Privacy policy
Last updated: 11 November 2026
This is the English version. If anything is unclear or the language versions differ, the Polish version prevails.
This policy explains how we process personal data in connection with the CiteLyzer service at citelyzer.com - both the website and the application with customer accounts, subscriptions, and brand-visibility tracking. The service is intended for businesses and we do not process consumer data as customer data, but personal data of the people involved (such as user e-mail addresses or sole traders’ invoice details) remains protected under the GDPR as described here.
Who is responsible
The data controller is SOLID SOFTWARE Piotr Czerwiński, Szkolna 4, 55-114 Kryniczno, Polska, NIP: PL9151812835. For any privacy question or request, contact us at contact@citelyzer.com.
What we collect
Account data: your e-mail address, and which version of the Terms and of this policy you accepted when creating the account, with the time (proof of the agreement). Signing in is passwordless - with one-time codes sent to your e-mail - so we store no password at all. Billing data: payments are handled by Stripe, and you provide your card details directly to Stripe - we do not store full card numbers; for invoicing we process the details you provide for the invoice (name or company name, address, tax ID), issued via Fakturownia. Product usage data: the configuration you create in the app - the domain and phrases you track, competitors you add - and the resulting metrics. Request form data: if you ask for an agency quote or apply to the partner programme, we process your e-mail address, your website address, your message (for a quote also the number of brands) and - if you provide it - your company name; this data is stored in Brevo and used only to reply to your request. Free website check: when you use the free AI-visibility checker, we record the domain you entered, the result, the time of the check and a one-way hash of your IP address. We need this to protect the tool from abuse (rate limiting) and to understand how much interest the service attracts; the legal basis is our legitimate interest. Technical data: essential session cookies needed to keep you signed in, and product analytics collected via PostHog (EU region). One-off report orders: if you buy a report without an account, we also process the e-mail address, brand, domain, prompts and competitors you provide with the order, together with order, delivery and consent records. Free report sample: when you prepare a report sample, we record the domain you entered, the market, the step you reached (plan, sample or the reason a site could not be read) and the campaign tags of the page you came from (utm_*); we do not store entries rejected as not being a website address. If you ask us to e-mail you the link to your sample, we process that e-mail address and - only if you tick the separate, optional box - your consent to receive an offer for the full report or ongoing AI visibility monitoring, with the time it was given and the version of its text.
Why we use it and on what legal basis
To provide the service - creating and securing your account, running the tracking you configure, processing subscriptions and payments, and customer support (performance of a contract, Art. 6(1)(b) GDPR). To issue and store invoices and meet tax and accounting obligations (legal obligation, Art. 6(1)(c) GDPR). To understand how the product is used, improve it, and keep the service secure and free of abuse (legitimate interest, Art. 6(1)(f) GDPR). To reply to a request sent through the agency quote or partner programme form (steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR). To send you e-mails about AI visibility and product news if you ticked the optional box when ordering a one-off report (consent, Art. 6(1)(a) GDPR - you can withdraw it at any time, and the report and invoice reach you regardless). To send the link to your report sample when you ask for it (steps taken at your request, Art. 6(1)(b) GDPR), and to send you an offer for the full report or ongoing AI visibility monitoring if you ticked the separate box next to it and then confirmed it on the sample page opened from that e-mail, or gave it there with one button (consent, Art. 6(1)(a) GDPR - the link goes out regardless, we send no offer before the confirmation, and every such e-mail has a one-click withdrawal link). To see where visitors of the report form stop - the domain register described above (legitimate interest, Art. 6(1)(f) GDPR). To analyse how the site and the app are used with session recordings, and to measure our ads (consent given in the banner, Art. 6(1)(a) GDPR - details under “Cookies”); without that consent, only counting visits and events with nothing stored on your device (legitimate interest, Art. 6(1)(f) GDPR). We do not sell your data. We may compile anonymised, aggregated statistics from measurement results (for example average visibility in an industry) from which no individual user’s brand, domain or phrases can be identified; we do not publish a specific user’s data without their consent. We use your account e-mail address to send CiteLyzer tips, news and offers only if you tick the separate, unticked consent box when creating the account or switch the consent on in the account settings (consent, Art. 6(1)(a) GDPR, and the rules on electronic marketing). We record the version of the consent text, the language, the time and every grant and withdrawal; you can withdraw consent at any time in the account settings, which does not affect the lawfulness of processing before the withdrawal.
Cookies
We use essential session cookies that are necessary to sign you in and keep your session secure - the service cannot work without them; your choice in the banner is also kept in your browser (for 12 months, then the banner asks again). Everything else runs only with the consent you give in the banner, separately for each purpose, and you can change or withdraw it at any time with the “Privacy settings” button in the page footer or at the top of this policy (withdrawal does not affect processing before it). Analytics and session recordings (PostHog, EU region): your path through the site and the app, and session recordings (mouse movement, clicks, pages viewed, and what is shown and typed on screen); the analytics identifier is kept in your browser’s local storage, not in cookies, and we do not include the domains or phrases you track in event properties. In those recordings we mask sign-in details, contact details and payment details typed into forms - they are never recorded; what you enter to set up a measurement (brand, domain, questions, competitors) can be visible in a recording. Without this consent (before you choose and after “Reject”) PostHog only counts visits and events, stores nothing on your device and records nothing; visitors are told apart by a hash computed on PostHog’s servers that cannot recognise anyone from one day to the next (legitimate interest: statistics and finding errors). Ad measurement (Meta Platforms Ireland, OpenAI Ireland): with this consent the Meta Pixel loads (Meta advertising cookies) to measure ad effectiveness and select ad audiences; when you arrive from an ad in ChatGPT we keep the click identifier from that link (oppref) for your visit, and if you request a free sample, buy the report or open an account with a trial from an ad link, our server sends that identifier with the event type, time, page and amount to OpenAI - never your name, e-mail address, IP address or browser data. When you buy the report or open an account with a trial from an ad link, our server also sends Meta (Conversions API) a one-way hash of your e-mail address to match the event with the ad. Without this consent the Pixel does not load, the click identifier is neither stored nor sent, and nothing is sent to Meta or OpenAI. We also record every banner choice on our server as proof of consent (Art. 7(1) GDPR): a random identifier kept in your browser, the choice for each purpose, the version of the banner text, the language, the page, the country and the time, with no IP address and no account data; the records are kept for 3 years (legal obligation, Art. 6(1)(c) GDPR).
