CitenzoPrivacy Policy
This Privacy Policy explains what personal data Citenzo collects, why, how we use it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Portuguese data-protection law.
Citenzo is operated by Alex Spender, an individual (sole trader) based in Lisbon, Portugal (“we”, “us”, “Citenzo”). You can reach us at [email protected]. For privacy matters, Alex Spender is the data controller.
What we collect
We collect only what we need to run the service and answer you:
- Account data — your email address (we use passwordless magic-link sign-in, so we do not store a password), plan, balance and account settings. Your email is required to create an account and use most features.
- Project data you enter — your brand name, website, niche, competitors and the prompts you track. This is the data we analyze to produce your AI-visibility reports.
- Free-tool inputs — the domain, URL or brand you submit to a tool, and the email you give to receive a report.
- Payment data — handled by our payment provider (Stripe). We never see or store your full card number; we keep only limited billing metadata (e.g. plan, amount, status).
- Communications — messages you send via the contact form, support tickets or the “Ask our AI” widget.
- Usage and device data — cookies and similar technologies, and aggregate analytics (see our Cookie Policy).
Why we use it (legal bases)
- To provide the service you asked for — run checks, build reports, manage your account and process orders. Legal basis: performance of a contract.
- To take payment and prevent fraud. Legal basis: contract and legitimate interests.
- To send you the report or reply you requested, and essential service emails. Legal basis: contract / your request.
- To send marketing emails only where you opted in. Legal basis: consent (you can withdraw any time via the unsubscribe link).
- To measure and improve the site with analytics — only if you accept analytics cookies. Legal basis: consent.
- To keep the service secure and comply with law. Legal basis: legitimate interests / legal obligation.
AI processing of your inputs
To produce visibility results we send the brand, domain, competitor and prompt data you provide to third-party AI and search-data providers, which run the queries and return results. We instruct these providers to process the data only to deliver the service. We do not use your private project data to train our own models.
Who we share it with (processors)
We do not sell your personal data. We share it only with service providers that help us run Citenzo, under contracts that limit them to our instructions:
- Stripe — payments and Merchant-of-Record billing.
- Google (Analytics, Search Console) — website analytics and search performance.
- Resend — transactional and (opt-in) marketing email delivery.
- Fly.io (hosting), Neon (database), Upstash (cache) and Cloudflare (CDN, security) — infrastructure.
- AI and search-data providers used to generate reports — including OpenAI, Google, Perplexity, Anthropic, xAI and DataForSEO — which process the brand/query data you submit to return results.
Business customers (we as your processor)
If you use Citenzo to process personal data of your own customers or contacts, you are the controller of that data and we act as your processor, on your instructions. We will enter a Data Processing Agreement (DPA) with you on request — just email [email protected].
International transfers
Some of these providers are based outside the EU/EEA (for example in the United States). Where data is transferred outside the EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses to protect it.
How long we keep it
- Account and project data — for as long as your account is active, then deleted or anonymized within a reasonable period after closure (billing records are kept as long as tax/accounting law requires).
- Free-tool leads and marketing contacts — until you unsubscribe or ask us to delete.
- Analytics — per the retention set in our analytics tools.
Your rights
Under the GDPR you can ask us to: access your data; correct it; delete it; restrict or object to processing; port it to another provider; and withdraw consent at any time. To exercise any of these, email [email protected] and we will respond within one month.
If you believe we have mishandled your data, you can complain to your local supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD); in the UK, the Information Commissioner's Office (ICO); or the data-protection authority in your EU country of residence.
Automated decisions
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Our scores and reports are informational tools you use to make your own decisions.
Security
We protect your data with encryption in transit (HTTPS/HSTS), hashed credentials, access controls and reputable infrastructure providers. No method is perfectly secure, but we work to keep your data safe and will notify you and the authorities of a breach where the law requires.
Children
Citenzo is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes & contact
We may update this policy as the service evolves; we will change the “last updated” date above and, for material changes, notify account holders. Questions? Email [email protected].