Privacy Policy

1. Who we are

Get AI Cited (“Get AI Cited”) is a trading name of Brightbay LLC, a Wyoming limited liability company, with an office at 15442 Ventura Blvd Suite 201-1406, Sherman Oaks, CA 91403. We measure how AI answer engines such as ChatGPT, Perplexity, Claude and Gemini cite and name B2B companies, publish those measurements, and provide AI visibility (GEO) services. Brightbay LLC is the controller of the personal data described here. For anything about privacy, email [email protected].

2. Information we collect

Contact and audit requests: your email address, company name and website, and anything you write in the form, plus where the request came from (our website, the browser extension or an agency partner).

Account information: the email addresses that can sign in to an account, the account name, the companies it tracks, and for agencies, their clients’ sign-in email addresses and branding (agency name, colour and logo).

Billing information: payments are handled by Stripe. Stripe collects your card details, name and billing address; we never see or store card numbers. We keep your Stripe customer and subscription references, plan, billing period and status.

Sign-in and security data: a sign-in cookie, hashed (one-way) sign-in links and access tokens, and your IP address, used briefly to limit repeated attempts and abuse. We also keep a security log of sign-ins and account changes (who, what, when, the outcome and the IP address), so we can investigate misuse; it never contains passwords, sign-in links or form contents.

Website analytics: we use Umami and Cloudflare Web Analytics, which count page views, referring sites, browser and device type, country and page load speed without cookies and without identifying individual visitors.

Site activity: on our homepage and blog, our own server records which pages and articles are viewed and which buttons are clicked in a browser session, under a random session ID kept in your browser’s session storage (cleared when you close the tab). If you then submit a form, that session’s activity is linked to your request so we understand what you were interested in. This stays with us and is never shared for advertising.

Sign in with Google: if you choose Continue with Google, Google tells us your email address and whether Google has verified it. We use it only to match an existing Get AI Cited account and sign you in; we do not receive your Google password, contacts or any other Google data, and we do not create an account from it.

Free trials: to keep to one trial per company, when you start a trial we check whether your email address, or another address at the same company domain, has had one before. Free email domains such as gmail.com are never matched as a company.

AI Source Builder and other services you order: the company details you approve for listings (name, description, categories, logo, links and business contact details) and, while we set listings up, the logins for those listings, which we hand over to you (see section 10).

Prospect reports: agencies on the White Label plan can create a report about a prospect company and share its private link. We count how many times a report is opened and when it was last opened; we do not record who opened it.

Data from services you connect: aggregated Google Analytics reports and AI-assistant connection details, as described in sections 5c and 5b.

Measurements of companies: our scans record what AI engines say about businesses. This is information about companies, not about you. We do not collect sensitive personal data (such as health, financial account, government ID, precise location or biometric data), and our services are not meant for it.

3. How we use it

To provide what you asked for: deliver audits, run your account and dashboard, sign you in, show agencies their clients, connect the services you choose, and take payment.

To communicate with you: reply to questions, send sign-in links, receipts and service notices, and, if you have agreed, occasional updates you can unsubscribe from at any time.

To keep the service safe and working: prevent abuse, fix problems and understand which pages are used, in aggregate.

To meet legal obligations: tax, accounting and responding to lawful requests.

We do not sell personal data, share it for cross-context behavioural advertising, or use it to train AI models. We do not make decisions about you that have legal or similarly significant effects by automated means alone.

4. Who we share it with

Only with service providers that need it to run Get AI Cited, under contracts that limit their use of it: Cloudflare (delivers and protects our website, so it handles every request, including your IP address), Railway (hosting and database), Stripe (payments), Resend (sign-in and service emails), Zoho (our support mailbox), and Umami and Cloudflare (aggregate website analytics).

Google, if you choose Continue with Google to sign in (see section 2), and, only if you connect a Google Analytics property, to read the reports described in section 5c.