Who processes it
We use a small number of providers acting as processors or independent controllers: Cloudflare (application hosting, database and bot protection on forms - Turnstile; data may be processed within Cloudflare’s global network with GDPR safeguards such as standard contractual clauses), Stripe (payment processing), Fakturownia (invoicing), PostHog with data hosted in the EU (product analytics), Brevo (storing requests from the agency and partner programme forms, and e-mail delivery - account e-mails such as sign-in messages, report e-mails and the report sample link) and - with your marketing consent - Meta Platforms Ireland (Meta Pixel and the Conversions API for ad measurement; data may be transferred to the US with GDPR safeguards such as standard contractual clauses) and OpenAI (OpenAI Ireland Ltd; measurement of ChatGPT ads: the ad-click identifier with the event type, time, page and order amount, never your contact or billing details; data may be transferred to the US with GDPR safeguards such as standard contractual clauses). To run measurements and analyse the results we pass to AI engine providers and specialised technical intermediaries only the data the measurement needs: the tracked phrases, brand and domain names (including a company name typed into the report form instead of an address, used once to look up its website) and publicly available content - never your contact or billing details. We do not train any AI models on users’ data. Measurement, however, means sending the tracked phrases to publicly available AI chats and AI search engines, whose operators process these queries under their own terms; so do not include confidential information or personal data in your phrases. Where a provider processes data outside the EEA, transfers are covered by appropriate safeguards under the GDPR.
Google Search Console and Bing Webmaster Tools data
If you connect a brand's Google Search Console or Bing Webmaster Tools in the app, we read, with read-only access, the search statistics of that brand's site only: search queries, pages, clicks, impressions and average position for the last 28 days, refreshed once a day. Google asks for permission to the whole Search Console account and a Bing API key opens the whole Bing account, but we use only the site on the brand's domain and skip everything else. We use this data only to show it to you in the app, to suggest questions for the AI chat measurement (a suggested question is measured only after you add it) and to point out which of the brand's pages to improve. We do not sell it, do not use it for advertising or to train AI models, and do not pass it to anyone other than the processors that run the service. People at CiteLyzer do not read it except with your permission, for security, or where the law requires it. The Google access token and the Bing key are stored encrypted, and the part of the application that shows the data cannot decrypt them. Disconnecting in the app, or deleting your account, deletes the token or key and the downloaded data at once and revokes the access at Google; you can also revoke it yourself in your Google account settings (https://myaccount.google.com/permissions) and invalidate a Bing key by generating a new one. CiteLyzer's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
How long we keep it
Account and product data: until you delete your account - you can do this yourself at any time in the account settings, which permanently removes your data. An inactive account, meaning one with no active plan or trial and no sign-in for 12 months, is deleted together with its data; 30 days before the deletion we send a message to the account’s address, and signing in during that time keeps the account. Invoices and accounting records are the exception: we must keep them for the period required by tax and accounting law (as a rule, 5 years counted from the end of the relevant tax year). One-off report orders: unpaid orders are deleted automatically after 30 days, and data of completed orders is kept for as long as needed to deliver the report, handle complaints, and establish or defend legal claims (invoices - as above). Free website checks: deleted automatically after 12 months. Report samples: the sample itself (domain, brand, questions and results) is kept so that its link keeps working; you can ask us to delete it at any time. The domain register of the report form: deleted automatically 12 months after the last visit. E-mail addresses left on a sample page: without a confirmed offer consent, deleted automatically 30 days after they were left or after the consent was ticked, whichever is later; with a confirmed consent, until you withdraw it, and then within 30 days. Request form data: until you ask us to delete it. We may retain limited data for as long as necessary to establish or defend legal claims.
Your rights
Under the GDPR you have the right to access your data, correct it, delete it (including the self-serve account deletion in the account settings), restrict or object to its processing, receive it in a portable format, and withdraw consent at any time where processing is based on consent. To exercise any of these, email contact@citelyzer.com. You also have the right to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (PUODO), or the authority in your country of residence.
How we protect your data
Signing in is passwordless: one-time codes sent to your e-mail are short-lived, allow only a few attempts, and their sending is rate-limited - there is no password that could leak. Connections to the service are encrypted, and access to production data is limited to what is necessary to operate the service.
Changes to this policy
If we materially change this policy, we will update the date at the top and, for changes that affect account holders, inform you by e-mail or in the app. This policy is drawn up in Polish and is also available in English, German, French, Spanish, Dutch and Slovak; if anything is unclear or the language versions differ, the Polish version prevails.