Citant.ai Privacy Policy
Citant.ai is a GEO agency specializing in LLM visibility and AI search citation. This Privacy Policy is issued by Hamza Wamiq, a sole proprietor based in Islamabad, Pakistan, trading as Citant.ai, referred to in this policy as “we,” “us,” and “our.” It explains what personal data we collect, why we collect it, how long we keep it, who receives it, and how anyone can exercise privacy rights over it.
This Privacy Policy covers the citant.ai website, the free AI Crawler Access Report, including the scan at check.citant.ai, our paid engagements, and the business outreach we send. It is read together with our Terms of Service, which set the rules for using the website, the Report, and paid engagements.
Document Status
- Version
- 1.0
- Effective
- Last updated
- Controller
- Hamza Wamiq, Islamabad, Pakistan
- Privacy contact
- info@citant.ai
Privacy at a Glance
| Question | Short answer |
|---|---|
| Who is responsible | Hamza Wamiq, sole proprietor, Islamabad, Pakistan. |
| What we collect | Details people send us, domains submitted to the AI Crawler Access Report, client engagement records, business contact details used for outreach, and technical data such as IP addresses. |
| What we never do | Sell personal data, share it for cross-context behavioral advertising, or use advertising cookies, retargeting pixels, or session recording tools. |
| AI model training | We do not submit personal data or client confidential information to any AI tool configured to use submitted data for model training. |
| Where data is processed | Pakistan, and the countries where our service providers operate, including the United States. |
| Privacy rights | Access, correction, deletion, restriction, objection, and portability, offered to everyone regardless of location and answered within one month, with an extension only for complex requests. |
| Contact | info@citant.ai |
Who Is Responsible for Personal Data
Hamza Wamiq, a sole proprietor based in Islamabad, Pakistan, is the controller of the personal data described in this Privacy Policy. Hamza Wamiq, Founder and GEO Architect, is also the person in charge of the protection of personal information for the purposes of Quebec’s privacy law.
Privacy questions and requests go to info@citant.ai, or through our contact form. We have not appointed a data protection officer, because the conditions that make one mandatory under the UK General Data Protection Regulation (UK GDPR) do not apply to our processing.
When a Client Is Responsible Instead
A client that gives us access to its own systems, such as analytics, search console, form, or content management accounts, remains the controller of the personal data held in those systems. We process that data only on the client’s documented instructions, under Section B13 of our Terms of Service and our data processing agreement, which is available to clients on request. A person whose data sits in a client’s systems should contact that client first, and we will help the client respond.
Personal Data We Collect, Why, and How Long We Keep It
Each source below lists the data involved, the purpose, the legal basis, and the retention period. Legal bases are named in UK GDPR terms. Where another law applies, we rely on the equivalent basis that law provides.
Website Visitors
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Technical data: IP address, browser and device type, pages requested, referring page, date and time | Deliver pages, keep the website secure, and block abusive traffic | Legitimate interests in operating a secure website | Hosting and security logs: up to 90 days |
| Analytics data collected by Google Analytics 4: pages viewed, approximate location, referral source, including visits from AI assistants, and device type | Understand which pages are used and improve the website | Consent for visitors in the UK and the European Economic Area (EEA); legitimate interests elsewhere | User-level data: 2 months, after which only aggregated reports remain |
AI Crawler Access Report Users and Site Owners
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| The domain and any page URLs a User submits, the scan result, the User’s IP address, and the date and time | Run the scan the User asked for, show the result, and enforce rate limits and the acceptable use rules in our Terms of Service | Performance of Part A of our Terms of Service; legitimate interests in preventing abuse | Private results: 90 days after the scan, then deleted. Public result pages: until removal. Rate-limit records: up to 90 days |
| An email address, where a User gives one to unlock or receive a report | Send the report and reply to questions about it | Performance of Part A of our Terms of Service | 24 months after the last contact, or sooner on request |
A scan result describes a website, not a person. A result stays private unless the User who ran it chooses an action that makes it public, such as sharing the result, unlocking the full report, or opening the print report. We may use scan results in aggregated form that identifies no domain and no User.
A site owner can ask us to remove a public result page for its domain by email to info@citant.ai, and we remove it once the request comes from an address at that domain or is backed by other reasonable proof of control. A site owner can also stop scans by disallowing CitantScanBot in its robots.txt file. The free scan checks whether AI systems can reach the site. The $440 AI Search Audit measures whether they name the brand. How each scan works is explained on the page for the free AI Crawler Access Report.
Inquiries and Order Forms
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, work email, company, role, website, message, and anything else entered in the contact form, an order or intake form, or an email | Reply, scope and quote work, and prepare an engagement | Steps taken at the person’s request before a contract; legitimate interests in answering business inquiries | 24 months after the last contact if no engagement follows |
Order and intake forms run on Tally, a form provider. Confirmation emails are sent through Resend, a transactional email provider.
Clients and Billing Contacts
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Names, work emails, and roles of client contacts, the Sign-Off, intake form answers, correspondence, invoices, and payment records | Deliver the engagement, invoice and collect payment, pay any refund due, and keep business and tax records | Performance of the contract; legal obligation for tax and accounting records | 6 years after the engagement ends |
Payments and refunds are processed by our payment provider. Card and bank details are entered with the payment provider, and we receive the payment confirmation, the amount, the date, and the payer’s name. The refund policy sets out how refunds are handled for each product.
