Summary
This policy explains how Citeplume (“Citeplume”, “we”, “us”) handles personal information when you visit citeplume.com, create an account, or use the Citeplume app and its features (the “Service”).
In short: we collect what the Service needs to run. We don’t sell your personal information, we don’t share it for targeted advertising, and we don’t use tracking pixels, third-party analytics or session recorders.
Information we collect
We collect information you give us, information created when you use the Service, and a little from the services you connect.
- Account information: your email address, name, a password hash if you set a password, your Google account id if you sign in with Google, your plan, your theme and your two-factor settings (the secret encrypted, recovery codes kept only as hashes).
- Sign-in and security records: when you sign in, whether it succeeded, your IP address and your browser’s user agent. We keep the last 100 per account.
- Your content: the pages and websites you add, the questions you check, competitors you follow, and the analyses, reports, briefs, plans and fixes the Service makes for them. Most of this is public web content; the analyses are yours.
- Connected services: if you connect a GitHub or GitLab repository or a CMS (WordPress, Shopify, Webflow, Ghost), the access token or credentials you give us, stored encrypted, and the files or posts the Service reads or changes for you.
- Billing information: your plan, subscription status and token usage. Card and payment details go to our payment processor and never reach us.
- Support and contact: support tickets, their screenshots and conversation, and messages you send through the Contact page (your name, email, topic and message). For the contact form we keep a keyed hash of your IP address to limit abuse, never the address itself.
- Error reports: when something breaks, the error, the page or API path (without its query string), your browser and, at most, your account id.
How we use it
We use personal information only to:
- provide the Service: run checks and analyses, call AI engines for the features you start, open pull requests and CMS patches you approve, and keep your history;
- bill your plan and count your tokens;
- keep accounts and the Service secure: sign-in, two-factor, rate limits, abuse prevention;
- answer support tickets and contact messages, and send account emails you need (for example about your plan);
- fix bugs and improve the Service; and
- meet legal obligations and enforce our Terms of service.
We don’t use your content to train AI models, and we don’t use your information for advertising.
Who receives it
We share personal information only with service providers that run parts of the Service for us, each receiving only what its job needs and bound to use it only for us:
- AI model providers (Anthropic, and OpenAI, Perplexity and Google for the engines you choose to check): the page content and questions a feature sends. Never your email or account details.
- Google: signing in with Google.
- GitHub, GitLab and your CMS: what a fix you approve reads and writes, under your own account.
- Dodo Payments: subscriptions, payments and usage-based billing.
- Supabase (database), Render (hosting) and Cloudflare (file storage): storing and serving the Service.
- Sentry: error reports, as described above.
We may also disclose information when the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.
We do not sell personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the past 12 months.
How long we keep it
We keep your information while your account exists. Deleting a page or website removes its content; the usage ledger stays for billing. When your account is deleted, we delete your account, content, credentials, usage and stored files. Sign-in records are capped at the last 100. Backups and logs may hold copies for a limited time before they are overwritten, and we keep what the law requires (for example, billing records).
Security
We protect your information with encryption in transit, encrypted repository and CMS credentials, hashed passwords and recovery codes, two-factor sign-in, session controls and access limited to people who need it. No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires.
Your privacy rights
Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws), you may have the right to:
- know what personal information we hold about you and how we use and disclose it, and get a copy in a portable format;
- correct inaccurate information;
- delete your information;
- opt out of the sale of personal information, sharing for targeted advertising, and profiling with legal or similarly significant effects (we do none of these); and
- not be treated differently for using these rights.
Use the Contact page (citeplume.com/contact) and pick “Privacy request”, from the email on your account if you have one. We will confirm your identity by matching the request to your account, answer within 45 days (we may extend this once by 45 days and tell you why), and explain any part we can’t fulfil. You can name an authorized agent; we may ask for proof of their authority and confirm your identity with you. If we deny your request, you can appeal by replying to our answer; we will respond to an appeal within the time your state’s law allows, and if you’re not satisfied you may contact your state attorney general.
We collect the categories of personal information listed under “Information we collect” from you, your browser and the services you connect, for the purposes under “How we use it”, and disclose them only to the recipients under “Who receives it”. We do not use or disclose sensitive personal information for purposes that would give California residents a right to limit it.
Children
The Service is for businesses and people 18 and older. It isn’t directed at children, and we don’t knowingly collect personal information from anyone under 13 (or under 18). If you believe a child has given us information, tell us through the Contact page and we will delete it.
Where information is processed
We operate in the United States, and our service providers may process information in the United States and other countries. If you use the Service from outside the United States, you understand that your information will be processed there, where the law may differ from yours.
Changes to this policy
We will post any change on this page with a new effective date. If a change materially affects how we use information we already have, we will tell you in the app or by email before it takes effect.
Contact us
Questions about this policy or a privacy request: Use the Contact page (citeplume.com/contact) and pick “Privacy request”. We reply by email.