Privacy policy

1. Data controller

The controller of your data is the owner of Citable (“Citable”, “we”):

Owner

Pol Angrill Domingo

Tax ID (NIF)

ES48021407Y

Address

Rambla Principal 92, 08800 Vilanova i la Geltrú (Barcelona), Spain

Email

hello@get-citable.com

For any privacy matter you can also write to privacy@get-citable.com.

2. Data we collect

Depending on how you use the service, we process:

• Account data: your email and, if you sign in with Google, the name and picture Google shares. We do not use passwords: you sign in with an email link or with Google.
• Data about your sites: domain, brand, competitors, tracked questions, brand voice, articles, drafts and publishing settings.
• Connections: permissions for your CMS, Search Console and Google Analytics (read-only on Google), for the integrations you connect (GitHub, Slack, Google Sheets and Docs, HubSpot, Semrush or Ahrefs) and, if you connect your email inbox, permission to send from it. Access tokens, the Slack webhook and API keys are stored encrypted (AES-256-GCM), never reach the browser and you can revoke them at any time.
• Email inbox (outreach campaigns): your address and name and, for each campaign email, what you wrote, the recipient, when it was sent and the message and thread IDs your provider returns. On Gmail the permission is send-ONLY (gmail.send): we do not read your email. On Outlook, besides sending, we read the metadata of the messages in the thread (sender and date) to know whether you got a reply; never the content or attachments, and we only store that there was a reply and its date. We never add attachments or open-tracking pixels.
• Automatic LinkedIn (paid add-on): the LinkedIn account you connect in Unipile’s window (Citable never sees your password: we only store the account’s ID at Unipile, your name, your LinkedIn ID and whether it is a paid account). From it we only send the invitation note and the message you approve and launch for each person; from LinkedIn we read, through Unipile, their ID, whether they accepted the invitation and whether they replied, never the text of the conversations.
• HeyReach (LinkedIn channel of campaigns): your API key, stored encrypted (AES-256-GCM). For each page you approve and export we only send HeyReach the person’s LinkedIn profile URL, their name, the publication and role read from the page, and the invitation note and message you approved (with the title, question and angle as variables); never their email. From HeyReach we read each lead’s status (invitation sent or accepted, message sent, replied), never the content of the conversations.
• LinkedIn (posts on your profile): your name, email and member ID (OpenID Connect) and the access token, stored encrypted, with permission to post on your behalf (w_member_social). We only send LinkedIn the text of the posts you approve and the article link. We only store authors’ LinkedIn profiles if the page itself links to them or you paste them: we never visit LinkedIn to look for them.
• Do-not-contact list: the addresses you add (or that asked not to receive more emails), so we never write to them again.
• Billing data: name or company name, address, tax ID and payment history, kept by Stripe. We never see or store your card details.
• Team: the emails of people you invite to your workspace.
• Free report: the email, site and questions you give us. To prevent abuse we store a one-way hash of your IP address, not the address itself.
• Technical data: server logs (IP, browser, paths visited) kept for a short time for security and troubleshooting.
• Referral program: if you arrive through a referral link, the link’s code, the time of the click and the destination page, in a 90-day first-party cookie; clicks are counted per day and per link, without your IP or any identifier of yours. The person who referred you only sees aggregate data (sign-up date, plan, status and what they earn), never who you are.
• Agencies: the tax and payment details an agency gives us so we can pay its commissions, and the commissions, holds and adjustments on each of its clients’ invoices.
• Whatever you write to us by email.

3. Data we process on behalf of our customers

In two features Citable processes data on behalf of the customer, who is the controller, with us as processor:

• The visits script customers add to their site: it uses no cookies, does not store the IP or identify the visitor; it only adds one view to the page and, if the visit comes from an AI assistant, to that source.
• The agencies’ lead widget: the details left by whoever uses it (for example, their email and website) are stored for the agency that installed it.

4. Purpose and legal basis

• Providing the service: measuring, writing, publishing and sending you reports (performance of the contract).
• Charging and invoicing (performance of the contract and legal obligation).
• Sending you service messages: publishing notices, weekly digest, technical alerts (performance of the contract and legitimate interest). You can unsubscribe from the weekly digest in one click.
• Preparing and sending the free report you ask for (your request and our legitimate interest in answering it) and preventing abuse (legitimate interest).
• Crediting sign-ups to whoever referred them and calculating their credits and commissions (legitimate interest and performance of the contract with the referrer; where required, your consent).
• Sending you news and offers, only with your express consent.
• Complying with legal obligations.

We do not sell your data or use it for advertising or to train AI models. We send AI providers only what each task needs (for example, an article’s topic and sources), through their business APIs.

5. Processors

We share only the data that is needed with these providers, who act as processors under contract and with safeguards:

If you connect other tools from Settings → Integrations, we send them on your behalf only what is needed for what you ask; each processes data under its own terms and you can disconnect it at any time (we revoke our access):

If you connect Google Search Console, Google Analytics, your Gmail or Outlook (Microsoft 365) inbox or your CMS (Framer, Webflow, WordPress, Ghost, Shopify, Wix, Notion, HubSpot, Contentful, Sanity, Strapi, Storyblok or Medium), we read from or send data to those services on your behalf; each processes data under its own terms. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Gmail data is used only to send the emails you approve, is not used for advertising or to train AI models and is not shared with third parties. If you connect your HeyReach account or your LinkedIn profile, we only send them what is described above on your behalf; HeyReach and LinkedIn process that data under their own terms and privacy policies. If your site is served through Lantis (a product of the same owner), Lantis sends us AI crawler hits on your site.

If your workspace is managed by an agency, its team sees and manages your workspace’s data with the permissions it has, and the agency sees your plan, what you pay and the commission it earns. If you arrived through an agency’s referral link, the agency only sees aggregate data.

6. International transfers

Some providers are in the United States or process data outside the European Economic Area. In those cases the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission, with any additional measures required.

7. Retention

We keep your data while you have an account. If you close it or ask us to delete it, we delete or anonymise your data within 90 days at most, except what the law requires us to keep longer (for example, billing records, for the periods required by Spanish commercial and tax law, up to 6 years). Server logs are kept for a few days only.

8. Your rights

You have the right to:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete it.
• Portability: receive it in a structured format.
• Objection: object to processing based on legitimate interest.
• Restriction: restrict processing in certain cases.
• Withdraw your consent where processing is based on it.

To exercise them, write to privacy@get-citable.com from your account email. We reply within one month at most. If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD) or to the authority in your country.

9. Security

We apply technical and organisational measures to protect your data: encryption in transit (TLS), third-party tokens encrypted at rest, role-based access within each workspace and signed links for read-only reports. If a security breach affects your data, we will notify you within the legal deadline.

10. Minors

Citable is a service for professionals and is not aimed at anyone under 18.

11. Cookies

The public website uses no analytics or advertising cookies. The cookies we do use are listed in the cookie policy.

12. Changes to this policy

We may update this policy when needed. If a change is significant we will email you before it takes effect. The date of the last update always appears at the top.