Privacy policy

Controller

The controller for your data on this website and in the app is:
Andrej Gluchow, Brahmsstr. 6, 57577 Hamm, Deutschland
Email: info@certentis.com

Where the contract with you is named below as the legal basis (Art. 6(1)(b) GDPR) and our contract partner is your company rather than you, we rely instead on our legitimate interest in performing the contract with your company (Art. 6(1)(f) GDPR).

What we process and why

Visiting the website

When you open a page, our hosting provider Vercel stores technical data: IP address, time, the address you opened, browser and operating system. We need it to deliver the website and to fend off attacks (Art. 6(1)(f) GDPR). The logs are deleted after [retention period of Vercel logs on the booked plan].

Account and sign-in

For your account we store your email address, your password only as a hash (never in plain text) and your language setting. If you sign in with Google, Google sends us your name, email address and profile picture (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Confirmation emails are sent through Supabase. The legal basis is our contract with you (Art. 6(1)(b) GDPR). On every sign-in Supabase logs your IP address and browser to detect abuse (Art. 6(1)(f) GDPR). These logs are deleted after [retention period of Supabase sign-in logs]. To stop password guessing we also count sign-in attempts per IP address and per email address. We store both only as a hash for this, and the counters expire after 15 minutes (Art. 6(1)(f) GDPR).

Projects and articles

To provide the service we store what you create in the app: domains, company description, audiences, competitors, keywords, keyword research chats, articles, answers to expert questions, author details and uploaded images (Art. 6(1)(b) GDPR). Database and files are hosted by Supabase in Frankfurt am Main. Article images and style references sit at a public address that can't be guessed, so you can embed them on your website. Anyone who knows that address can open the image.

While Citapult works on a research or an article, Vercel stores the intermediate steps so the work can resume after an interruption (Art. 6(1)(b) GDPR). They are deleted after [retention period of Vercel workflow data].

Payment

When you start the Pro trial or book Pro, we set you up as a customer at Stripe and send it your email address, your language and an internal ID of your account. In Stripe's checkout window you then enter your name, billing address, your VAT ID if you like, and your payment details (Art. 6(1)(b) and (c) GDPR). Stripe charges Pro after the trial, “Start Pro now” and add-ons per website to the payment method stored there. Stripe issues the invoices and collects the payments. We only store your Stripe customer number and what your websites’ subscriptions include; we never see your card or account details. Stripe tells us whether a payment succeeded, so we can pause a website while its payment fails. Stripe also processes payment data as a controller in its own right, for example to prevent fraud.

Text and images with AI

For profile suggestions, keyword scoring, articles, rewrites and images we send the content needed to OpenRouter, Inc. (USA). OpenRouter forwards it to a provider that runs the chosen model, such as OpenAI (USA). This includes text from your website, your project details, your answers to expert questions and images you upload as style references. The legal basis is our contract with you (Art. 6(1)(b) GDPR). Only enter personal data about other people if the article needs it.

Keyword and search data

For search volume, difficulty and Google results we send keywords, domains and the chosen language to DataForSEO and Serper. No account details are sent. To read content, our server fetches public pages from your domain and from the search results. If it can't read a page itself, it sends the page address to Serper, which fetches it for us. If “Embed a YouTube video” is on, it searches YouTube for a matching video.

Visibility in Google and AI answers

If you use visibility tracking, we regularly look up the keywords and questions you track for your website: Google rankings through Serper and DataForSEO, answers from ChatGPT, Google AI Overview and Google AI Mode through DataForSEO, and answers from Gemini through OpenRouter. These services receive the text of the query, the language and the country. To evaluate the answers, we send them to a language model at OpenRouter together with your brand name and your competitors' domains. If you add recipients for the weekly report, we store their email addresses. The report is not sent yet. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

Google Search Console

If you connect a project to Google Search Console, you give us read-only access at Google. For this we store an access key from Google, encrypted. With it we fetch the clicks, impressions and positions of the chosen property every day, per day, page and search query (the search queries split by the countries of your languages), and store them with the project. The numbers stay with us: when the agent revises a falling article, the language model only learns that it fell. We change nothing in your Search Console. If you disconnect, we delete the key and the numbers; only an improvement keeps the numbers that triggered it. You withdraw the access itself in your Google account under “Third-party apps & services”. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

Publishing to your website

If you connect a project to WordPress, Webflow, a webhook or your Next.js website, we store the keys this needs, encrypted. Citapult then sends articles and images to your website or to Webflow, or holds them ready for your website to fetch (Art. 6(1)(b) GDPR). What happens to the content there is up to you or your website's provider.

Analytics and advertising

We use Google Analytics to see how the website and the app are used, and Google Ads to measure which of our ads lead to sign-ups and purchases. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Both are on until you turn them off. On your first visit a notice appears at the bottom of the page where you can turn analytics and advertising off, separately or together. After that you can change this at any time under “Cookie settings” in the website footer, on the sign-in pages and in the app (footer and account menu).

While analytics is on, Google Analytics receives page views and these events: sign-up and sign-in (by email or Google), starting a purchase and the purchase with amount and currency, the setup steps, newly added websites, articles generated and published, and connecting Search Console. We shorten page addresses first, so project and article IDs, query parameters and page titles don't reach Google. The events contain only internal IDs, amounts and fixed values, no names, email addresses or domains. If you're signed in, we send your account's internal ID as the user ID. Google sets the cookies _ga and _ga_… for this. We store the ID from _ga with your account, so our server can report purchases and articles generated and published to Google Analytics even when no page is open.

While advertising is on and you arrive through an ad, we keep the click ID from the address (gclid, gbraid or wbraid) and the campaign details utm_source, utm_medium and utm_campaign in a cookie for 90 days. When you sign up or book, we store them with your account and with the booking. After your first payment and after every subscription renewal we report to Google Ads the click ID, the time, amount and currency of the payment and the Stripe invoice number. Your name, email address or phone number are not sent to Google. The Google Ads tag in your browser sets cookies whose names start with _gcl_.

The legal basis is our legitimate interest in measuring how our service is used and in targeting our advertising (Art. 6(1)(f) GDPR). [Have a lawyer check the opt-out approach under § 25 TDDDG] Google may also process the data in the USA and relies on the EU-US Data Privacy Framework for that.

Turning analytics or advertising off takes effect immediately: we delete the matching cookies, send no more events and cancel reports to Google that are still pending. If you're signed in, we also store your choice with your account, delete the analytics ID or the click ID and campaign details stored there, and report nothing more to Google while it stays off. The details we recorded along with your sign-up and your bookings stay stored until your account is deleted. Your browser still loads the Google tag from Google. Google receives your IP address and details about your browser, but the tag no longer sets analytics or advertising cookies. Google deletes what it has already received after [retention period in Google Analytics and Google Ads].

Images from other servers

During setup the app shows you images from your website, and in the settings images at addresses you enter as examples. Your browser loads these images directly from the server they sit on. That server receives your IP address and details about your browser, but not the address of the page the request comes from (Art. 6(1)(b) GDPR).

Embedded YouTube videos

If an article contains a YouTube video, the editor first shows only a placeholder. Only when you click it does the editor load the video from youtube-nocookie.com, a service of Google Ireland Limited. Google then receives your IP address and details about your browser, and YouTube may use cookies or similar storage on your device. Google may also process this data in the USA and relies on the EU-US Data Privacy Framework for that. By clicking you consent for that one video (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Once you close or reload the page, the editor loads no video until you click again. Cookies YouTube has already set can be deleted in your browser.

Cookies and local storage

These are the cookies and browser storage entries Citapult uses:

• Sign-in: Supabase keeps your session in cookies while you're signed in.
• rq_consent: your choice in the cookie settings, for one year.
• rq_ads_click: an ad's click ID and campaign details, 90 days, only while advertising is on.
• rq_events: passes an event such as a sign-in on to the next page after a redirect, at most five minutes, only while analytics is on.
• _ga and _ga_… from Google Analytics while analytics is on, and _gcl_… from Google Ads while advertising is on. Google sets how long they last.
• In your browser's storage: whether you chose the light or dark theme, the list of your keyword research chats and, until you close the tab, short markers, for example that an article is being generated or an event was already reported. These entries never leave your device.

The session, your choice and the browser storage entries are needed for the service and your settings to work, and need no consent (§ 25(2)(2) TDDDG). You can turn analytics and advertising off at any time, see “Analytics and advertising”. For embedded YouTube videos see above. Fonts load from our own server.

Recipients and transfers outside the EU

These providers process data for us:

• Vercel Inc., USA: hosting and intermediate steps of running work, server region [Vercel function region]
• Supabase Inc., USA: database, sign-in and files, servers in Frankfurt am Main
• Stripe Payments Europe, Limited, Ireland: payments, subscriptions and invoices (partly as a controller in its own right, see “Payment”)
• OpenRouter, Inc., USA: AI models, forwards requests to the model's provider
• [DataForSEO: company and country]: search volume and keyword data
• [Serper: company and country]: Google results and page fetching
• Google Ireland Limited, Ireland: Google Analytics and Google Ads unless you turn them off; Google may also process data in the USA

Transfers to the USA rely on the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

How long we keep data

We keep your data as long as your account exists. When Pro ends for a website, its data stays in your account. We delete your account when you ask us by email, within [period, e.g. 30 days]. We disconnect connected websites, end running subscriptions immediately and delete your sign-in, projects, articles, images, Search Console data and the weekly report's recipients. If you share the account with others, we only remove you from it. We cancel work in progress; Vercel deletes its intermediate steps after [retention period of Vercel workflow data].

What remains: billing records at Stripe, as long as commercial and tax law requires, at most ten years (§ 257 HGB, § 147 AO), and our cost accounting, from which we remove every link to your account. In reports to Google we delete click IDs and analytics IDs after 90 days. Those stored with your account are deleted when you turn analytics or advertising off; the details from sign-up and bookings remain until the account is deleted (see “Analytics and advertising”).

Your rights

You can ask for access to your data (Art. 15 GDPR), for correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and a copy in a common format (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)). An email to info@certentis.com is enough. You can also complain to a data protection authority (Art. 77), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

We need your account details to perform the contract. Without them you can't use Citapult. You are under no legal obligation to provide them.

Right to object

Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing the data unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You can turn Google Analytics and Google Ads off yourself at any time, without giving reasons, under “Cookie settings”.