Privacy Policy
Version 2026-10-15 · Effective 15 October 2026
1. Who we are
CitedAI is operated by AmbitX (Pty) Ltd (trading as CitedAI) ("we", "us"). For the personal information described in this policy we are the responsible party under the Protection of Personal Information Act, 2013 (POPIA). This policy tells you what we collect, why, who we share it with, and the rights you have.
- Responsible party
- AmbitX (Pty) Ltd
- hello@ambitx.ai
- Website
- citedai.co.za
- Information Officer
- Murali Naidu, hello@ambitx.ai
CitedAI is a business service. Our clients are organisations that sign an agreement with us, and we invite their users. Where a client puts personal information into CitedAI (for example, a person’s name in a keyword), we process it on the client’s behalf as its operator, under our Terms. The client is the responsible party for that information.
2. What we collect and where it comes from
| Information | Where it comes from |
|---|---|
| Your email address, and a password stored only as a secure hash | Your organisation, when it asks us to invite you, and you, when you set your password |
| Your name, email address and profile picture link | Google, only if you choose "Sign in with Google" |
| Your organisation membership and role (owner, admin or member) | Us, when we set up your account |
| Sign-up and sign-in dates and times, and the IP address in our sign-in logs | Recorded automatically when you use your account |
| The versions of our Terms and this Privacy Policy you accepted, and when | Recorded when you accept them |
| Your organisation’s configuration: name, industry, country, brands (your own and competitors’), keywords and questions, website domains | You and your colleagues, or us on your organisation’s instructions |
| Scan results: AI answers, brand mentions, sentiment, cited sources | Generated by the AI providers in section 5 when we run your scans |
| Technical data: IP address, browser, pages and API paths requested, timestamps, internal user and organisation IDs; error reports | Recorded automatically by our servers and error monitoring |
| Demo requests: name, email address, company, website, role and message, and the campaign tags (utm_) in the link you arrived on, if any | You, through the demo request form on our website |
| Free website check: the website address you type, and what our check finds on that website’s public pages | You, on the free website check page, and the public pages of the website you name |
| Free website check full report: your name, work email address and company, and, if you give them, your phone number and role; the website you checked and its result; which boxes you ticked, when, and the wording you saw; if you asked to hear from us, whether and when you confirmed it from the link in our email; the campaign tags (utm_) in the link you arrived on, if any | You, on the free website check page when you ask for the full report, and on the page the link in our email opens |
| Website visits to our public pages (the pages outside the app, such as the homepage, our guides, the free website check, the demo request page and these legal pages): pages viewed, the site that referred you, campaign tags, device, browser, approximate location, and a random identifier held in a cookie | Google Analytics, automatically when you visit those pages. Not collected in the app |
| Billing contact details on your order form | Your organisation, when it signs an order form |
| Privacy requests you make: type, dates and a one-way hash of your email address | Recorded when you export your data, delete your account or turn off email reports |
Your organisation’s configuration and scan results are mostly business information about brands, not personal information about you. We do not ask for special personal information (such as health, religion or biometric data) or information about children, and you should not enter any.
3. Why we use it
- To provide the service under the agreement with your organisation: set up and secure your account, run scans, show results, and send the reports and change digests your organisation receives. (POPIA s11(1)(b): necessary to perform a contract.)
- To keep the service secure and working: sign-in logs, server logs and error reports let us detect misuse and fix faults. (s11(1)(f): the legitimate interest, ours and yours, in a secure, working service.)
- To understand how people find our website: which public pages they visit and which links and campaigns bring them. (s11(1)(f): our legitimate interest in improving the site and our marketing. Analytics is switched off in the app.)
- To reply to a demo request you send us. (s11(1)(a): your consent, given with the checkbox on the demo form; and s11(1)(b) where it leads to an agreement.)
- To run the free website check you ask for, and to stop it being abused. (s11(1)(f): your interest in the result, and ours in showing what CitedAI does and keeping the check working.)
- To send you the full report of your free website check, and to reply if you write back. (s11(1)(a): your consent, given with the required box on the form.)
