Privacy policy

Who we are

Citedly (“we”, “us”) is an AI visibility platform operated by devcrafthouse.co.za. We help businesses measure how often they are mentioned and cited in answers from AI engines such as ChatGPT, Perplexity, Gemini and Claude. This policy explains what personal data we process, why, and the rights you have under the Protection of Personal Information Act (POPIA, South Africa) and the General Data Protection Regulation (GDPR).

What we collect

• Account data. When you sign up we store your name, email address, and (if you use Google sign-in) your Google account identifier.
• Brand and tracking data. The domains, brands, competitors and prompts you configure, plus the tracking results we generate from them.
• Free-tool leads. If you use the free llms.txt generator and provide an email, we store that email together with the domain you checked, so we can optionally follow up.
• Billing data. Subscription and payment details are handled by our payment processor (PayFast). We store the subscription relationship and plan, not your full card details.

Why we process it

We process personal data to provide the service you asked for (running audits and tracking your brand), to manage billing, to operate and secure the platform, and where required by law. We do not sell personal data. We do not use your tracking data for advertising.

AI engines

Paid tracking sends your configured prompts to third-party AI engines (OpenAI, Perplexity, Google, Anthropic) to retrieve answers. These providers process the prompt text under their own terms and privacy policies. We do not send your account credentials or unrelated personal data to these engines.

Sharing

We share personal data only with: (a) the AI engines and payment processor needed to deliver the service; (b) our hosting and infrastructure providers; and (c) a competent authority where required by law. Agency-plan reports are white-label and contain only the data you choose to include.

Retention

We keep account and tracking data for as long as your account is active. You can request deletion at any time; we will delete your personal data within 30 days of a valid request, except where we are required to retain some records (for example, billing records) by law.

Lawful basis

We process personal information under POPIA s.11 and GDPR Art. 6: to perform the contract with you (running audits, tracking, billing), for our legitimate interest in operating and securing the platform, with your consent for optional lead follow-up, and where required by law (billing records).

Cross-border transfers

Our primary infrastructure is in South Africa. Where data crosses borders (for example, AI engines in the United States), we rely on adequate protection, binding agreements, or the EU Standard Contractual Clauses (POPIA s.72; GDPR Chapter V).

Cookies

We use only strictly necessary cookies: a session cookie to keep you signed in and short-lived state for the PayFast checkout. No analytics or advertising cookies.

Your rights

Under POPIA and GDPR you have the right to: access your personal data; request correction of inaccurate data; request deletion; request portability; object to processing; and withdraw consent. To exercise any of these rights, email us and we will respond within the statutory period.

Security

We use industry-standard safeguards: data encrypted in transit (TLS), hashed API keys, access controls, and least-privilege infrastructure. No method of transmission or storage is 100% secure; we will notify you of any confirmed breach that is likely to harm you.

Contact

Questions about this policy or a data-subject request? Email our Information Officer (designated under POPIA s.14) at privacy@citedly.tech. You may also lodge a complaint with the Information Regulator (iopo.org.za) or your local supervisory authority.