Client Accounts We Access During an Engagement
Engagement work can require access to a client’s search console, webmaster, analytics, and content management accounts. We use client credentials only for the engagement, store them securely, and request the least access the work requires where the platform allows. When an engagement ends, we remove our access where the client asks and list the accesses the client should revoke, as Section B11 of our Terms of Service describes. Personal data inside those accounts is handled as described under When a Client Is Responsible Instead.
GEO Pilot Measurement Records
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Screenshots of AI answers, tracking exports, and review records for the agreed target queries | Run the week-9 guarantee review, give the client its per-platform record, and settle any refund question | Performance of the contract; legitimate interests in establishing and defending legal claims | 24 months after the week-9 review |
These records concern brands and queries. They contain personal data only where an AI answer or a record happens to name a person. Daily tracking runs in an independent third-party citation tracking platform, and the queries and brand names sent to it identify businesses rather than people. Every counting rule is published on the GEO Pilot guarantee and its measurement protocol page.
Business Contacts We Reach Out To
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, work email, role, company, public professional profile, and the record of messages and replies | Contact people at B2B SaaS companies about our services, and honor opt-outs | Legitimate interests in business development | 12 months after the last message if there is no reply. Opt-out records are kept for as long as we send outreach, so that each opt-out keeps working |
We obtain these details from company websites, professional networking profiles, and business contact data providers. We contact business addresses only, about services relevant to the recipient’s role. Every outreach email includes a way to opt out, and a reply asking us to stop, or an email to info@citant.ai, ends further outreach within 10 business days.
Publicity and Case Study Permissions
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| The written consent a client gives for its name, results, or quotes to be published, and the approved material | Publish case studies only with permission, as Section B15 of our Terms of Service requires | Consent | For as long as the approved material stays published, then 24 months as a record of the consent |
Reviews on Third-Party Platforms
Review platforms such as Clutch collect reviews and interview clients under their own privacy policies. When a client reviews us on such a platform, we receive only what the platform publishes or shares with us.
AI Tools and Personal Data
We use AI models, currently provided by Anthropic through Claude, to research, draft, and analyze work. We do not submit personal data or client confidential information to any AI tool configured to use submitted data for model training, and we do not train AI models of our own on personal data.
Our GEO execution team reviews AI-assisted work before it reaches a client. No decision that has a legal or similarly significant effect on a person is made by automated means. We use aggregated, de-identified measurements from scans and engagements for research, in a form that identifies no client, brand, target query, or person, as Section B15 of our Terms of Service allows.
Who Receives Personal Data
We share personal data with service providers that process it on our behalf and under our instructions:
| Recipient | What it does for us |
|---|---|
| Hostinger | Website hosting |
| Cloudflare | Content delivery, DNS, and website security |
| Cloud infrastructure providers | Hosting and running the AI Crawler Access Report |
| Google Analytics 4, added to the website through Google Site Kit | |
| Tally | Contact, order, and intake forms |
| Resend | Transactional email, such as report and form confirmations |
| Anthropic | AI models used through Claude |
| Our payment provider | Payments and refunds |
| An independent third-party citation tracking platform | Daily tracking of GEO Pilot target queries |
| Email and document providers | Business email, file storage, and shared documents |
Members of our GEO execution team, including subcontractors, see personal data only where their work needs it, and each is bound by confidentiality obligations. We may also share personal data with professional advisers such as accountants and lawyers, with authorities where the law requires it, and with a company formed to carry on the business if our engagements are assigned to it under Section B23 of our Terms of Service. We do not sell personal data.
Where Personal Data Is Processed
We are based in Pakistan, and our service providers operate in other countries, including the United States and member states of the European Union. Personal data can therefore be processed outside the country where a person lives.
Where UK or EEA law requires a transfer mechanism, for example when a client makes personal data in its systems available to us, we use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as set out in our data processing agreement. Our service providers transfer data under their own safeguards, such as the EU-US Data Privacy Framework and its UK Extension, or standard contractual clauses.
Deletion and Backups
When a retention period ends, we delete the data or anonymize it so that it no longer identifies anyone. Deleted data can remain in routine backups until those backups are overwritten on their normal cycle. We keep data longer than its stated period only where the law requires it, or where it is needed to establish, exercise, or defend a legal claim, and only for as long as that need lasts.
How We Protect Personal Data
Every page of the website and the AI Crawler Access Report is served over encrypted HTTPS connections. Access to personal data is limited to Hamza Wamiq and the members of our GEO execution team whose work needs it. Accounts that hold personal data are protected by multi-factor authentication where the provider supports it, and client credentials are handled as Section B11 of our Terms of Service describes. No method of storing or sending data is completely secure, so we do not promise that personal data can never be accessed without authorization.
If a personal data breach is likely to put people at risk, we notify the relevant supervisory authority where the law requires it. Where a breach is likely to result in a high risk to people, we also tell those affected without undue delay. Where a breach affects data we process for a client, we notify that client without undue delay, as Section B13 of our Terms of Service commits.
Privacy Rights
We give the same privacy rights to everyone, wherever they live:
- