CiteLook Privacy Policy

This Privacy Policy explains how New Ways of Doing LLC ("CiteLook," "we," "us," or "our") collects, uses, stores, shares, and deletes information when you visit citelook.com (the "Site"), join our waitlist, or, after launch, use the CiteLook software service (the "Service"). Section 4 explains how we will handle information we receive from Google APIs.

1. Who we are and what CiteLook does

CiteLook is business software that we are building. It is designed to help businesses, and the people they authorize, manage their own Google Business Profile information and review replies, and track how their business appears in search results and AI search answers.

The Service is not available yet. Today, the Site provides information about CiteLook and a waitlist. Where this policy describes the Service, it explains how we will handle information when the Service becomes available.

The Service is designed for business use by people who are 18 or older and is intended for businesses in the United States.

2. Information we collect

Waitlist information. When you join our waitlist, we collect your first name, last name, and email address, which are required. You can also choose to tell us what you do by selecting an option on the form, and you can choose to give us your company name and your website or Google Business Profile link. We also record when you joined and the page you joined from.

Technical information. When you visit the Site, our hosting provider's server logs record technical information, such as your IP address, browser type, and the pages you request.

Communications. When you email us, we receive your email address and the content of your message.

Account information (after launch). If you create an account after launch, we will collect your name, your email address, and the information needed to sign you in.

Customer Inputs (after launch). If you use the Service after launch, we will collect the information you add to it ("Customer Inputs"), such as your website and domain names, business and brand names, competitor names and domains, keywords, questions to track, and target locations.

Google user data (after launch). If you connect your Google Business Profile after launch, we will receive information from Google APIs as described in Section 4.

Search and AI visibility data (after launch). If you use the Service after launch, we will obtain search and AI answer data from a third-party search data provider based on your Customer Inputs, as described in Section 5.

Payment information. We do not offer paid plans yet. Before we do, we will update this policy to describe the payment information we collect and the payment processor we use.

3. How we use information

We use the information described in Section 2 to:

• manage the waitlist and email you about CiteLook, as described in Section 6;
• respond to your messages;
• provide the Service after launch, including your account and the metrics, scores, and reports in your dashboard;
• send service messages, such as security alerts and notices about changes to the Service or this policy;
• keep the Site and the Service secure, prevent fraud and abuse, and enforce our Terms of Service;
• understand and improve the Site and the Service using information that does not include Google user data; and
• comply with legal obligations.

Google user data will be used only as described in Section 4. The uses in this Section 3 do not expand those limits.

4. Information we will receive from Google APIs

CiteLook does not access Google user data today. If you connect your Google Business Profile after launch, we will handle the information we receive from Google APIs as described in this section.

4.1 How we will access Google user data

If you connect your Google Business Profile after launch, we will access Google user data only after you choose to connect a Google Account to CiteLook and approve access on Google's consent screen. Google shows you the permissions CiteLook requests, and you can decline. We will never see or store your Google password.

You should connect only Business Profiles that you own or manage, or that the owner has authorized you to manage.

4.2 Permissions we will request

If you connect your Google Business Profile after launch, we will request this Google permission (OAuth scope):

• https://www.googleapis.com/auth/business.manage, which lets CiteLook view and manage the Business Profiles that your Google Account can access.

We will request only the permissions needed for the features described in this section. If we add a feature that needs another Google permission, we will update this policy and ask for that permission separately when you use that feature.

4.3 What Google user data we will access

If you connect your Google Business Profile after launch, we will access the following information for the locations you choose to connect:

• the names and identifiers of the Business Profile accounts and locations you can access;
• business information on those profiles: business name, phone numbers, categories, address, website, regular and special hours, service area, description, open status, map location, and profile metadata;
• reviews of those businesses: star rating, review text, review dates, and existing replies; and
• daily performance metrics for those profiles, such as views on Google Search and Maps, calls, website clicks, direction requests, and, where available, messages, bookings, and food orders.

Review text will be shown only to users you authorize in your CiteLook account. Google's review data may include the reviewer's display name and profile picture; we will not store them. We will not access photos or videos attached to reviews, and we will not access data for locations you do not choose to connect.

