Privacy Policy

This Privacy Policy explains how SEO RANK SERP LLC ("CiteTrack AI", "we", "us") collects, uses, stores, shares, and protects information across our products and services:

• the website at https://citetrackai.com (marketing site, knowledge base, customer accounts, and checkout);
• the CiteTrack AI WordPress plugin that customers install on their own websites;
• the CiteTrack Chrome extension (covered by its own policy, see Section 13); and
• our Google integrations (Search Console and Google Analytics 4).

If you have questions, contact us through our contact form or by post at 8 The Green, Dover, DE 19901, USA.

1. Who we are and how this policy is structured

Our website address is https://citetrackai.com.

CiteTrack AI plays two different roles depending on the context:

As a controller, for our own website visitors, account holders, and customers (billing, support, marketing, license management). We decide why and how that data is processed.

As a processor / service provider, for data that the CiteTrack AI plugin handles on a customer’s own WordPress site (for example, a customer’s website-visitor logs). That data is stored on the customer’s own server and under the customer’s control; we process it only to provide the plugin’s functionality and do not use it for our own purposes.

The sections below indicate which role applies.

2. Information we collect

2.1 Website, accounts, and checkout (we are the controller)

Account data: name, email address (your email also serves as your username), and password (stored hashed).

Billing and payment data: orders, license keys, plan, billing country, and VAT/tax ID where applicable. Card/payment details are processed by Stripe and are never stored on our servers, we receive only transaction metadata (e.g., status, amount, last four digits where provided by Stripe).

License and site data: the license key and the site URL(s) on which you activate the plugin, plus activation/validation timestamps, used to enforce seat limits and deliver updates.

Support and communications: the contents of support tickets, emails you send us, and our replies.

Website usage: standard server logs and, where enabled, privacy-respecting analytics about how the marketing site is used.

Comments (WordPress default): when visitors leave comments we collect the data shown in the comment form, plus the visitor’s IP address and browser user-agent string to help spam detection. An anonymized hash of your email address may be sent to Gravatar (privacy policy: automattic.com/privacy); after approval, your profile picture may be visible alongside your comment.

2.2 The CiteTrack AI plugin, running on a customer’s own site (we are the processor)

When the plugin is installed on a customer’s WordPress site, it processes the following on that customer’s own server. This data is stored in the customer’s own database and is not transmitted to CiteTrack AI:

AI-crawler / bot logs: for each front-end request, the requested URL, HTTP status, response time, the browser/bot user-agent string, a one-way hashed (salted SHA-256) IP address (the raw IP is not stored when IP hashing is enabled, which is the default), and a bot classification. Used to show which AI crawlers reach the site.

AI citation tracking: the customer’s tracked prompts, the AI engine responses, cited source URLs, sentiment, and share-of-voice. Engine queries are made directly from the customer’s server using the customer’s own AI provider API keys (Perplexity, OpenAI, Google, Anthropic). CiteTrack AI does not proxy or receive these queries or responses.

Stored credentials: AI provider API keys and connected-service tokens are encrypted at rest (AES-256-GCM) in the customer’s site.

Attribution data: a first-party cookie (ctai_sid) and records of visits that arrived from AI assistants, plus conversions/leads (e.g., WooCommerce/EDD orders or form submissions) used to attribute revenue. See Section 6.

On-page optimization data: content scores and suggested fixes for the customer’s own posts/pages.

The customer (site owner) is the controller of this data and is responsible for their own privacy notices to their visitors.

2.3 Google Search Console and Google Analytics 4

See Section 4.

2.4 Media and embedded content (WordPress default)

If you upload images to the website, avoid images with embedded location data (EXIF GPS), which visitors could extract. Articles may include embedded content (videos, images, posts) from other websites; that content behaves as if you visited the other site directly and those sites may collect data about you, set cookies, and track your interaction with the embedded content.

3. How we use information

We use information to: provide and operate the products; create and manage your account; process payments, taxes, and licenses; deliver software updates; provide customer support; detect and prevent fraud, abuse, and spam; comply with legal obligations; and, where permitted, send service and (with consent where required) marketing emails. You can unsubscribe from marketing emails at any time.

We do not sell your personal information, and we do not use data obtained through Google APIs for advertising or to train generalized AI/ML models (see Section 4).

4. Google user data (Search Console & Analytics)

With your explicit authorization, CiteTrack AI connects to your Google account to provide analytics inside your own WordPress dashboard. This connection uses one-click sign-in brokered by citetrackai.com.

What we access (read-only):

• Google Search Console (webmasters.readonly), your verified properties and per-URL index/coverage status.
• Google Analytics 4 (analytics.readonly), reporting data such as sessions, page views, and engagement, plus the list of GA4 properties on your account.

How it is used: solely to display index status and AI-traffic analytics to you within your own WordPress admin. We do not use it for any other purpose.

Where it is stored: the OAuth tokens and any retrieved Google data are stored on your own WordPress site (tokens encrypted at rest). citetrackai.com acts only as a secure sign-in relay, it brokers the OAuth handshake and stores nothing beyond short-lived, single-use transients needed to complete sign-in.

