Privacy Policy

Effective date: March 30, 2026

This Privacy Policy explains how CiteFront ("we," "us," or "our"), operated by Alpine Samurai SAS, a Colombian company, collects, uses, and protects your personal data when you use our website at citefront.com and our AEO (Answer Engine Optimization) platform (collectively, the "Service").

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Data We Collect

Account information: When you create an account, we collect your name, email address, and a password. Passwords are stored using one-way cryptographic hashing and are never stored in plain text.

Brand and domain data: When you add brands to your account, we collect the domain names and related configuration you provide. This data is necessary to run AEO scans and generate optimization recommendations.

Scan results: When you run scans, we store the results -- including citation analysis, content briefs, and fix recommendations -- in your account so you can access them over time.

Usage logs: We collect basic usage information such as timestamps of actions, features used, and error logs. This helps us maintain and improve the Service.

Payment information: We do not collect or store credit card numbers, bank details, or other payment credentials. All payment processing is handled by LemonSqueezy, our Merchant of Record (see Section 4).

2. How We Use Your Data

To provide, operate, and maintain the Service
To run AEO scans on your behalf using AI providers
To generate optimization recommendations and content briefs
To send transactional emails (account confirmation, password resets, scan notifications)
To diagnose technical issues and improve the Service
To communicate important changes to the Service or this policy

We do not use your data for advertising. We do not sell, rent, or trade your personal data to third parties.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

Performance of a contract: Processing your account and brand data is necessary to provide the Service you signed up for.
Legitimate interest: Usage logs and error tracking help us maintain service quality and security.
Consent: Where required, we will ask for your explicit consent before processing (e.g., optional marketing communications, if we ever introduce them).

4. Third-Party Services

We use the following third-party services to operate CiteFront. Each has its own privacy policy:

LemonSqueezy -- Merchant of Record for payment processing. They handle all billing, payment data, invoicing, and tax compliance. We receive only your name, email, and subscription status from LemonSqueezy. LemonSqueezy Privacy Policy
OpenAI, Anthropic, Google (Gemini), and Perplexity -- AI APIs used to perform AEO scans and generate recommendations. We send domain names and publicly available web content to these APIs during scans. We do not send your personal information (name, email, password) to these services.
Resend -- Transactional email delivery. We share your email address with Resend solely to deliver account-related emails. Resend Privacy Policy
Railway -- Cloud infrastructure hosting our database and application servers, located in the United States.

5. Cookies

We use only session cookies that are strictly necessary for authentication. These cookies are HttpOnly (not accessible to JavaScript), are not used for tracking, and expire when your session ends or after a reasonable inactivity period.

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

6. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Railway infrastructure in the United States. We implement reasonable technical and organizational measures to protect your data, including:

Password hashing using industry-standard algorithms
HTTPS encryption for all data in transit
HttpOnly session cookies to prevent cross-site scripting attacks
Access controls limiting who can access production data

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. International Data Transfers

Alpine Samurai SAS is based in Colombia. Our infrastructure is hosted in the United States (Railway). If you are accessing the Service from the EEA or other regions with data protection laws, your data will be transferred to and processed in these locations. By using the Service, you consent to this transfer.

8. Data Retention

We retain your account data and scan results for as long as your account is active. If you delete your account, we will delete your personal data and scan results within 30 days, except where we are required by law to retain certain records.

Usage logs are retained for up to 12 months for diagnostic and security purposes, after which they are deleted or anonymized.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your personal data ("right to be forgotten").
Data portability: Request your data in a structured, machine-readable format.
Restriction: Request that we limit processing of your data in certain circumstances.
Objection: Object to processing based on legitimate interest.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Account Deletion

You can request complete deletion of your account and all associated data by emailing [email protected]. Upon verification of your identity, we will delete your account, brand data, scan results, and personal information within 30 days.

11. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service before the changes take effect. The "Effective date" at the top of this page indicates when this policy was last revised.

13. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

CiteFront (operated by Alpine Samurai SAS)
Email: [email protected]
Website: citefront.com