1. Who is responsible for your information

Citrevo is operated by RAXZ LTD. We are the controller of personal information used to operate Citrevo, manage accounts, produce visibility reports and handle enquiries. This notice covers visitors, users, business contacts and people whose public business information appears in a scan.

For privacy questions, rights requests or complaints, email [email protected] with “Citrevo privacy” in the subject, or write to our registered office.

2. Information we collect and its sources

• Account information you provide: email address, account identifier, display name where supplied, account memberships and sign-in/session records.
• Scan inputs: website address, business or trading name, aliases, category, services, customer geography and corrections you make to discovered details.
• Public-source information: text and metadata from the public webpage you submit, public business details, source URLs and content referenced in AI responses. This can identify sole traders or named business representatives even when published openly.
• Generated and operational records: questions, AI answers, citations, mention/recommendation matches, report summaries, diagnostics, any enabled page captures, timestamps, scan status, provider usage and error records.
• Enquiries and order records: contact information, messages, interest in weekly reports or expert help, requested offers, order references, acceptance records and any payment status needed for an enabled purchase. Live payments are not enabled in the current release.
• Technical information: IP/network information, browser and request details, access times, security and service logs, and essential cookies or browser-storage records. Hosting and authentication systems can receive IP addresses even where the scan-intake system uses a hashed network identifier.

Sources are you and authorised account users, public websites, AI/API providers, our authentication and hosting systems, and payment providers if checkout is enabled. Do not enter private records, credentials, sensitive personal information or data about children. If such information appears inadvertently, contact us so we can assess restriction or removal.

3. Why we use it and our lawful bases

Provide your account, checks and reports

We use account and scan information to perform our contract with you or take steps you request before a contract. Where you represent a company rather than contracting personally, our legitimate interest is providing and administering that company’s service.

Analyse public business visibility

Our legitimate interest is providing relevant, evidence-led business research and checking report accuracy. We consider the nature of the public information, its relevance, reasonable expectations and potential effects on individuals. Public availability does not remove your data-protection rights.

Protect and operate the service

Our legitimate interests include preventing abuse, authenticating users, protecting accounts, diagnosing faults, controlling provider costs and maintaining a reliable service.

Respond to enquiries and requests

We rely on steps requested before a contract, performance of a contract, or our legitimate interest in answering business enquiries. Responding to an expert-help or weekly-report enquiry does not automatically subscribe you to general marketing.

Meet legal requirements and resolve disputes

We use necessary records to comply with legal obligations, including applicable accounting and data-protection requirements, and for our legitimate interest in establishing, exercising or defending legal claims.

Optional marketing or non-essential tracking

Where introduced and required by law, these require a separate choice and valid consent. They are not a condition of using a free scan or creating an account. You can withdraw consent without affecting earlier lawful processing.

You do not have to provide information, but we cannot supply an account without an email address or produce a meaningful report without the relevant business details. We do not sell personal information or use scan submissions for advertising profiles.

4. AI processing and automated analysis

When a scan is enabled, Citrevo generates business-discovery questions from the selected category, services and customer geography and sends those questions to an AI service. The current integration routes requests through OpenRouter to the configured model/provider; the initial configuration uses Perplexity Sonar. A question can contain personal information if the submitted business details themselves identify a person.

We do not deliberately include your account email, sign-in credentials or payment details in those AI prompts. Public business names, personal names or website details can nevertheless appear in provider answers, citations and report evidence. Providers receive request content and technical information needed to process the request.

AI providers have their own processing terms, retention settings and subprocessors. We do not promise zero provider retention, exclusively UK processing or a universal exclusion from provider model training. Only submit public business information suitable for this analysis. See also Perplexity’s privacy notice.

Our automated matching and summaries assess business visibility. We do not use them to make decisions about individuals that have legal or similarly significant effects. You can challenge a match or request a human review of a concern by contacting us.

5. Who receives information

• Hosting: SMLL provides the application infrastructure. It is also a Raxz-operated service; operating within the same group does not mean that all staff or other customers can access Citrevo data.
• Database and authentication: Supabase stores application and account data, handles authentication and prepares sign-in and account-confirmation emails.
• Transactional email: Amazon Simple Email Service (Amazon SES), provided by Amazon Web Services, delivers our authentication emails through Supabase’s SMTP integration. SES receives the recipient’s email address, sender details, message content (including the single-use sign-in link) and delivery information such as timestamps, delivery outcomes, bounces and complaints. We use this for account access, reliable delivery and abuse prevention, not to add you to marketing lists. See the AWS privacy notice.
• AI processing: OpenRouter and the underlying model/provider receive the information described in section 4 when a scan runs.
• Public websites: fetching a submitted page necessarily discloses a request and the fetching server’s network information to that website and its infrastructure providers.
• Payments, if enabled: Stripe processes hosted checkout information and provides transaction references and status. We do not receive full card details through hosted checkout. Stripe is not used to take live payments in the current release.
• Authorised people: relevant account users, staff supporting or administering the service, and anyone with an enabled unlisted report link. Professional advisers or authorities may receive information where necessary for legal obligations or claims.

If the business is reorganised or transferred, relevant information may be disclosed to advisers and a successor subject to appropriate confidentiality and data-protection requirements. We do not give unrelated Raxz services permission to market to you merely because you use Citrevo.

Report links should be treated as access credentials. A recipient may retain a copy even after we revoke the link. Account authentication and private report tokens do not prevent someone you share with from copying the report.