- To tell you about CitedAI’s services, only if you ticked the separate, optional box on the free website check form AND then said yes from the link in the report email we sent you. (s69 and s11(1)(a): your consent. You can say no at any time.)
- To invoice and keep accounting records. (s11(1)(c): required by tax and company law.)
- To handle your privacy requests and keep a record that we did. (s11(1)(c).)
The platform does not send marketing emails to account holders. We send them only to people who ticked the separate, optional box on the free website check form and then confirmed it from the link in our email, and each one says how to stop them. We do not sell personal information, and we do not make decisions about you based solely on automated processing: scans analyse what AI assistants say about brands, not about you, and the free website check scores a website, not a person.
4. What you must give us, and what happens if you don't
To have a CitedAI account we need your email address: without it we cannot create your account or let you sign in. The configuration your organisation enters (brands, keywords, domains) is needed to run its scans; without it there is nothing to scan. Signing in with Google is optional. Filling in the demo request form is voluntary; without an email address we cannot reply. The free website check shows your score without any personal information. Asking for its full report is voluntary: without your name, email address and company we cannot send it. Your phone number, your role and the box to hear about CitedAI are optional. No law requires you to give us personal information, but South African tax law requires us to keep invoicing records once your organisation is a client.
5. Who we share it with
Other members of your organisation can see your organisation’s configuration and results. AmbitX staff with platform-administrator access can see all organisations, to set up accounts and support the service. We use the types of service provider below, who process personal information for us under their contracts with us. We may also disclose information where the law requires it. We do not share or sell it to anyone else. A client organisation may ask our Information Officer for the names of our current service providers.
| Type of provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Cloud database and sign-in provider | Database, sign-in and account management | All account and platform data described in section 2 | Ireland (EU) |
| Application hosting provider | Runs the CitedAI application server | All data passing through the application, and server logs | Netherlands (EU) |
| Website hosting provider | Hosts and serves the website | IP address, browser details and the pages requested | Global network, served from the location nearest you; company in the United States |
| Email delivery provider | Sends our emails: invitations, password resets, reports, change digests, free website check reports, demo requests and free check requests to us, and privacy-request notices to our Information Officer | Recipient email address and the content of the email | Sent from Ireland (EU); company in the United States |
| AI model providers | AI answers for scans, and the AI features of the platform, such as the website scanner, keyword suggestions, content recommendations and article drafts | The question or keyword being scanned, inside a prompt that names your industry and country. For the website scanner, up to 3,000 characters of text from the web page you ask us to scan. For the other AI features, your brand and competitor names, industry, keywords and a sample of scan results | United States |
| Keyword search-data provider | Search volume, search intent and keyword ideas | Keywords, and the brand names, topic terms and website domains used to find keyword ideas. No information about individuals | European Union |
| Error monitoring provider | Error monitoring | Error details, browser and device type, the page or API path, and internal user and organisation IDs. Configured not to receive your name or email address | United States |
| Google Analytics (Google LLC) | Measures visits to our public pages (the pages outside the app, such as the homepage, our guides, the free website check, the demo request page and these legal pages). Switched off in the app | Pages viewed, the site that referred you, campaign tags, device and browser details, approximate location worked out from your IP address (Google Analytics does not store the IP address itself), and a random identifier from a cookie | United States |
| Google (Google LLC) | Sign in with Google; web fonts; a speed test of the home page of a website checked on the free website check | If you sign in with Google, Google sends us your name, email address and profile picture link. Every page loads fonts from Google, which receives your IP address and browser details. For the speed test, our server sends Google only the address of the home page of the website checked | United States |
| Paystack | Card payments, only if your organisation pays by card on the platform. Nothing about invoiced clients paying by EFT is sent to Paystack | At card checkout: your email address, organisation name and ID, and the amount. Paystack collects card details directly; we never see them. Paystack’s checkout script also loads on our pages, so Paystack receives your IP address and browser details | Ireland (EU), where Paystack stores its data |
The AI providers receive questions about markets and brands, not your name or email address. They process what they receive under their API terms with us.
