Privacy Policy
What Inciteful collects, why, who processes it, how long it is kept, and how to exercise your rights.
Legal
Last updated: 25 September 2026 · Data controller: Inciteful Ltd, a company registered in England and Wales (company number 17400405), registered office 128 City Road, London, EC1V 2NX, United Kingdom (“we”, “us”).
1. What we collect
| Data | Why |
|---|---|
| Email address (yours and any team members you invite) | Account, sign-in, transactional email, seats |
| Password (hashed with scrypt, never stored in plain text) | Authentication |
| Client workspaces you create: business name, website or domain, and the competitors you track | To run and organise tracking for each client |
| Tracked questions, and the AI answers, citations and cited source domains we record for them | To measure and show AI visibility over time |
| Questions you ask the Agent, and its answers | To answer from a client’s own measurements, and keep your history |
| Pages we fetch from public URLs you give us | Site Health audits, and Proof checks of pages you ship |
| Request records from a log source you choose to connect for AI traffic | To show which AI assistants fetch a client’s pages |
| Free report requests: the domain you enter, your email address and a verification code | To run the report you asked for and send it to you; verifying creates your free account |
| Usage records (tracked questions, checks and Agent use each month) | Plan limits and billing |
| Billing identifiers (Stripe customer and subscription IDs) | Subscriptions (card data is held by Stripe, not by us) |
| Optional connections: Google Search Console authorisation and your own AI provider keys, encrypted at rest (AES-256-GCM) | Search-demand data and tracking on your own keys, only if you connect them |
2. How we use it
To operate your account, provide the service, run free reports you request, enforce plan limits, process payments, send essential transactional emails (verification, password reset, receipts), secure the service, and comply with law. We do not sell your personal data.
3. Lawful basis (UK GDPR)
Performance of our contract with you (providing the service), our legitimate interests (security, service improvement), legal obligation (tax and records), and consent where required (for example, optional emails and analytics).
4. Processors we share data with
- Vercel, application hosting
- Neon, database hosting (your account and measurements)
- Stripe, payment processing (card data is handled directly by Stripe)
- Resend, transactional email delivery
- AI model providers and AI answer data providers, the services we use to put tracked questions to AI assistants and to run the Agent. Your tracked questions are sent to them, and for the Agent, your question and the relevant client’s measurements.
- Google, for Search Console (only if you connect it) and Google Analytics (site usage on our own pages, only with your consent; see section 7)
Some processors store data outside the UK or EEA under appropriate safeguards, such as Standard Contractual Clauses. We do not publish content to any website on your behalf.
5. Retention
We keep your account data while your account is active. When you delete your account, your account, measurements, sessions and usage records are permanently deleted from our database, subject to short-lived backups and any records we must keep for legal or tax reasons.
6. Your rights
Under UK GDPR you can access, correct, export or delete your data, and object to or restrict certain processing. We provide self-service data export and account deletion in your account settings. To exercise other rights, contact us. You may also complain to the ICO (ico.org.uk).
7. Cookies and analytics
We use one essential, HttpOnly session cookie to keep you logged in. It needs no consent, because the service cannot work without it. On our own marketing, documentation and application pages we also offer Google Analytics (GA4) to understand how the site is used. Analytics is off by default: the first time you visit we ask, and GA4 is only loaded, and its first-party cookies (for example _ga) only set, if you choose Accept. Choose Decline and no analytics is loaded and nothing is stored beyond your choice. We do not run analytics on the white-label reports you share with your clients, and we do not use cookies for advertising. You can change your mind any time by clearing your site data.
8. Google user data (Search Console)
When you choose to connect Google Search Console, Inciteful accesses, with your consent and read-only (the webmasters.readonly scope), the list of Search Console properties your Google account can access and that property's Search Analytics data (search queries, clicks, impressions, click-through rate, and average position). We use this data solely to show your own search-demand data inside your Inciteful dashboard and to compare it against your AI-citation results. We store only an encrypted refresh token and the Search Console property you select; we do not sell this data, use it for advertising, or share it with third parties, and you can disconnect at any time, which deletes the stored token. Inciteful's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. Security
Passwords are hashed (scrypt), sessions are signed (HMAC), optional API keys are encrypted at rest (AES-256-GCM), and traffic is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.
10. Contact
Privacy questions or requests: hello@tryinciteful.com.