6. Locations and international transfers

The current Supabase project is configured in its London region, the SMLL application is deployed in its EU Central region, and our Amazon SES sending endpoint is in EU West (Ireland, eu-west-1). Email is also handled by the recipient’s email provider. Regional configuration does not guarantee that every support, delivery, AI-processing or backup operation stays in that location. Our providers may process information in other countries, including the United States.

UK data-protection law requires a valid transfer mechanism for restricted transfers, such as applicable UK adequacy regulations or appropriate contractual safeguards, together with any required assessment and supplementary protections. The mechanism depends on the recipient and processing involved; a provider’s privacy notice alone is not a transfer safeguard.

Contact us for details of the recipients, processing locations and safeguards applicable to your information, or to request a copy of relevant safeguards with confidential information removed where appropriate.

7. How long information is kept

We keep personal information for the purpose for which it was collected, rather than treating it as a permanent archive. Retention depends on the type of record, whether your account or request remains active, the need to explain a report, and applicable legal or dispute requirements:

• Accounts and saved reports: while needed to provide your account and requested report history. When you request closure or deletion, we assess which records can be removed and which must be retained for a specific lawful reason.
• Anonymous checks and supporting evidence: for delivery, recovery, investigation of errors and legitimate disputes. Public business facts may remain personal information and are subject to the same necessity assessment.
• Enquiries: while dealing with the enquiry and any resulting relationship or reasonably anticipated follow-up; you can ask us to stop follow-up or delete it where applicable.
• Transactional email information: as needed to deliver and troubleshoot authentication messages, handle bounces or complaints and prevent abuse, subject to the applicable Supabase, AWS and recipient-provider retention arrangements. The expiry of a sign-in link does not mean that the message or delivery records are immediately erased.
• Security and technical records: as needed to detect abuse, investigate faults or incidents and protect legal claims. Scan-intake rate-limit records older than 24 hours are removed during subsequent intake processing; this is not a 24-hour deletion promise for hosting logs or other records.
• Orders, consent and accounting records: for the applicable statutory accounting period and where necessary to evidence an agreement, payment, cancellation or legal claim.

There is no universal automatic expiry for all report or account records in this release. Deletion requests are handled through the contact above. Any information retained after a request must have a continuing lawful purpose; we will explain relevant exceptions. Backup removal follows the applicable provider’s backup lifecycle, and restricted records may remain there until overwritten. Ask us for the retention position for a particular record.

8. Cookies and browser storage

The current Citrevo application uses browser storage for requested functionality. It does not embed advertising pixels, session-replay software or non-essential analytics. A consent banner is not used for these strictly necessary functions.

Supabase authentication cookies: sb-…

Maintain and refresh your signed-in session and, where needed, hold a short-lived sign-in verification value. Cookie names can include the project reference and numbered chunks. Authentication cookies may have a browser lifetime of up to 400 days and be renewed during use; token validity is controlled separately by the authentication service. Signing out clears the current browser’s authentication cookies.

sl_claim cookie

Temporarily transfers a private scan-claim request through sign-in so it can be saved to your account. It is limited to the claim route, HTTP-only, expires after 15 minutes and is cleared when the claim flow completes.

Session storage: aiseo:…

Holds private check-access tokens and, where the order flow is used, order drafts, purchaser details, consent choices, order-access tokens and duplicate-request protection. The older internal prefix is a technical name, not another company. This storage lasts for the browser tab’s session; browser session restoration can preserve it.

You can clear or block storage in your browser. Doing so may sign you out, prevent sign-in or remove access to an anonymous result or pending order. Storage is not a backup of your report. Third-party websites you choose to visit, including a hosted checkout if enabled, have their own storage practices.

If we introduce non-essential cookies or similar technologies, we will explain them and obtain any consent required before they run, with a way to reject them and withdraw consent.

9. Your data-protection rights

Depending on the circumstances, you can request access to your personal information, correction, erasure, restriction of processing and a portable copy of information you provided. You can object to processing based on legitimate interests and object to direct marketing at any time. Where consent is the basis, you can withdraw it.

These rights can apply to personal information obtained from public websites or generated in reports, not just to registered users. Tell us enough to locate the information, such as a website, report reference or relevant account email. We may need proportionate information to verify identity or authority, but please do not send identity documents unless requested.

We normally respond within one month. Where the law permits more time for a complex or numerous request, we will explain the extension. Requests are normally free; any permitted fee or refusal will be explained. Some rights have exceptions, including records required by law or needed for legal claims.

Where appropriate, we will consider corrections, annotations, restrictions or removal of disputed information and notify relevant recipients as required. We cannot directly alter an independent website or AI provider’s records, but can explain the source and the steps within our control.

10. Security and children

We use measures such as encrypted connections, authenticated account access, report-access tokens and restricted administrative access. No online service can guarantee absolute security. Keep access links and email accounts secure, and contact us promptly if you believe personal information or a report has been exposed.

Citrevo is intended for adults using business information, not for children. Do not submit information about children. If you believe we have collected it, contact us so we can investigate and take appropriate action.

11. Complaints and policy updates

Please contact us first if you have a privacy concern so we can investigate. We will acknowledge a data-protection complaint within 30 days and respond without undue delay. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to contact us before exercising your right to complain to a regulator.

We may update this notice as the service or law changes. The date at the top identifies this version. We will bring material changes to your attention where appropriate and seek a new choice where required, rather than treating continued use as consent to unrelated processing.

For the agreement governing use of the service, see our Terms of Service.