Legal

Privacy Notice

Effective date: May 2026 · Last updated: May 2026

Summary

Key Points

This summary provides key points from our Privacy Notice. You can find more details by clicking the links in the table of contents above.

  • What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the choices you make.
  • Do we process sensitive personal information? No. We do not process sensitive personal information.
  • Do we collect information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources.
  • How do we process your information? To provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
  • With whom do we share personal information? We may share information in specific situations and with specific third parties.
  • What are your rights? Depending on your location, applicable privacy law may give you certain rights regarding your personal information.
  • How do you exercise your rights? Submit a data subject access request or contact us directly.
01

What Information Do We Collect?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

The personal information we collect may include:

  • Names
  • Email addresses
  • Phone numbers
  • Job titles
  • Business names and website URLs
  • Any other information you choose to provide

We do not process sensitive personal information such as racial or ethnic origins, sexual orientation, or religious beliefs.

Information automatically collected

In short: Some information — such as your IP address and browser/device characteristics — is collected automatically when you visit our Services.

This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services.

Information collected from other sources

In short: We may collect limited data from public databases, marketing partners, and other outside sources.

We may obtain information about you from other sources, such as public databases, joint marketing partners, and social media platforms, to supplement the information we have about you.

02

How Do We Process Your Information?

In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

  • To deliver and facilitate delivery of services to you
  • To respond to your inquiries and solve any potential issues
  • To send you information about our services, updates, and promotions (where permitted)
  • To understand how our Services are being used so we can improve them
  • To comply with our legal obligations
  • To protect our Services and prevent fraud
03

What Legal Bases Do We Rely On?

In short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

As we operate in Finland and the EU, we rely on the following legal bases under the GDPR:

  • Consent. We may process your information if you have given us permission to use your personal information for a specific purpose.
  • Performance of a contract. We may process your personal information when it is necessary to fulfil our contractual obligations to you.
  • Legitimate interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests, provided those interests do not outweigh your rights.
  • Legal obligations. We may process your information where we are legally required to do so.
04

When and With Whom Do We Share Your Personal Information?

In short: We may share information in specific situations described in this section and/or with the following third parties.

We may share your personal information in the following situations:

  • Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
  • Service providers. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf (e.g., payment processors, email delivery services).
  • Legal requirements. We may disclose your information where required to do so by law or in response to valid requests by public authorities.
05

Do We Use Cookies and Other Tracking Technologies?

In short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Services may not function properly.

06

Do We Offer Artificial Intelligence-Based Products?

In short: Yes. We use AI-based tools to provide our services, and your data may be processed by those tools.

As part of our Services, we use AI-based tools to analyze how AI systems reference and recommend businesses. These tools may process information you provide to us (such as your business name, website, and industry) in order to generate reports and recommendations.

We do not use your personal data to train AI models. Any AI processing is solely for the purpose of delivering the service you purchased.

07

AI Providers Used in Our Audit Process

To deliver the Services, we submit certain information to third-party AI and search providers. We submit only your business name, website URL, public-facing listings, and the buyer-intent prompts we craft to evaluate AI visibility.

We do not submit private information (financials, internal strategy, customer lists) to these providers.

Providers we may use include:

  • OpenAI (ChatGPT) — Prompt visibility testing
  • Anthropic (Claude) — Prompt visibility testing
  • Google (Gemini) — Prompt visibility testing
  • Perplexity — Prompt visibility testing
  • Microsoft (Copilot) — Prompt visibility testing
  • Web search tools — Pulling public content for audits

We use commercial or API endpoints where available and configure provider accounts to prevent customer data from being used to train models where that control is available.

08

How Long Do We Keep Your Information?

In short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

Specifically:

  • Active engagement records — retained for the duration of the engagement and for at least 3 years after termination
  • Payment records — retained for at least 7 years for accounting and tax purposes
  • Email correspondence — retained for up to 7 years from the date of last contact
  • Acceptance records (Terms, Privacy, NDA) — retained for the duration of the accepted agreement and for up to 10 years thereafter
  • Marketing analytics data — retained for up to 26 months
  • Backups — information may persist in encrypted backups for up to 90 days after a deletion request

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it.

09

Do We Collect Information From Minors?

In short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. If you become aware of any data we may have collected from children under age 18, please contact us at helpto@getcited.online.

10

What Are Your Privacy Rights?

In short: Depending on your location, you may have rights that allow you greater access to and control over your personal information.

In some regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws. These may include the right to:

  • Request access to and obtain a copy of your personal information
  • Request rectification or erasure of your personal information
  • Restrict the processing of your personal information
  • Data portability (where applicable)
  • Object to the processing of your personal information
  • Not be subject to automated decision-making

EEA, UK, and Switzerland (GDPR / UK GDPR)

As we operate in Finland and the EU, we comply with the GDPR. Legal bases on which we process your information include: (a) performance of a contract; (b) compliance with a legal obligation; (c) our legitimate interest in operating and improving the Services; and (d) your consent where required.

If you are an EEA/UK/Swiss resident and wish to exercise your rights, contact us at helpto@getcited.online. You also have the right to lodge a complaint with your local data protection supervisory authority.

US Residents (CCPA / CPRA and similar state laws)

If you are a California resident or resident of another US state with applicable privacy laws, you may have rights to know, delete, correct, and opt out of the sale or sharing of your personal information.

While we do not sell your personal information for money, our use of online advertising tools may constitute "sharing" under California law. To opt out, email helpto@getcited.online with the subject "Do Not Sell or Share — California resident".

Exercising Your Rights

To exercise any right, email helpto@getcited.online. We will respond within 45 calendar days (or as required by applicable law). We may need to verify your identity before processing the request.

11

Security

We use reasonable administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS/HTTPS), encryption at rest where appropriate, and access controls limited to personnel with a business need.

No system is perfectly secure. In the event of a material data breach, we will notify affected users as required by applicable law.

12

International Data Transfers

The Company is based in Finland. By using the Services, you consent to the processing of your information in Finland and, where applicable, in the United States (via third-party providers such as Stripe, Google, and OpenAI).

Where required by law, we use Standard Contractual Clauses or equivalent safeguards.

13

Do We Make Updates to This Notice?

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification.

We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

14

How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may contact us:

GetCited helpto@getcited.online

Finland