How we protect it: all data exchanged with Google is encrypted in transit using HTTPS/TLS, and your Google OAuth tokens are encrypted at rest (AES-256-GCM) on your own WordPress site. Any Google data retrieved for display is held only on your own server, protected by your site’s authentication and access controls. The short-lived sign-in state handled by citetrackai.com is transmitted over encrypted connections, is single-use, and is discarded within minutes. Security procedures are in place to protect the confidentiality of your Google user data against unauthorized access, alteration, disclosure, or destruction.

Sharing: we do not transfer Google user data to third parties, except as required to provide the integration at your direction or as required by law.

Limited Use disclosure. CiteTrack AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not: sell Google user data; use or transfer it for serving advertisements; use it to train, improve, or develop generalized/non-personalized AI or ML models; or allow humans to read it except (a) with your affirmative consent, (b) for security/abuse/legal compliance, or (c) where the data is aggregated and anonymized.

Pushing events to GA4 (optional, separate). If you enable it, the plugin can send AI-related events from your site into your own GA4 property using the Measurement Protocol (with a Measurement ID and API secret you provide). This sends event data to Google at your direction; it is governed by Google’s policies and your own GA4 configuration.

You can revoke this access at any time by disconnecting Google inside the plugin, or via your Google Account permissions.

5. Microsoft Clarity (optional)

If a customer enables the Microsoft Clarity integration, behavioral analytics (e.g., engagement, scroll depth, dead/rage clicks) are processed by Microsoft Clarity under Microsoft’s privacy terms (privacy.microsoft.com). The customer provides their own Clarity project ID and export token, and may optionally have the plugin inject the Clarity tag on their site.

6. Cookies

Comment cookies (optional): if you leave a comment you may opt in to saving your name, email, and website in cookies for convenience; these last one year.

Login/admin cookies (WordPress): temporary cookies to check cookie support; login cookies (2 days, or 2 weeks with "Remember Me"); screen-option cookies (1 year); a post-edit cookie (1 day). These contain no marketing data.

ctai_sid (attribution): a first-party cookie set by the CiteTrack AI plugin on a customer’s site to recognize a visitor session that arrived from an AI assistant, so a later conversion can be attributed. It is HttpOnly, SameSite=Lax, and expires after 7 days. It contains a random session identifier only.

7. Who we share data with (sub-processors)

We share data only with service providers that help us run the products, under contracts that limit their use of the data:

Transactional and account emails (for example, receipts and password-reset messages) are sent using the built-in WordPress email function through our hosting infrastructure; we do not use a separate third-party email-delivery service.

Your own AI provider keys (OpenAI, Perplexity, Google, Anthropic) are used by the plugin on your site; those providers process queries you initiate under their own terms. If you request a password reset, your IP address is included in the reset email. Visitor comments may be checked by an automated spam-detection service.

We may also disclose data to comply with law, enforce our terms, or protect rights, safety, and security; and in connection with a merger, acquisition, or asset sale (with notice where required).

8. How long we retain data

Account, license, billing, and tax records: for as long as your account is active and thereafter as required for legal, accounting, and security purposes.

Support communications: as long as needed to resolve and document the matter.

Comments: retained indefinitely so follow-ups can be auto-approved.

Plugin data on a customer’s site: controlled by the customer. Crawl logs are retained for a configurable period (default 365 days, minimum 30) and then deleted automatically; the customer may shorten this or delete data at any time, and may purge all plugin data on uninstall.

Google user data: stored only on your own WordPress site for as long as the connection is active. Disconnecting Google in the plugin deletes the stored tokens from your site; you can also revoke access from your Google Account permissions at any time.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, export (portability), restrict, or object to processing of your personal data, and to withdraw consent.

EU/UK (GDPR/UK GDPR): our legal bases are contract (to provide the service), legitimate interests (to secure and improve the service, prevent fraud), consent (for marketing and certain cookies), and legal obligation. You may lodge a complaint with your supervisory authority.

California (CCPA/CPRA): you may request access, deletion, and correction, and may opt out of "sale"/"sharing", we do not sell or share personal information as those terms are defined.

If you have an account or have left comments, you can request an export or erasure of the personal data we hold about you, excluding data we must keep for legal, administrative, or security reasons. To exercise any right, submit a request through our contact form. We verify requests before acting and respond within the timeframes required by law.

10. International transfers

We may process and store data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) for international transfers.

11. Security

We use technical and organizational measures appropriate to the risk, including encryption of secrets at rest (AES-256-GCM), encrypted transport (HTTPS), access controls, and salted hashing of visitor IP addresses by default. No method of transmission or storage is 100% secure, but we work to protect your data and to notify you and regulators of incidents where required.

12. Children’s privacy

Our products are not directed to children under 16 (or the age of digital consent in your region), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

13. CiteTrack Chrome Extension

CiteTrack AI also publishes a Chrome extension, the CiteTrack SEO/AEO/GEO Toolkit. Because it handles different data than this website, including current-page audit data, page URLs, technical SEO metadata, user-created screenshots, responsive-preview data, local extension settings, and optional browser permissions, it has its own privacy policy.

The extension is a no-login, local-first tool: audits, screenshots, capture/blur workflows, asset checks, responsive previews, and exported reports are processed locally in your browser by default and are not uploaded to CiteTrack AI unless you intentionally send them to us (for example, through support).

14. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date and, where appropriate, communicated to account holders.

15. Contact

SEO RANK SERP LLC, 8 The Green, Dover, DE 19901, USA. Privacy enquiries: citetrackai.com/contact.