6. Transfers outside South Africa
None of our providers stores data in South Africa. Our database is in Ireland and our application server is in the Netherlands, where the EU General Data Protection Regulation provides protection substantially similar to POPIA. Other providers in the table above process data in the United States and elsewhere.
We transfer personal information outside South Africa under POPIA section 72: to recipients bound by a law or a binding agreement that provides adequate protection (s72(1)(a)); where the transfer is necessary to perform our agreement with you (s72(1)(c)); and where it is necessary to perform the agreement with your organisation, which is concluded in your interest (s72(1)(d)).
7. How we protect it
- All traffic is encrypted in transit (TLS). Passwords are stored only as secure hashes.
- Each organisation’s data is isolated at database level (row-level security), so one client cannot read another’s.
- Keys that can read all data are held only on our servers, never in your browser.
- Staff access is limited to what is needed to run and support the service.
If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires.
8. How long we keep it
| Information | How long |
|---|---|
| Your account (email, password hash, profile, memberships) | Until your account is deleted: by you in Settings, or by us when your organisation’s agreement ends. Deleting your account immediately removes your login, your memberships and your record of accepting the Terms and this policy. |
| Your organisation’s configuration and scan results | For as long as your organisation is a client. When the agreement ends, we delete it within 30 days unless your organisation asks us in writing to keep it longer (for example, to renew). If the last member of an organisation deletes their account, the organisation’s data is not deleted automatically: we record the request and our Information Officer actions it within 30 days. |
| Records of your privacy requests | Kept as evidence that we handled them. They hold a one-way hash of your email address, not the address itself. |
| Records of the Terms and Privacy Policy versions you accepted | Kept for as long as your account exists, as evidence of what you agreed to and when. Deleted with your account. |
| Server logs and error reports | A limited period, after which our hosting and error-monitoring providers delete them automatically (error reports after at most 90 days). |
| Demo requests | Emailed to us and not stored in our database. We keep the email only as long as we need it to follow up with you, and delete it if you ask. |
| Free website check | The check itself is not stored in our database. The website address and the result stay in our server’s memory for up to 24 hours, your IP address for up to a day, and then they are discarded. The server log line about the check is kept like any server log (above). |
| Free website check full report requests | Your details, your choices and the result are stored in our database and deleted automatically 12 months after your last request, unless your organisation becomes a client (then section 8’s client rows apply). A request to hear from us that you do not confirm within 30 days lapses. The note we send our own team names your company and the website, not you, so it holds none of your details. You can ask us to delete your details sooner. |
| Website analytics | Google Analytics keeps visit-level data for at most 14 months, the longest it allows. Its cookie expires two years after your last visit unless you delete it sooner. |
| Invoices and accounting records | At least five years, as South African tax law requires. |
9. Your rights
Under POPIA you may:
- Access your information (s23). In Settings, under Privacy, choose Download my data for a copy of your account details, memberships and consent records and, for each organisation you are a member of, its brands, keywords and domains. You can also ask us for anything else we hold about you.
- Correct or delete it (s24). Ask us to correct anything inaccurate. In Settings, under Privacy, choose Delete my account to delete your login, memberships and consent records; section 8 explains what happens to your organisation’s data.
- Object (s11(3)) to processing based on legitimate interests. Any member of your organisation can turn off report and change-digest emails in Settings, under Privacy, or ask us to stop them.
- Withdraw consent where we rely on it. This does not affect processing before you withdrew. To stop hearing from us about CitedAI, reply to any of our emails or email our Information Officer, and we record it at once. If you never confirmed the link in our report email, we never contact you about our services.
- Complain to the Information Regulator (s74) if you believe we have interfered with your personal information. We would like the chance to put it right first, but you do not have to contact us before complaining.
To exercise a right, email our Information Officer at hello@ambitx.ai. We will respond within a reasonable time and in any event within 30 days, and may first need to confirm your identity. There is no charge.
