Last updated: October 11, 2026
1. Who we are
Citewise AI is operated by INCAA LLC, a Missouri limited liability company with its mailing address at 8301 State Line Rd, Ste 220-2254, Kansas City, MO 64114, United States. We are the controller of the personal data described in this policy. Contact us about privacy at [email protected].
2. Data we collect
- Account data: your name, email address and a hashed password, or your Google account identifier if you sign in with Google.
- Project data: brand names, domains, competitors, prompts and the AI answers and analysis generated for you.
- Billing data: purchase records (pack, amount, date, order identifier) received from Polar, our Merchant of Record. We never receive full card numbers.
- Communications: messages you send through the contact form or by email, and newsletter subscriptions (email address, confirmation status).
- Technical data: IP address and basic request information in server logs, used for security and rate limiting.
- Free tools: the website address you enter is used to run the check and is not stored with your identity.
3. How we use data
- To provide the Service: run checks, show results, send alerts you enable, and process credits (performance of a contract).
- To send transactional emails such as password resets and purchase confirmations (contract).
- To send the newsletter, only after you confirm your subscription (consent; unsubscribe at any time).
- To secure the Service, prevent abuse and enforce our Terms (legitimate interests).
- To meet legal, tax and accounting obligations (legal obligation).
We do not sell personal data, use it for advertising profiles, or use your project data to train AI models.
4. Service providers
We share data only with providers that help us run the Service, under contracts that limit their use of it:
- Polar: payment processing and Merchant of Record (checkout, tax, receipts).
- AI providers (OpenAI, Google, Perplexity AI, Anthropic): receive the prompts you track in order to generate answers. Prompts are sent through business APIs; do not put personal data in prompts.
- Resend: transactional email delivery.
- Google: sign-in, only if you choose “Continue with Google”.
- Hosting provider: servers and storage for the application and database.
We may disclose data if required by law or to protect rights and safety.
5. Cookies and local storage
We use one essential, HttpOnly session cookie to keep you signed in. Your browser's local storage remembers your light/dark theme preference. We do not use advertising or third-party tracking cookies. Google Fonts are loaded from Google's servers, and Google sign-in loads Google's script on the sign-in pages.
6. Retention
We keep account and project data while your account is active. When you delete a project or your account, the related data is deleted from our live database immediately. Purchase records are kept as long as required for tax and accounting (generally up to 7 years). Server logs are kept for up to 30 days.
7. Your rights
Depending on where you live (including under the GDPR, UK GDPR and California privacy law), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can export results and delete your account yourself in Settings, or email [email protected]. We respond within 30 days. You may also complain to your local data protection authority. We do not sell or share personal information for cross-context behavioral advertising.
8. International transfers
We are based in the United States, and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses offered by our providers.
9. Security
We use HTTPS, hashed passwords, hashed API keys and access controls to protect data. See our Security page. No system is perfectly secure; we will notify affected users of a breach as required by law.
10. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.
11. Changes
We will post changes here and, for material changes, notify account holders by email.
12. Contact
INCAA LLC, 8301 State Line Rd, Ste 220-2254, Kansas City, MO 64114, United States. Email: [email protected].