Effective date · 2026-04-21 Last updated · 2026-04-25 Related · Terms of Service

Use of the Site and Services is also governed by the Terms of Service. The two documents are intended to be read together; the Terms of Service control on non-privacy matters and incorporate this Privacy Policy by reference (Terms §10).

The short version

  • No cookies. Web Cited sets zero first-party or third-party cookies.
  • No analytics. No Google Analytics, no Plausible, no Fathom, no server-side analytics. We do not count visits, sessions, or referrers.
  • No third-party scripts. No ad networks, no chat widgets, no embedded video, no marketing pixels, no fingerprinting.
  • One use of local storage, only to remember that you dismissed the on-site privacy notice - it never leaves your browser.
  • If you email us or submit the intake form, we have what you sent us - nothing more. See the sections below for exactly where that data goes and for how long.

What we do not collect

Web Cited does not access, store, or use your IP address, browser, device, location, referrer, or any other identifier when you visit any page on web-cited.com. We run no first-party analytics events. We make no third-party requests from this site: every asset loaded on a page is served from the same domain.

Our hosting and content-delivery providers (described in Hosting below) may process IP addresses and request metadata at the network level for security, abuse prevention, and content delivery; that processing is governed by the providers' own privacy policies. Web Cited does not request, retrieve, or use those infrastructure logs.

Local storage

Our privacy notice (the bar that appears at the bottom of the screen on your first visit) needs to remember that you've dismissed it, so we don't show it again on every page. To do that we set a single key in your browser's local storage:

  • wc-notice-dismissed-v1 - value "1", set when you click "Got it".

Local storage is first-party and is never transmitted to any server, including ours. You can clear it any time via your browser's site-data controls. Clearing it will simply make the notice reappear on your next visit.

If you submit the intake form or email us

The intake form at /start sends the fields you fill in - first and last name, work email, company, website, the primary market you serve, whether you have a storefront or service area, a short business description, the buyer questions you want us to test, your competitor list, the audit tier you've selected, and your explicit consent acknowledgment - to our own API at api.web-cited.com. From there, your submission is recorded as a contact and deal in our CRM, a scope-confirmation email is sent to you automatically through our email-delivery service, and an invoice is generated through our payment processor with a hosted-checkout link. If you pay, a kickoff email is sent automatically and we begin the audit. If you don't, the record stays in our CRM and we close it out. "Contact" links elsewhere on the site open a standard mailto: in your email client, which transmits your email address to our inbox directly.

We use anything you send us solely to reply, to scope the engagement, and - if you become a client - to deliver the audit. We do not add you to a marketing list. We do not share, sell, or transfer your information to any third party beyond the service providers listed in the "Third parties" section below. If you ask us to delete your record and any associated data, we will - see "Your rights" for the process and timeline.

How long we keep your data

The retention periods below apply by default. You can request deletion at any time (see Your rights); a deletion request shortens the retention window for personal-data records to the timelines described there.

  • Intake-form data and CRM record (your contact details, company, deal record, scope notes): retained while the relationship is active and for as long as we may reasonably need it for follow-up engagements, dispute resolution, and operational records, unless you request deletion. Indefinite by default; deleted within 30 business days of a deletion request, subject to the legal-records carve-out below.
  • Email correspondence (scope, kickoff, follow-up, support, and ad-hoc threads): retained in our email-delivery service's logs and in our mail provider's archive while the relationship is active, unless you request deletion. Indefinite by default; deleted within 30 business days of a deletion request, subject to the legal-records carve-out below.
  • Intake API operational data (the at-rest record on our edge-compute platform): retained for the duration of the audit engagement and for normal operational purposes (debugging, audit-trail integrity, abuse prevention) thereafter. Deleted within 30 business days of a deletion request.
  • Playbook URL content: 12 months hosted at a private URL, plus 12 months in archive, then deleted at 24 months from delivery unless a separate retention agreement applies. Full schedule in Terms of Service §6.1.
  • Paid invoices and tax records: 7 years, retained by our payment processor and by Web Cited as required by tax and accounting law. We can remove your name and company from any draft, unpaid, or voided invoice on request, but cannot delete paid-invoice records during the retention period.
  • Local-storage notice-dismissed key (wc-notice-dismissed-v1): set in your browser only; never transmitted to Web Cited or any third party. Persists until you clear browser site data.

Legal-records carve-out: Web Cited may retain certain records longer than the periods above where required by law (for example, tax and accounting records under U.S. and California law; records under legal hold or active dispute resolution). The carve-out is narrow and applies only to the specific records covered.

Why we are allowed to process your data

Under applicable data-protection law (including the EU and UK General Data Protection Regulation, where it applies, and California's Consumer Privacy Act and California Privacy Rights Act), we rely on the following legal bases to process your personal data:

  • Performance of a contract: to provide the audit Services you have engaged us to perform (intake, scope confirmation, payment, audit execution, deliverable delivery, follow-up).
  • Legitimate interests: to respond to inbound inquiries, to operate and secure the Site and intake API, to maintain audit-trail integrity, to prevent abuse, and to develop anonymized and aggregated analytics about the Services in line with Terms of Service §8.4. These interests are balanced against your rights and freedoms; if you object, contact us at the address in Your rights.
  • Legal obligation: to retain tax, accounting, and dispute-resolution records, to respond to lawful requests from public authorities, and to comply with applicable law.
  • Consent: where you provide it explicitly (the acknowledgement checkbox on the intake form covers your assent to processing intake data for the purposes above; consent is not the legal basis on which we rely for performance-of-contract or legal-obligation purposes).

