments). The plugin’s citation features call the AI providers whose API keys you supply; those calls are made directly from your site to the providers you choose.

When you connect Google, Search Console/Analytics data is retrieved directly to your own site under read-only scopes; citetrackai.com only brokers the OAuth sign-in and stores no Google data. See the Privacy Policy for scopes and the Limited Use disclosure.

Your DPA

Need a signed Data Processing Agreement for our website services? Contact us and we’ll provide one.