4.4 How we will use Google user data

If you connect your Google Business Profile after launch, we will use Google user data only to provide features you can see and use in CiteLook:

• to show your Business Profile information in your CiteLook dashboard and alert you to missing or inconsistent information;
• to let you edit your Business Profile information and publish the changes you approve;
• to show your reviews and let you write replies, request an AI-drafted reply, and publish replies that you approve;
• to show your Business Profile performance metrics in your dashboard; and
• to notify you of changes made to your Business Profile through CiteLook.

We will show your Google Business Profile data separately from data that comes from other sources. We will not share it with, or compare it against, other CiteLook customers. Google Business Profile data will not be used to calculate CiteLook scores. Trends for your Business Profile will be retrieved from Google when you view them; we will not store Business Profile content to build historical trends.

CiteLook will publish a review reply or a profile change on Google only when you take or approve that action. CiteLook will create an AI-drafted reply only when you click the button to request one and will never publish a draft without your approval. We will not post replies or make changes automatically.

Our staff will not read your Google user data unless (a) you ask us to and give us permission to view specific data, for example in a support request; (b) it is necessary for security purposes, such as investigating a bug or abuse; or (c) it is necessary to comply with applicable law.

4.5 How we will share Google user data

We do not sell Google user data, and we do not share it with third parties for advertising or for any purpose other than providing the features you use, as described in this section. We will not use Google user data for advertising, and we will not use it to train generalized AI or machine-learning models.

If you connect your Google Business Profile after launch, the service providers that will process Google user data on our behalf are:

• Supabase, for database storage;
• Railway, for application hosting and processing; and
• Anthropic, only when you ask CiteLook to draft a review reply with AI.

If you ask CiteLook to draft a reply with AI, we will send the review text, star rating, your business name and category, and the reply tone you choose to Anthropic to create the draft. We will not send reviewers' names or photos, your contact details, or access tokens to Anthropic.

We will not send Google user data to our search data provider.

If CiteLook is involved in a merger, acquisition, or sale of assets, we will transfer Google user data only after obtaining your explicit prior consent. If the law requires us to disclose Google user data, we will disclose only what the law requires.

4.6 How we will store Google user data

If you connect your Google Business Profile after launch, Google user data will be processed by our application hosting provider and stored in our database, which is hosted in the United States. Our database is encrypted at rest with AES-256, and connections to it are encrypted in transit with TLS. Google user data will be accessible only to systems and personnel that need it to provide the Service. Tokens that Google issues to CiteLook will be stored in encrypted form, and we will not write Google content or tokens to our logs.

We will keep Business Profile content received from Google for no more than 7 days and will refresh it from Google as needed.

4.7 How to disconnect and how we will delete Google user data

If you connect your Google Business Profile after launch, you will be able to disconnect it at any time using the Disconnect option in CiteLook, or by removing CiteLook's access from your Google Account permissions page at https://myaccount.google.com/permissions.

When you disconnect, or when we learn that you removed CiteLook's access, we will:

• stop accessing your Google user data;
• revoke the tokens for that connection with Google and delete them; and
• delete Google user data received through that connection from our database within 24 hours.

Any copy of that data in our database backups will be removed when those backups expire, within 7 days. If you delete your CiteLook account, we will delete your Google user data in the same way. You can also ask us to delete it by emailing [email protected].

4.8 Google API Services User Data Policy

CiteLook's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.9 Working with a third party

If you connect your Google Business Profile after launch and CiteLook manages it for your business, CiteLook will work with your business as a third party. The business owner will always remain the owner of its Business Profile and will give CiteLook Manager access in the "People and access" section of the profile, which the owner can remove at any time.

Google Business Profile is a free service from Google. Any fees you pay CiteLook will be for CiteLook's software and services, not for Google Business Profile.

To learn what to expect when working with a third party, see Google's guidance: Working with a third party.

5. Search and AI visibility data from third-party providers

After launch, to measure how your business appears in search results and AI search answers, we will send search parameters based on your Customer Inputs, such as keywords, domain names, brand names, locations, and languages, to our third-party search data provider, DataForSEO, and receive search and AI answer data in return.