Deliverable retention

Once your audit is delivered, the audit report PDF is sent to you and is yours to keep, and the Schema Pack is delivered to you as a downloadable .zip. The Playbook (Audit and Enterprise tiers) is hosted at a private URL for twelve (12) months from delivery. After 12 months, Web Cited may take the URL offline; we retain a copy of the rendered content in our archives for an additional twelve (12) months and can re-publish on request. After 24 months from delivery, the rendered Playbook content may be deleted from Web Cited's systems unless a separate retention agreement applies. The full retention schedule for deliverables is in Terms of Service §6.1.

Hosting

This site is a static collection of HTML, CSS, JavaScript, and images served by GitHub Pages, which delivers content through its own content-delivery network (Fastly). GitHub and Fastly may retain access logs (including IP addresses and request headers) at the infrastructure level for security and content delivery, as described in the GitHub General Privacy Statement and Fastly's privacy policy. DNS for web-cited.com is provided by Cloudflare (as authoritative DNS only, not as a request-path proxy); Cloudflare's DNS service may process DNS-query metadata. The intake API at api.web-cited.com runs on Cloudflare's edge-compute platform and may retain its own access logs at the infrastructure level. Web Cited does not access, request, or retrieve any of these providers' infrastructure logs.

Third parties

When you submit the intake form, your data flows through a short list of service providers we need to actually deliver the audit. The full list mirrors Terms of Service §6.7 and is grouped by what each provider handles.

Personal-data processors (handle your contact details, your company information, and your payment information):

  • Cloudflare: runs our intake API at api.web-cited.com and stores at-rest operational data.
  • HubSpot: customer relationship management (CRM) system holding your contact record and deal record.
  • Resend: email-delivery service for scope, kickoff, and follow-up emails.
  • Stripe: payment processor for invoices and the hosted checkout you are redirected to. Web Cited never sees your card data.

Audit-content backends (process your Customer Content, meaning the buyer questions, brand and competitor list, and URLs you submit on intake; do not directly receive your name, email, or other contact details):

  • OpenAI, Anthropic, Google (Gemini), and Perplexity: large language model (LLM) backends queried with your buyer questions to test how each engine answers.
  • DataForSEO: structured search-engine and SERP (search engine results page) data provider.

Each provider acts as a data processor under our instructions and is governed by its own privacy policy and our data-processing agreement with it. We do not share, sell, or transfer your information to any third party beyond this list. For links to each provider's current privacy statement, email hello@web-cited.com.

Outside of that pipeline, this site uses no analytics, no ad networks, no chat widgets, no embedded video, no marketing pixels, and no fingerprinting. We use the system font stack rather than a third-party font service. We do not embed YouTube, Vimeo, X/Twitter, Calendly, Intercom, or any other widget. Outside of form submission, the only outbound network call you'll make from any page on this site is to follow a link you click yourself.

Publicity

Per Terms of Service §11, Web Cited may identify you as a customer (by name and logo) on the Site, in marketing materials, and in case studies, in factual descriptions of the engagement and without disclosing Confidential Information. To opt out at any time, email hello@web-cited.com with the subject "Publicity opt-out". Following an opt-out, Web Cited will use commercially reasonable efforts to remove or redact references on assets Web Cited controls within thirty (30) days; see Terms §11 for the full mechanism.

Children

This site is intended for an adult business audience. We do not knowingly collect any information from anyone under the age of 18, consistent with Terms of Service §1.

Automated decision-making

When you submit the intake form, it receives a simple scope-fit score before anything else happens. The score gates only one thing: whether a scope-confirmation email and invoice are generated automatically, or whether your intake is held back for a human to review first. Either way, a human sees every intake - the score doesn't accept or reject anyone on its own. Under GDPR Article 22, this does not qualify as "solely automated decision-making with legal or similarly significant effects." We disclose it here in the interest of full transparency. If you'd prefer your intake be reviewed manually rather than scored, reply to the scope email when you receive it, or email hello@web-cited.com before submitting.

Your rights

If you haven't contacted us or submitted the intake form, we don't have any record of you: rights like access, rectification, deletion, and portability have nothing to act on. If you have submitted the intake or emailed us, you can exercise those rights by writing to hello@web-cited.com. We'll acknowledge within 5 business days and complete the action within 30 business days, across each of the systems involved: our CRM, the email-delivery service's message logs, the intake API's operational storage, and our email threads. Invoices already paid are retained by our payment processor for the period required by tax law (generally 7 years); we can remove your name and company from any draft, unpaid, or voided invoice, but cannot delete paid-invoice records.

The rights listed above (access, rectification, deletion, portability, and objection to processing) are intended to satisfy applicable obligations under California law (the California Consumer Privacy Act and California Privacy Rights Act) and EU and UK law (the General Data Protection Regulation and UK GDPR), where each applies. Residents of those jurisdictions have any additional rights granted by local law; we will honor any such rights on the same email-request mechanism. You also have the right to lodge a complaint with your local data-protection authority (in California, the California Privacy Protection Agency; in the EU, your member-state supervisory authority; in the UK, the Information Commissioner's Office).

Changes to this policy

If we ever introduce analytics, cookies, or third-party scripts, we will update this page, change the "Last updated" date at the top, and re-show the privacy notice on your next visit. Material changes will be reflected before - not after - the change goes live.

Contact

Questions about this policy or about Web Cited's data practices generally should go to hello@web-cited.com.