Privacy policy
Last updated October 28, 2026
This policy explains what personal data Supercitation collects, why, who helps us handle it, how long we keep it, and how you can see, correct or delete it. It applies to supercitation.com, the audits we run, and the work we sell. Our Terms and Conditions at supercitation.com/terms explain the rest of how we work.
1. Who we are
Supercitation is a business based in Washington, D.C. We decide how the personal data described here is used. You can reach us about anything in this policy at info@supercitation.com.
2. What we collect
When you request an audit. Our form asks for your website and your work email.
When you write to us. We keep your message and the address you sent it from. If you ask about a plan from an audit page, we keep your email, your name and your note. If you confirm or correct facts about your company on an audit page, we keep what you sent.
When we contact you first. We may use your name, your company and your work email, taken from public sources or a business contact database, to send you an audit or a short note about Supercitation.
When we run an audit. We read your public website, keep the text of the pages we read and a picture of your homepage, and look up your logo, colors and company name through a brand data service. We ask AI engines about your company and keep their answers and the sources they cite. This is mostly business information, but it can include personal data that your pages or the AI answers show, such as the names of founders or staff.
When you buy. Stripe, our payment processor, collects your payment details. We receive your name, email address, business name, billing details and a record of the payment. We never see or store your full card number.
When you visit the site. On supercitation.com we use PostHog to see how the site is used: the pages you view, where you came from, what you click, which sections appear on screen, how far you scroll, time spent on a page, and your device, browser and rough location. We count form starts, the names of the fields filled in, errors and results, never what you type. PostHog also records visits so we can replay them and fix what doesn’t work, with everything typed into forms hidden. When you open an audit or preview we made for your company, we can see that it was opened and what was clicked, and a personal link can tie that visit to the person we sent it to, or to anyone it was forwarded to. When you request an audit or agree to a plan, we link your earlier visits to the email address you gave us, and when you click through to checkout we can link the payment to the visit. Framer, which hosts the site, also counts visits, and our audit engine keeps daily totals of page views. To stop abuse of the audit form, we keep a scrambled version of your IP address, which cannot be turned back into the address, for about a day.
3. How we use it
to run your audit and send it to you
to reply to you
to do the work in your plan, and to bill and refund you
to send you email about Supercitation. You can ask us to stop at any time, and we will
to understand how the site is used and fix what doesn’t work, to see whether an audit we sent was opened so we know when to follow up, and to stop abuse of the audit form
to keep the business and tax records the law requires, and to enforce our terms
We use your website’s text and brand files only to run your audit and do your work.
4. Who we share it with
We do not sell your personal data, and we do not share it for advertising. We share it only with service providers who help us run Supercitation, and only what each one needs:
Framer, which hosts supercitation.com, counts visits and holds our audit pages
Cloudflare, which runs our audit engine, stores audit requests and results, and relays analytics through e.supercitation.com
PostHog, which runs our site analytics and the recordings of visits, on servers in the United States
Manifold, which puts our questions to AI engines, returns their answers and checks whether AI crawlers can read your site
the AI engines themselves, such as ChatGPT, Gemini, Claude and Perplexity, which receive our questions about your company
Anthropic, whose Claude models check AI answers against your website’s text
a brand data service, which returns your logo, colors and company name
Stripe, which processes payments and sends receipts
our email providers, which send and store the email we exchange with you
a business contact database, which supplies work email addresses when we contact someone first
We may also disclose personal data if the law requires it, to protect our rights or someone’s safety, or to a business that takes over Supercitation.
We will not show your audit, your name or your logo as an example of our work without your written permission.
5. Analytics and session recordings
We use PostHog, an analytics service, to understand how people use supercitation.com and to make it better.
Who we measure. We don’t measure visitors in the European Union, the European Economic Area or the United Kingdom. We also don’t measure any browser that sends a Global Privacy Control signal. Turning that signal on in your browser is how you opt out.
What we collect. The pages you visit, your clicks and scrolling, and which parts of a page were on screen. Your browser, device and page speed. Your IP address, which we use to estimate your country and city.
Session recordings. We record how a page looked and changed while you used it, so we can see what works and what breaks. Anything you type into a form field is masked and never recorded.
Cookies and storage. PostHog sets one first-party cookie on supercitation.com and uses your browser’s local storage. Both hold a random identifier so we can recognize a returning browser.
If you give us your email. When you request an audit or an agreement, we link your visits to that email address so we can follow up on your request.
Where it goes. Data travels through our own address, e.supercitation.com, to PostHog’s servers in the United States. PostHog may use automated tools, including AI models, to summarize recordings for us.
How long we keep it. Analytics events are kept for up to one year, and recordings for 30 days.
What we don’t do. We don’t sell this data and we don’t use it for advertising.
To ask what we hold about you, or to have it deleted, email info@supercitation.com.
Framer, which hosts the site, also counts visits, and our audit engine keeps daily totals of page views and clicks without cookies and without linking them to you. There is no advertising pixel or retargeting tag on supercitation.com.
6. Audit pages
Audits live at unlisted links. They are not listed on our site or in search engines unless a company lets us show its audit as an example, but anyone who has a link can open it, so share yours only with people who need it. If a link is shared by mistake, tell us and we will take the page down or move it to a new link.
7. How long we keep it
Audit requests, messages and contact details: while we are in touch, then for up to 24 months after our last contact.
Audits and the website text behind them: until we take them down, and no longer than 24 months after our last contact with your company. We take one down whenever you ask.
Records of the work in a plan, such as what we published and sent: for the length of your plan, then for up to 24 months.
Email records: while you are in touch with us. If you ask us to stop emailing you, we stop, and we delete the record if you ask.
Payments, invoices, refunds and tax records: as long as the law requires.
Site analytics: events for up to one year, recordings of visits for 30 days.
Scrambled IP addresses: about a day. Daily totals of page views and clicks contain no personal data, and we keep them.
If you ask us to delete something sooner, we will, unless the law requires us to keep it.
8. Your rights
You can ask us to:
send you a copy of the personal data we hold about you
correct anything that is wrong
delete it, including an audit and the website text behind it
stop sending you email
tell you who we have shared it with
Email info@supercitation.com from the address you gave us, or tell us which address you used, and say what you want. We answer within 30 days. If we cannot do what you ask, we will tell you why.
Privacy laws in places such as California, the European Union and the United Kingdom give some people these rights by law. We give them to everyone. We do not sell or share personal data in the ways those laws let you opt out of.
9. If you are in the EU or UK
We rely on our legitimate interests to answer requests, run audits, understand how our site is used and contact businesses about our work, on our contract with you when you buy, and on legal obligations for our records. You can object to our use of your data at any time by emailing us. You can also complain to your local data protection authority. We are based in the United States, and your data is processed there. Site analytics don’t run for visits we place in the EU, the EEA or the UK.
10. Security
We use reasonable measures to protect personal data, including access controls on our accounts and unlisted links for private pages. No system is perfectly secure, so we cannot promise that data will never be exposed. If a breach affects you, we will tell you as the law requires.
11. Children
Supercitation sells to businesses, and this site is meant for adults at work. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us something, email info@supercitation.com and we will delete it.
12. Changes and contact
When our practices change, this policy changes and the date at the top moves with it. If a change materially affects data you have already given us, we will say so on this page and, where we have your email, tell you before it takes effect.
Email: info@supercitation.com
Supercitation, Washington, D.C.