Privacy without fine print.

Last updated: 16 September 2026

1. Who we are. Citarra (“we”) provides AI visibility tracking at citarra.com. This policy explains what personal data we collect and how we use it. Contact: hello@citarra.com.

2. Data we collect. Account data: name, email, company, password hash. Billing data: handled by our payment provider (Paddle) as merchant of record; we do not store card numbers. Service data: brand names, competitor names, prompt lists, and the AI answers and reports generated for your workspace. Usage data: log data, device and browser information, and cookies necessary for login and basic analytics.

3. How we use data. To provide and improve the Service, run your scheduled tracking, send reports and service emails, provide support, bill subscriptions, and meet legal obligations. We do not sell personal data and we do not use your workspace data to train AI models.

4. Third-party processors. We use the following providers to operate Citarra, each processing data only to provide their service to us. Hosting and database: Vercel and Supabase. AI providers, which receive your tracked prompts and brand names in order to generate the answers we analyse: OpenAI, Perplexity and Anthropic, plus cloro, which retrieves Google AI Overviews on our behalf, and SerpApi as its backup for the same purpose. Email delivery: Resend. Payment processing: Paddle, as merchant of record. Error monitoring: Sentry. Customer records: Attio, which holds your signup email, company and plan status, and never the contents of your workspace.

Connecting AI assistants. If you connect Citarra to an AI assistant such as Claude or ChatGPT through our connector, that assistant receives the workspace data you ask it about (your visibility figures, tracked questions, competitors, sources and alerts) for the workspace you select. The assistant’s provider processes that data under its own terms. You choose whether to connect, which workspace, and can revoke the connection at any time from the assistant’s settings or from Citarra’s Settings → AI apps. We never send workspace data to an AI assistant you have not connected.

5. Cookies and similar technologies. We group what we set into three categories. Strictly necessary cookies keep you signed in, keep the site secure, and remember your cookie choice; these are always on because the site cannot work without them. Analytics cookies are Google Analytics 4 (_ga, _ga_<id>) and Microsoft Clarity (_clck, _clsk). Marketing cookies are not used at all today; the category exists so that if we ever advertise, your choice is already on record.

Microsoft Clarity records a playback of your visit: the pages you view, where you click and scroll, and how your mouse moves. We run Clarity in its strictest masking mode, so all text is masked before it leaves your browser. We cannot read what you typed, and we do not see your email address, password or any other text you enter. We use these recordings only to find where the site is confusing or broken, and we do not sell them.

Where you are changes what happens. If you are in the European Economic Area, the United Kingdom or Switzerland, nothing beyond strictly necessary cookies is set until you choose, and we show you a banner asking. Everywhere else, analytics is on by default and you can switch it off at any time. Wherever you are, you can change your mind whenever you like: open your cookie settings.

One technical detail we would rather state than hide. When you decline analytics, we still send Google a signal that a page was viewed, with no cookies, no identifiers, and nothing that can be tied back to you or to a later visit. Google uses these anonymous signals to estimate overall traffic. If you would prefer to send nothing at all, a browser-level content blocker will stop the request entirely, and we do not attempt to work around one.

We also honour the Global Privacy Control signal where your browser sends it, and we never grant advertising storage when it is present. Separately, our own staff can set a citarra_internal cookie on their own devices so that our visits are excluded from our analytics; it is never set on your browser unless you deliberately request it.

6. Retention. Account data is kept while your account is active. Workspace and report data is retained so your trends remain available; you may request deletion of a workspace or your entire account at any time, and we will delete associated personal data within 30 days except where law requires retention.

7. Your rights. Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict processing. Email hello@citarra.com to exercise these rights.

8. International transfers. Our providers may process data in other countries; where required we rely on appropriate safeguards such as standard contractual clauses.

9. Security. We use encryption in transit, access controls, and tenant isolation at the database level. No system is perfectly secure; notify us immediately of any suspected breach of your account.

10. Support access. To investigate a problem you report, or to prepare for a call with you, a small number of authorised Citarra staff can open your workspace in a read-only view. They can see what you see: your tracked questions, competitors, results and sources. They cannot change anything, cannot sign in as you, and cannot see your password or session. Every time a member of staff opens a workspace we record who they were, which workspace, and when. That record cannot be edited or deleted by the person who created it, and we keep it for three years. If you would prefer we did not use this to help you, tell us at hello@citarra.com and we will note it on your account.

11. Children. The Service is for business use and not directed at anyone under 18.

12. Changes. We will post updates here and notify you of material changes by email.