• Metrics only. CiteLook will show derived metrics, such as rank or position, URL or domain, whether a result or mention is present, whether your brand was mentioned, the number of sources cited, and scores we calculate.
• No content copies. We will not store or display search result snippets, the text of AI-generated answers, the text of third-party reviews or comments, or images from these sources.
• Short retention. We will keep raw data from our search data provider only as long as needed to calculate metrics, and no longer than 7 days. After that, we will keep only the derived metrics.
• Personal details masked. When raw data enters our systems, we will remove or mask fields that identify individuals before further processing.

This data will be kept separate from the Google user data described in Section 4.

6. Waitlist emails

If you join our waitlist, we will use your name and email address only to send you emails about CiteLook: a confirmation when you join, and later, a notice when CiteLook launches and other news about CiteLook. We will not sell your email address or give it to others for their marketing.

The confirmation email only confirms that you joined. If you didn't sign up, reply to it or email [email protected] and we will remove you. Every other email we send to the waitlist will:

• clearly identify CiteLook as the sender and have a subject line that reflects its content;
• include our postal address; and
• include a link to unsubscribe.

You can unsubscribe at any time by using the link in any of these emails, by replying to any email from us, or by emailing [email protected]. Unsubscribing will not require a fee, a login, or any information other than your email address. We will honor unsubscribe requests within 10 business days. If you unsubscribe, we will keep your email address only to make sure we do not email you again, unless you ask us to delete it.

We also send your waitlist information to our own team inboxes so we can manage the waitlist. These internal notifications are not sent to anyone outside CiteLook.

We use Resend, an email delivery provider, to send these emails. See Section 7.

We keep waitlist information until you ask us to delete it. To ask, email [email protected].

7. How we share information

We share information only as described in this policy. Google user data will be shared only as described in Section 4.5.

Service providers. These service providers process information on our behalf to run the Site and the Service:

Legal and safety. We may disclose information other than Google user data if required by law or legal process, or if needed to protect the rights, property, or safety of CiteLook, our users, or others. Google user data is handled as described in Section 4.5.

Business transfers. If CiteLook is involved in a merger, acquisition, or sale of assets, information other than Google user data may be transferred as part of that transaction and will remain subject to this policy. Google user data is handled as described in Section 4.5.

We do not sell personal information, and we do not use it for targeted advertising.

8. Cookies and Do Not Track

We do not use advertising or analytics cookies or similar tracking technologies on the Site. We use only cookies that are necessary for the Site and the Service to work, such as cookies that keep you signed in after launch.

Our Site does not respond to "Do Not Track" browser signals. We do not allow third parties to collect information about your online activities over time and across different websites through our Site.

9. Security

We use reasonable administrative and technical safeguards designed to protect information against unauthorized access, use, loss, alteration, or disclosure. These safeguards include encrypting data in transit and at rest and limiting access to the people and systems that need it. No method of transmission or storage is completely secure.

10. How long we keep information

Except for Google user data, which we keep only as described in Section 4, we may keep information longer if required by law or to resolve disputes.

11. Your choices

• Access, correction, and deletion. You can ask us to access, correct, or delete your information by emailing [email protected]. We will verify your request and respond.
• Google connection. After launch, you will be able to disconnect your Google Account at any time; see Section 4.7.
• Waitlist emails. You can unsubscribe at any time; see Section 6.

Depending on the state where you live, you may have additional privacy rights. We will honor those rights as required by applicable law.

12. Children

The Site and the Service are for businesses and are not directed to children. You must be 18 or older to use the Service. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact [email protected] and we will delete it.

13. Where we operate

CiteLook is based in the United States, and our database is hosted in the United States. Some service providers process limited data outside the United States, as described in Section 7. The Site and the Service are intended for businesses in the United States and are not directed to individuals in the European Union, the European Economic Area, or the United Kingdom.

14. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date. If we make a material change, we will notify you by email or in the Service before the change takes effect. Before we use Google user data in a new way or for a purpose not described in this policy, we will ask for your consent.

15. Contact us

If you have questions about this policy or how we handle information, contact us at [email protected].

CiteLook is operated by New Ways of Doing LLC.
165 Berwick St, Melrose, Massachusetts 02176-3830, United States of America