Privacy Policy

Citewell is operated by Blockstart Ltd (“Citewell”, “we”, “us”), registered in Scotland, company number SC783316, with its registered office at 272 Bath Street, Glasgow, G2 4JR, United Kingdom. Blockstart Ltd is the data controller for the personal data described in this policy.

Contact us about privacy at privacy@citewellgeo.com. We have not appointed a statutory Data Protection Officer, as our processing does not meet the threshold that requires one; the contact above reaches the person responsible for data protection at Citewell.

We collect the following categories of personal data:

• Account data. Your email address, and, if you sign in with Google, the name and email address Google shares with us. We do not receive or store your Google password.
• Workspace and billing data. Your workspace or agency name, brand and competitor names you enter, and — via Stripe, our payment processor — your subscription status. Citewell never receives or stores your card number; Stripe collects payment details directly.
• Content you submit. The buyer questions (“prompts”) you write, the domains you ask us to audit, and any notes or tags you add.
• Service data. The answers returned by third-party AI engines (ChatGPT, Claude, Perplexity, Gemini, Grok) when we run your prompts, and the citation, position, and sentiment analysis we generate from them.
• Technical and usage data. IP address, browser type, device information, session identifiers, and pages visited, collected directly and via Google Analytics on our marketing pages.
• Communications. Sign-in and transactional emails we send you, and any correspondence you send us.

• To provide the service (running prompts, generating reports, sending sign-in links) — necessary to perform our contract with you.
• To process payment and manage your subscription — necessary to perform our contract with you, and to comply with accounting and tax obligations we are subject to.
• To keep the service secure and prevent abuse — our legitimate interest in protecting Citewell and its users, balanced against your rights.
• To improve the product and understand how it is used — our legitimate interest in operating and improving Citewell.
• For analytics cookies on our marketing pages — only with your consent, given through our cookie banner. You can withdraw this consent at any time; see Section 8.
• To contact you about your account, billing, or material changes to the service — necessary to perform our contract with you, or our legitimate interest in keeping you informed.

We do not use your personal data to make any decision about you that has a legal or similarly significant effect without a human involved.

We share personal data only where necessary to provide the service, and only with processors bound by contractual data protection terms. We do not sell personal data.

• AI engine providers — OpenAI (ChatGPT), Anthropic (Claude), Perplexity AI, Google (Gemini), and xAI (Grok) receive the prompt text and country you specify, via their official APIs, in order to generate an answer. We do not send them your account email or billing details.
• Sign-in providers — Google, if you choose to sign in with it.
• Stripe, to process payments and manage your subscription.
• Resend, to deliver transactional sign-in emails.
• ImprovMX, which forwards email sent to support@citewellgeo.com and privacy@citewellgeo.com to our inbox. It handles the content and sender details of messages you send to those addresses.
• Vercel Inc. and Neon, who host our application and database.
• Google Analytics, for aggregate marketing-site analytics, where you have consented to analytics cookies.
• We may also disclose data where required by law, to enforce our Terms of Service, or in connection with a merger, acquisition, or sale of assets, subject to the same protections described in this policy.

Several of the processors listed above are based in, or process data in, the United States. Where we transfer personal data outside the UK or EEA, we rely on the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or on the processor’s own compliance with an approved transfer mechanism, to ensure your data continues to receive an equivalent standard of protection.

• Account and workspace data is kept for as long as your account is active, and for a reasonable period afterwards in case you return, after which it is deleted or anonymised.
• Billing records are kept for as long as required by UK tax law (currently six years from the end of the relevant accounting period).
• Reports are retained on a rolling basis (the most recent 24 per brand); older reports are automatically removed.
• If you close your account, we delete personal data associated with it within a reasonable period, except where we are required to retain it by law.

Under UK GDPR and EU GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“the right to be forgotten”);
• restrict or object to how we process your data;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent; and
• lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ICO); if you are in the EU, your local data protection authority.

To exercise any of these rights, email privacy@citewellgeo.com. We respond within one month, as required by law.

Citewell uses strictly necessary cookies (for example, to keep you signed in) that do not require consent. Our marketing pages also use Google Analytics, which sets non-essential cookies — these are only set once you have given consent through our cookie banner, and you can withdraw that consent at any time by changing your cookie settings.

We use industry-standard measures to protect personal data, including encryption of data in transit, access controls restricting who at Citewell can view your data, and reputable, security-audited infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Citewell is a business tool and is not directed at, or knowingly used by, children under 16. We do not knowingly collect personal data from children.

If you are a resident of California or another US state with its own privacy law, you may have additional rights over your personal data, including the right to know what data we collect and the right to request deletion. We do not sell personal data. To exercise these rights, contact privacy@citewellgeo.com.

We may update this policy from time to time. If we make a material change, we will notify you by email or by a notice on the site before it takes effect. The “effective date” above shows when this policy was last revised.

Blockstart Ltd, 272 Bath Street, Glasgow, G2 4JR, United Kingdom. Email: privacy@citewellgeo.com.