Privacy Policy

Last updated: July 15, 2026

This policy explains what ncited collects, why, and what we do with it. Short version: we collect what's needed to run the Service, we don't sell your data, and the domains you audit are processed to produce your reports — nothing else.

What We Collect

Account data: your email address (used for magic-link sign-in), workspace name, and role. Billing data: handled by Stripe — we store your Stripe customer reference, plan, and purchase history, never card numbers. Content you provide: client domains/URLs submitted for audits, Google Ads exports you upload, and branding assets (logos, colors, footer text). Usage data: audit/job history, credit usage, and report view counts on shared report links.

How We Use It

To run audits and generate your white-label reports; to operate billing, credits, and subscriptions; to send transactional email (sign-in links, receipts, delivery notices); and — only where we have a customer relationship with you — occasional product and marketing email, every one with a working unsubscribe. We may publish aggregated, anonymized audit statistics that never identify you or your clients.

Who Processes It (Subprocessors)

Stripe (payments), Vercel (hosting and file storage), Neon (database), Resend (email delivery), and Anthropic (audit narrative generation — report inputs only). Each receives only what its function requires. Audit engines analyze publicly available data about the domains you submit.

Cookies

We set a session cookie to keep you signed in. We do not run third-party advertising trackers on this site. If that changes (e.g. ad retargeting pixels), this policy and a consent mechanism will be updated first.

Retention & Deletion

Account and billing records are kept while your account exists and as required for tax and accounting. You can request a copy of your data or deletion of your account and its content at any time by emailing hello@ncited.co from your account email; we'll confirm completion. Some billing records must be retained where the law requires.

Your Clients' Data

Reports you generate about client domains are your work product. We process client domains as your service provider and don't contact your clients or use their identities for our own marketing.

Miscellany

The Service is for business use by adults (18+). We take reasonable technical measures to protect data (TLS everywhere, secrets management, least-privilege access). If we make material changes to this policy, we'll post them here with a new date. Questions: hello@ncited.co.