Citeworthy Privacy Policy
Last updated: 29 July 2026
Citeworthy ("we", "us", "our") provides evidence-led audits that show whether AI assistants and search engines can accurately understand, verify, and recommend a business. This policy explains what personal data we collect, why, and what rights you have over it, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Citeworthy is operated by CITEWORTHY LTD, registered in England and Wales. Company number 17381854. Registered office: Suite RA01, 195–197 Wood Street, London, E17 3NU. CITEWORTHY LTD is the data controller for the personal data described in this policy.
If you have questions about this policy or want to exercise any of the rights below, contact us at support@citeworthy.com.
1. What data we collect, and why
Your account
When you sign up, we collect your name, email address, and password (stored securely by our infrastructure provider, never in plain text). We use this to let you log in, manage your account, and receive audit results and notifications. This is necessary to provide the service you've asked for (lawful basis: contract).
The business you audit
When you submit a business for audit, we collect and store the business name, address or service area, phone number, website, and category, sourced from what you tell us and from Google's public Places data. This is the core of what the service does (lawful basis: legitimate interest, since we are processing publicly available business information for the purpose of verifying and improving how it's represented, which is squarely what a business operating publicly should reasonably expect).
Authority to commission an audit
Before we run a full paid audit, we ask you to confirm your relationship to the business (owner, employee, agency, or authorised representative) and, where your email address doesn't automatically match the business's website domain, we may ask for evidence of your authority (a business email listed on the website, a phone confirmation, a short letter, or an agency confirmation naming the client). We keep a record of the outcome of this check (who verified it, how, and when), but we do not keep the supporting evidence itself once a decision has been made, only the fact that it was reviewed and the result.
Reviews and reputation data
As part of an audit, we look at public reviews of the audited business from Google. Review text may contain the personal opinions of the people who wrote them, who are not our customers. We use this to assess trust signals (lawful basis: legitimate interest, since these reviews are already public and we are using them for exactly the kind of verification purpose a reasonable reviewer would expect). We keep the full text of reviews for 7 days, after which it is removed; only our summary assessment (for example, whether a review raised a serious complaint) is kept for as long as your account is active.
Your website
We fetch the public pages of the business website you submit, to check things like technical accessibility, structured data, and consistency with your Google listing. We keep this data for 30 days, after which the raw content is removed and only our findings remain.
AI and search queries
To test whether AI assistants can find and recommend the business, we send a small number of queries to AI providers (currently Google's Gemini and Perplexity) and record their responses. We keep the raw responses for 30 days, after which they are removed; the summarised finding (for example, "mentioned in 1 of 3 test queries") remains as part of your report for as long as your account is active.
Payment information
If you pay for an audit, our payment processor, Stripe, handles your card details directly, we never see or store them. We keep a record of your Stripe customer reference and subscription status for as long as required by UK financial record-keeping rules, separately from the retention periods above (lawful basis: contract and legal obligation).
Technical and security logs
We keep operational logs (things like error reports and admin actions) to run the service safely and investigate problems, for 12 months (lawful basis: legitimate interest, in keeping the service secure and working).
Free preview
If you run a free, public-information preview of a business without creating a full paid audit, we do not retain full review text, do not build a fix-tracking history, and do not carry that data forward into a paid audit's records.
2. Who we share data with
We use a small number of specialist providers to run the service. Each only receives what it needs to do its specific job: Google (Places API, and Gemini via our AI infrastructure provider) sees business details, reviews, website content, and audit queries, for ground-truth business data and AI-assisted analysis. Perplexity sees business name, city, category, for live AI recommendation testing. SerpAPI sees business name, city, search queries, for checking directory and public-listing presence. Stripe sees payment details and your email, for payment processing. Supabase, our hosting provider, sees all of the above as our infrastructure. CQC and SRA, the relevant UK regulators, see business name and address, for checking public regulatory status where relevant to your industry.
We do not sell your data, and we do not use it to train third-party AI models on our behalf, we are still confirming this point directly with our AI providers and will update this policy once confirmed.
3. How long we keep things
Full review text: 7 days. Full website content fetched during an audit: 30 days. Raw AI query responses: 30 days. Your audit reports and findings: as long as your account is active, then 90 days. Operational and security logs: 12 months. Payment records: as required by UK financial law.
4. Your rights
Under UK GDPR, you have the right to access the personal data we hold about you, correct it if it's wrong, erase it (subject to the exceptions above, such as financial records we're legally required to keep), object to processing based on our legitimate interest, and complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your data.
To exercise any of these, email support@citeworthy.com. We'll respond within one month, as required by law.
If you're a reviewer whose review text we've processed as part of an audit, rather than a Citeworthy customer, the same rights apply to you, contact us at the same address.
5. Cookies
Citeworthy uses one first-party cookie, to remember whether you've collapsed a navigation panel, and a small number of first-party browser storage entries to keep you logged in and remember your recent activity. None of these track you across other websites. We load one third-party resource (Google Fonts) to display our typeface; this transmits your IP address to Google but sets no cookie. We do not currently run any analytics or advertising trackers.
6. Changes to this policy
We'll update this page if what we do with your data changes, and update the date at the top. If we make a significant change, we'll email you.