Calendly, if you book a call with us: you enter your details on Calendly’s site, under its privacy policy.

AI engines and search data: our scans send buyer questions about a category to OpenAI (ChatGPT), Anthropic (Claude), Perplexity, Google (Gemini) and xAI (Grok), and to DataForSEO, which retrieves Google search results, including AI Overviews, for us. These questions contain no personal data about you.

AI tools we use to do our work: we may use AI assistants from Anthropic and OpenAI to help provide our services, only under business or API terms whose providers do not train their models on what we send, and only with the information a task needs.

Listing sites: if you order AI Source Builder, we submit the company details you approved to the sites in your order. Those sites publish them and handle them under their own terms and privacy policies.

Agencies: if you sign in through an agency, or send an audit request with an agency’s partner code, that agency can see your sign-in email, your company’s results and your request, and handles them under its own privacy policy.

Others only when the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply.

5. Legal bases (EU, UK and Brazil)

We rely on contract (to provide services you buy or request), legitimate interests (to answer enquiries, secure and improve the service, and publish measurements of businesses), consent (for optional marketing emails, which you can withdraw at any time) and legal obligation (tax and accounting records).

5a. Browser extension (Get AI Cited: AI Visibility Checker)

The extension reads the address of the tab you are on only when you click its icon (Chrome’s activeTab permission) and sends that address to getaicited.co to look up a published measurement for the website. It does not read page content, track your browsing, run in the background, or record the addresses it looks up against you. It stores one setting in your browser: an optional partner code. If you request an audit from the extension, we receive the email address you enter and the website you were on and use them only to deliver that audit; with a partner code set, the request goes to the agency that gave you the code. The extension’s use of information follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

5b. AI assistant connection (ChatGPT, Claude and others)

Anyone can use our public tools in an AI assistant (published scores, leaderboards, methodology and the AI-readiness check) without an account; for these we receive only the company or website asked about. If you connect your Get AI Cited account, you sign in to Get AI Cited and approve the connection, and the assistant gets read-only access to the measurements your dashboard shows. We store hashed access tokens (access expires after 1 hour, renewal after 60 days), the app’s name and when it was last used. We do not receive or store your conversations: the questions you ask and the answers given are handled by the assistant’s provider under its own privacy policy. You can disconnect an app at any time from your dashboard, which ends its access immediately.

5c. Google Analytics connection

If you connect a Google Analytics 4 property, you give Get AI Cited’s service account read-only Viewer access in Google Analytics yourself. Get AI Cited then reads aggregated reports for that property: visit counts by traffic source, landing pages, engaged visits and key events, limited to visits from AI assistants plus the total visit count. We do not read data about individual visitors. You can disconnect in your dashboard and remove Get AI Cited’s access in Google Analytics at any time; disconnecting deletes the stored report.

5d. AI-readiness checker

When you check a website, we fetch the same public pages any crawler can see (robots.txt, the homepage, the sitemap and llms.txt), identifying ourselves as CitedReadinessChecker. We keep the result in server memory for 15 minutes so a repeat check is instant, and we do not store the website you checked or your IP address beyond short-lived rate limiting.

5e. Cookies

We use four cookies, all strictly necessary and none for advertising or tracking: cited_session keeps you signed in (30 days); cited_brand remembers which agency’s sign-in page you used (1 year); cited_next returns you to an AI-app connection after you sign in (30 minutes); cited_social protects a Continue with Google sign-in while it is in progress (10 minutes, deleted when you return). Our analytics use no cookies; the site-activity session ID in section 2 lives in session storage, not a cookie, and is cleared when you close the tab. Because we only use necessary cookies, we do not show a cookie banner. You can block cookies in your browser, but you will not be able to sign in.

5f. Do Not Track, Global Privacy Control and tracking by others

We do not track you across other websites, and we do not allow other companies to collect information about your activity across websites through Get AI Cited: there are no advertising pixels, social media trackers or session-recording tools on our site. Because of that, our site does not behave differently when your browser sends a Do Not Track signal. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information, which we do not do in any case.

