Privacy Policy
Last updated: 25 August 2026 · Data controller: Inciteful Ltd, a company registered in England and Wales (company number 17400405), registered office 128 City Road, London, EC1V 2NX, United Kingdom (“we”, “us”).
1. What we collect
| Data | Why |
|---|---|
| Email address (yours and any team members you invite) | Account, login, transactional email, seats |
| Password (hashed with scrypt - never stored in plain text) | Authentication |
| Client workspaces you create: business name, website/domain, and competitors you track | To run and organise citation tracking per client |
| Tracked questions, and the AI answers, citations and cited source domains we record for them | To measure and show AI visibility over time |
| Content you generate (niches, clusters) and page snapshots we fetch from public URLs you give us | To generate, retrofit and save your work |
| Usage records (generations, checks, tracked questions per month) | Plan limits & billing |
| Billing identifiers (Stripe customer/subscription IDs) | Subscriptions (card data is held by Stripe, not us) |
| Optional integration credentials you connect - your own AI/search provider keys, Google Search Console authorisation, and CMS publishing tokens (WordPress, Shopify) - encrypted at rest with AES-256-GCM | BYOK tracking/generation, search-demand grounding, and one-click publishing, only if you choose to connect them |
2. How we use it
To operate your account, provide the service, enforce plan limits, process payments, send essential transactional emails (verification, password reset, receipts), secure the service, and comply with law. We do not sell your personal data.
3. Lawful basis (UK GDPR)
Performance of our contract with you (providing the service), our legitimate interests (security, service improvement), legal obligation (tax/records), and consent where required (e.g. optional emails).
4. Processors we share data with
- Vercel - application hosting
- Neon - database hosting (your account & content)
- Stripe - payment processing (card data handled directly by Stripe)
- Anthropic, OpenAI, Google, Perplexity - AI assistants we query for citation tracking and use to generate content (your tracked questions and niche/topic inputs are sent to these providers; per their terms this is not used to train their models)
- DataForSEO - retrieves AI-search and search-result data used for tracked questions, source intelligence and related analysis
- SerpApi - legacy or fallback retrieval for Google AI search results while provider migration is completed
- Google - Search Console (only if you connect it, to ground questions in real search demand) and Google Analytics (site usage on our own pages, and only with your consent - see §7)
- Resend - transactional email delivery
When you publish content, it is sent to the CMS you connect (e.g. WordPress or Shopify) using the token you provide. Some processors may store data outside the UK/EEA under appropriate safeguards (e.g. Standard Contractual Clauses).
5. Retention
We keep your account data while your account is active. When you delete your account, your account, content, sessions, and usage records are permanently deleted from our database (subject to short-lived backups and any records we must keep for legal/tax reasons).
6. Your rights
Under UK GDPR you can access, correct, export, or delete your data, and object to or restrict certain processing. We provide self-service data export and account deletion in your account settings. To exercise other rights, contact us. You may also complain to the ICO (ico.org.uk).
7. Cookies and analytics
We use one essential, HttpOnly session cookie to keep you logged in - it needs no consent because the service cannot work without it. On our own marketing, documentation and application pages we also offer Google Analytics (GA4) to understand how the site is used. Analytics is off by default: the first time you visit we ask, and GA4 is only loaded - and its first-party cookies (for example _ga) only set - if you choose Accept. Choose Decline and no analytics is loaded and nothing is stored beyond your choice. We do not run analytics on the white-label reports you share with your clients, and we do not use cookies for advertising. You can change your mind any time by clearing your site data.
8. Google user data (Search Console)
When you choose to connect Google Search Console, Inciteful accesses - with your consent and read-only (the webmasters.readonly scope) - the list of Search Console properties your Google account can access and that property's Search Analytics data (search queries, clicks, impressions, click-through rate, and average position). We use this data solely to show your own search-demand data inside your Inciteful dashboard and to compare it against your AI-citation results. We store only an encrypted refresh token and the Search Console property you select; we do not sell this data, use it for advertising, or share it with third parties, and you can disconnect at any time, which deletes the stored token. Inciteful's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. Security
Passwords are hashed (scrypt), sessions are signed (HMAC), optional API keys are encrypted at rest (AES-256-GCM), and traffic is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.
10. Contact
Privacy questions or requests: hello@tryinciteful.com.