Privacy Policy
Last updated 14 November 2026. See also our Terms of Service.
1. Who is responsible
The controller responsible for your personal data is:
- Business
- Principia Technologies, trading as Supercite, an eenmanszaak (sole proprietorship) registered in the Netherlands
- Address
- (to be added)
- KVK number
- 42219932
- VAT number
- (to be added)
- legal@supercite.ai
For anything privacy-related, email privacy@supercite.ai.
This policy covers our website and the Supercite app. Where we process personal data on behalf of our customers (for example names that appear on a customer's website), the customer is the controller and we act as its processor under our Terms of Service.
2. What we collect
| Data | Examples |
|---|---|
| Account | Your name, email address and password. We store the password only as a salted scrypt hash, never in readable form. |
| Business information | Your website address, business name and description, country, competitors, prompts, and the articles we write for you. This is mostly about your business, but can include personal data, for example if your business carries your name. |
| Website connection | If you connect your site (WordPress, Webflow, Framer, Shopify or Ghost): its address and the access key, token or application password you give us, stored encrypted and used only to publish your articles. |
| Billing | Your plan, subscription status, billing country and the customer reference from our payment provider. Card details, billing address and tax ID are entered on the payment provider's page and stay with them. |
| Free report requests | The email address and website you enter when you ask for a free report. |
| Technical data | IP address and timestamps of login attempts (to stop password guessing), and server logs needed to run and secure the service. |
| Messages | What you write when you email us. |
Supercite also records answers from AI services to the prompts you track. Those answers are about businesses and products. They can occasionally mention people, such as founders named in an answer, and are stored as part of your workspace.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, running Supercite, writing and publishing your articles, support | Performance of our contract with you (Art. 6(1)(b)) |
| Billing, invoices and tax records | Contract, and our legal obligations (Art. 6(1)(b) and (c)) |
| Sending the free report you asked for | Steps taken at your request before a contract (Art. 6(1)(b)) |
| Security, preventing fraud and abuse, keeping logs | Our legitimate interest in a safe, reliable service (Art. 6(1)(f)) |
| Service emails, such as password resets, failed payments and important changes | Contract and legitimate interest (Art. 6(1)(b) and (f)) |
| Improving Supercite using aggregated, non-identifying statistics | Legitimate interest (Art. 6(1)(f)) |
We don't send marketing emails without your consent, we don't sell personal data, and we don't make decisions about you that have legal or similarly significant effects based solely on automated processing.
4. Cookies
We use only cookies that are needed for the site to work:
- a session cookie that keeps you logged in (for up to 30 days, extended while you use Supercite);
- a preference cookie that remembers whether you chose the light or dark theme.
We don't use analytics, advertising or social media cookies, so we don't ask for cookie consent. The payment provider's checkout page sets its own cookies to process payments and prevent fraud.
5. Who we share it with
We use the service providers below. They may only use your data to provide their service to us, under agreements that protect it.
| Provider | What for | Where |
|---|---|---|
| Hosting provider | Runs our servers and stores the database, including all data described in this policy. | (to be added) |
| Stripe (Stripe Payments Europe Ltd. and affiliates) | Checkout, card payments, invoices, subscriptions and tax. Where Stripe acts as reseller of your subscription, it's a separate controller for the payment data. | EU and United States |
| Resend | Sends account emails, such as password resets. | United States |
| Meta Platforms, Inc. (Meta Model API) | AI model that helps analyse websites, read AI answers about your brand and write articles. It receives business information (your website's content, business description, competitors, prompts and the AI answers we collect), never your login details or payment data. | United States |
| DataForSEO | Asks AI services the prompts you track and returns their answers. It receives the prompts and the country they're asked from, never your personal data. | (to be added) |
| Bright Data Ltd. | Backup for DataForSEO: asks AI services the prompts you track when DataForSEO can't. Receives the same prompts and countries. | (to be added) |
To track AI visibility, we send your prompts to AI services such as ChatGPT, Gemini and Google. Prompts are general questions buyers ask; we don't add your personal data to them. If you connect your website, we send your articles to it to publish them.
We may also disclose data when the law requires it, to protect our rights or others' safety, or to a successor if our business is transferred (for example to a company we set up to run Supercite). We'd tell you about such a transfer.
6. Transfers outside the EU
Some providers process data outside the European Economic Area, as shown above. Where a country doesn't have an EU adequacy decision, we rely on the European Commission's Standard Contractual Clauses or, for US providers that are certified, the EU-US Data Privacy Framework, together with additional safeguards where needed. For our AI model provider, we limit what we send to business information needed to analyse answers and write content. Contact us for a copy of the relevant safeguards.
7. How long we keep it
- Account and workspace data: as long as your account exists, then deleted within 90 days of closing it.
- Billing and invoice records: 7 years, as Dutch tax law requires.
- Free report requests: up to 12 months, unless you become a customer.
- Login attempt records: about one day.
- Server logs: up to 30 days, unless needed to investigate a security incident.
- Backups: overwritten on a rolling basis, within 30 days.
8. Security
We protect your data with measures appropriate to the risk, including encrypted connections (HTTPS), hashed passwords, hashed session tokens, rate limits on login attempts and restricted access to our systems. No system is perfectly secure. If a breach puts your data at risk, we'll inform you and the authorities as the law requires.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have it corrected if it's wrong;
- have it deleted;
- restrict or object to our use of it, including where we rely on legitimate interest;
- receive it in a machine-readable format and have it sent to another provider;
- withdraw consent at any time, where we rely on consent.
Email privacy@supercite.ai to use any of these rights. We'll reply within one month. We may ask you to confirm your identity first. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country, though we'd appreciate the chance to sort it out with you first.
10. Children
Supercite is a business service and isn't meant for anyone under 18. We don't knowingly collect data from children.
11. Changes to this policy
We'll update this policy when our practices change, for example when we add a service provider. The date at the top shows the latest version. If a change matters for how we use your data, we'll tell you by email or in Supercitebefore it takes effect.
12. Contact
Questions or requests: privacy@supercite.ai.