5g. Google user data

Our use and transfer of information received from Google APIs, including Sign in with Google and Google Analytics, adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use that information only to sign you in and to show you the reports you connected, never for advertising, and we do not sell it or let people read it except to provide support you ask for, for security, or where the law requires.

6. How long we keep it

Account and client data: while the account is open. After an account closes (including a free trial that ends without a card) we keep it for up to 12 months in case you come back, then delete it, except billing records; ask us and we delete it sooner. Billing and invoice records: 7 years, for tax and accounting. Audit requests from people who do not become customers, and site-activity records: 24 months after the last contact or visit. Sign-in sessions: 30 days, and the records of them are deleted within a week after they expire. Sign-in links: usable for 15 minutes, deleted within a day after that. AI-app access: until it expires or you disconnect, deleted within a day after it expires. Listing logins we set up for you: deleted from our systems once we have handed them over. Prospect reports: until the agency deletes them or its account closes. Google Analytics reports: until you disconnect. Rate-limiting data: minutes to hours. Security logs: up to 30 days, then deleted automatically. Published measurements of companies are kept as a dated public record.

You can ask us to delete your data sooner at any time (section 7).

7. Your rights and choices

Wherever you live, you can ask us for a copy of your personal data, to correct it, to delete it, or to stop optional emails. Email [email protected] from the address concerned; we may need to confirm it is you. We reply within 30 days, or within the time the law where you live requires. If we decline a request, we will tell you why. You can appeal by replying with the subject “Privacy appeal”; we answer appeals within 45 days, and if you are still not satisfied you can contact your state attorney general or data protection authority.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, use and disclose; to delete and correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be treated differently for using these rights. We do not sell or share personal information and do not use sensitive personal information, so there is nothing to opt out of. You may use an authorised agent, whose authority we will verify. The categories we collect are identifiers and contact details, commercial information (plan and billing status), internet activity on our site (aggregate analytics and security logs) and, for connected services, aggregate analytics reports; sources and purposes are described in sections 2 and 3.

EU and UK residents: you also have the rights to restrict or object to processing and to data portability, and you can complain to your local data protection authority.

Brazil residents (LGPD, Lei nº 13.709/2018): you can ask us to confirm whether we process your data; to access, correct, anonymise, block or delete it; for a copy in a portable format; to know who we share it with; and to withdraw consent where we rely on it. You can also petition the Autoridade Nacional de Proteção de Dados (ANPD). Our contact for data-protection requests, including under the LGPD, is [email protected], and requests in Portuguese are welcome.

California “Shine the Light”: we do not disclose personal information to third parties for their own direct marketing purposes.

If you need this policy in another format, for example because of a disability, email [email protected] and we will provide it.

8. International transfers

Get AI Cited is run from outside the United States and our main systems are hosted in the United States. Your data may be processed in the United States and other countries where we or our providers operate. Where the law requires it, we rely on safeguards such as standard contractual clauses offered by our providers.

9. Children

Get AI Cited is a business service and is not directed at children under 16. We do not knowingly collect their personal data; if you think we have, email us and we will delete it.

10. Security

We use encrypted connections throughout, accept website traffic only through Cloudflare, keep our database on a private network with no public address, store sign-in links and tokens only in hashed form, limit repeated attempts, keep a security log of account activity, limit access to personal data to the people who need it, and host on Railway’s managed infrastructure. Listing logins we set up for you are stored securely and deleted from our systems once handed over. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

11. Other websites

Our site and reports link to other websites, including the sources AI engines cite. Their own privacy policies apply.

12. Changes to this policy

We will post any change here and update the date above. For a material change we will also email account holders before it takes effect.

13. Contact

[email protected] · Brightbay LLC · 15442 Ventura Blvd Suite 201-1406 · Sherman Oaks, CA 91403 · +1 213 460 5908