- Information Regulator
- Information Regulator (South Africa)
- Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Telephone
- 010 023 5200 (toll-free 0800 017 160)
- Complaints
- POPIAComplaints@inforegulator.org.za
- General enquiries
- enquiries@inforegulator.org.za
- Website
- inforegulator.org.za
10. Cookies and local storage
On our public pages (the pages outside the app, such as the homepage, our guides, the free website check, the demo request page and these legal pages) we use Google Analytics, which sets first-party cookies (_ga and _ga_ followed by an ID) holding a random identifier, so we can count visits and see which links bring people to the site. It is switched off in the app, after you sign in. You can block these cookies in your browser’s settings or with Google’s opt-out add-on. We use no advertising trackers. The app keeps a few items in your browser’s local storage, which stays on your device:
- Your sign-in session, so you stay signed in.
- A copy of your user and organisation details, so the dashboard still loads if the network drops for a moment.
- Display preferences and unfinished choices in forms.
Signing out removes the session and the copy of your details. Our pages also load fonts from Google and Paystack’s checkout script, so those providers receive your IP address and browser details when a page loads.
11. Demo requests
When you request a demo, the name, email address, company, website, role and message you enter are emailed to us at hello@ambitx.ai through our email delivery provider, with the campaign tags in the web address you arrived on, if any (for example utm_source=linkedin), so we know which link brought you. They are not stored in our database. Our server log records only that a request arrived and the domain part of the email address (for example, acme.co.za), not your IP address. To stop the form being abused, your IP address is held in our server’s memory for up to an hour and then discarded. We use your details only to reply to you, as you agreed when you ticked “CitedAI may contact me about a demo”. To withdraw that consent, email us and we will delete your request.
12. Free website check
On our free website check page you type a website address. Our server then reads up to ten public pages of that website, and its robots.txt, sitemap and llms.txt files, the way a search or AI tool would, and asks Google’s free speed test to load the website’s home page once (Google receives only that page’s address). No AI is asked. Only public websites can be checked: the check refuses private and internal network addresses. You see the website’s score and its top fixes without giving any personal information.
The check itself is not stored in our database. The result is kept in our server’s memory for up to 24 hours, so a second check of the same website answers at once, and is then discarded. Our server log records that a check ran, the website address checked and the outcome, not your IP address. To stop the check being abused, your IP address is held in our server’s memory for up to a day and then discarded. The page is one of our public pages, so section 10 applies to it.
The full report. If you ask for the full report, we ask for your name, work email address and company, and, if you wish, your phone number and role. We use them to send you the report and to reply if you write back; you agree to that with the required box on the form. The report email does not repeat words from the website you checked, only its address and the addresses of its pages.
Hearing from us. A second, separate box, which is never ticked for you, asks CitedAI to contact you about its services. You can leave it empty and still get the report. Ticking it is only a request: the report email carries a link, and we contact you about our services only after you open it and choose yes. If you choose no, do nothing for 30 days, or leave the box empty when you ask for a report again, we do not contact you about our services. You can say no at any time after that by replying to any of our emails or emailing our Information Officer, and we record it at once.
We store your details, the boxes you ticked (with the time and the wording you saw), whether and when you confirmed the link, the campaign tags in the link you arrived on and the result in our database, and email the report to you through the email delivery provider in section 5. We also send our own team a short note so we can follow up: it names your company, the website and its scores, never your name, email address or phone number. Our server log records only that a request arrived and the domain part of your email address, not your name, email address, phone number or IP address. To stop the form being abused, your IP address, and a count of the reports sent to your email address and to its domain that day, are held in our server’s memory for up to a day and then discarded. We delete your details 12 months after your last request unless your organisation becomes a client. Section 9 lists your rights, including access and deletion.
If you then book a demo, the website address (and, after the full report, your name, email address, company and role) is filled in on the demo form for you; you can change any of it, and section 11 applies to what you send.
13. Changes to this policy
When this policy changes, we publish the new version here with a new version number and effective date. If a change is material, we tell account holders by email or in the app and may ask you to accept the new version. Earlier versions are available on request.
14. Contact
Questions about this policy or your personal information: hello@ambitx.ai (Information Officer: Murali Naidu).