Your data, plainly.

FreshlyCited is run by Space-O Technologies (FreshlyCited) legal entity and registered address to confirm. We decide how the personal data described here is used, so we are its controller.

To ask about your data, use the contact form (pick “Other”) dedicated privacy email to confirm.

Your account. Your name, email address, and optionally your agency or company and a short note about what you want indexed. Your password is stored only as a one-way hash, or you can sign in with an email link instead. We also keep your role and which workspaces you belong to.

Your work in the app. The pages and links you submit, the checks and pushes you run, their results and re-check history, the reports you share (and how many times a report link was opened), and your credit history.

Billing. Payments are handled by Stripe. We receive your plan, subscription status and payment outcomes, never your full card number.

API keys and AI-assistant connections. API keys and the tokens used by AI assistants (MCP) are stored only as hashes. Assistant access tokens last one hour; refresh tokens last 30 days and change every time they are used.

The contact form. Your name, email, optional company, topic and message. It reaches us as an email, and you get a copy. We don’t keep it in our database; if email delivery fails, a copy is kept in our internal error log so the message isn’t lost.

The free checks on our website (Site X-ray, the AI answer check and the crawler lens). The domain, page address or question you type in. To answer, we read your public sitemap or page and ask a search-data provider. Results are kept in memory for about 24 hours so the same check isn’t paid for twice; they are not written to our database. We count requests per IP address, in memory, to stop abuse.

Technical data. Our servers log requests (IP address, browser, page requested, time). When the app hits an error in your browser, it may send us the error message, the page and your browser type so we can fix it. Account actions such as sign-ins, invitations and key changes are kept in an audit log.

When analytics is switched on, we use Google Analytics 4 through Google Tag Manager, with Google’s Consent Mode v2.

• In the EEA, the UK and Switzerland, analytics stays off until you choose “Accept analytics”.
• Elsewhere, analytics is on by default, and you can turn it off with “Decline” in the same panel.
• Advertising storage is denied everywhere. We run no ads and sell nothing.

What we send is limited on purpose: fixed event names (for example “started a check”) with small counts or categories. We never send emails, names, the domains or addresses you type, or free text.

• To run the service you signed up for: your account, checks, pushes, re-checks, reports and emails about them (performing our contract with you).
• To keep it safe and fair: rate limits, abuse prevention, the audit log and error reports (our legitimate interest in a secure service).
• To bill you when you buy credits or a plan (contract, and the law for tax records).
• To understand which pages help: analytics, on the consent basis described above.

We don’t sell personal data, and we don’t use it for advertising.

We use a small number of service providers, only for the jobs below:

• Hosting: a virtual server in a data centre in Boston, USA, that runs the app and its database.
• Payments: Stripe processes card payments and subscriptions.
• Analytics: Google (Analytics and Tag Manager), when analytics is on.
• Email delivery: an email provider that sends our account and result emails.
• Indexing and search-data providers: they receive the page addresses you submit or check, and the domains or questions typed into the free checks. They never receive your name or email.

Client reports are shared only through links you create, and you can revoke them at any time. We may disclose data if the law requires it.

• Account and workspace data: while your account is open. Ask us and we will delete it.
• Backups: nightly copies of the database, kept for 14 days and then deleted.
• Server logs: up to about one month for system logs, and up to eight weeks for rotated application logs.
• Free-check results: about 24 hours, in memory only.
• Billing records: as long as tax law requires.
• Analytics: according to our Google Analytics retention setting retention period to confirm.

Connections are encrypted (HTTPS). Passwords, API keys and assistant tokens are stored as hashes; email delivery credentials are encrypted at rest. Access inside a workspace follows roles, and backups are checksummed. No system is perfectly secure, so please keep your password and API keys private.

You can ask us to show you, correct, export or delete your personal data, to stop or limit some uses, and you can withdraw analytics consent at any time. Depending on where you live (for example the EU, UK or Canada), you can also complain to your data protection authority. To use any of these rights, contact us; we will answer within the time the law sets.

Your data is stored on our server in the United States, and our service providers may process it in other countries. Where the law requires it, we rely on safeguards such as standard contractual clauses transfer mechanism to confirm.

FreshlyCited is a business tool and isn’t meant for anyone under 16. We don’t knowingly collect their data.

When we change this policy we update the date at the top. If a change matters for how we use your data, we will tell account holders by email before it takes effect.