Privacy notice

Controller and scope

This notice applies to aicitewho.com, your account, and the AI Cite Who service. Contact hello@aicitewho.com for privacy questions or requests. The service is operated by Huang Haichuan, an individual operator based in China.

Data we process and why

We process account details (email, optional name, password hash when you use email sign-in, language preference, and a provider-specific account identifier when you use Google sign-in), project and website information, decision-intent questions, audit outputs and citations, subscription status, and service-security records, including the IP address observed on successful authentication for security review and short-term registration limits. Google provides your verified email address, name when available, and a stable Google Account identifier solely to create or authenticate your account. We do not request access to Google Drive, Gmail, contacts, or other Google services. We use these data to authenticate you, provide and secure the service, apply plan limits, support you, and meet legal obligations. We do not use your inputs or Google user data to train AI models.

We use a signed first-party session cookie to carry a public landing path, source category, evidence type, and time to registration. It contains no anonymous identifier and closes with the browser session; evidence older than 30 days is ignored. At registration, observed attribution is stored with your account to assess acquisition and verified payments, with test traffic separated. We do not retain arbitrary URL parameters, full external referring URLs, IP addresses, or fingerprints for attribution. Do Not Track and Global Privacy Control requests disable this attribution. Missing evidence is recorded as unknown.

Providers, payments, and retention

Google provides optional account authentication; Cloudflare provides hosting, storage, queues, and AI infrastructure; Resend delivers service email, including report-ready and competitor-review notices; and Waffo Pancake processes subscription checkout and payment data. For platforms you select, we send buyer questions and relevant public project context to OpenAI for ChatGPT, Google for Gemini, or Perplexity to obtain independent search answers. Payment-card data is handled by Waffo Pancake and is not stored on our servers. We store the Google Account identifier until the associated account is deleted; we do not store Google access or refresh tokens. Other data is retained while your account or paid access is active and for up to 90 days after cancellation or deletion requests, except where a longer period is required by law or needed to resolve disputes, fraud, or security issues. Empty accounts that have never been verified or signed in may be removed after 30 days without account or authentication-email activity, provided no business, payment, credit, support or other protected records exist. The latest successful login IP is visible only to administrators and retained for up to 90 days after that authentication; older accounts may have no recorded IP. IP addresses can be shared by unrelated people. Hashed delivery-suppression records and routine authentication security events are kept for up to 90 days; unresolved security incidents may be retained for investigation.

Your choices, security, and changes

You may request access, correction, deletion, or a copy of your personal data by emailing hello@aicitewho.com. Service providers may process data in jurisdictions other than yours under their applicable safeguards. We use access controls, encryption in transit, hashed passwords, and logging designed to protect the service; no method is completely secure. The service is not directed to people under 18. Material changes will be posted here before taking effect.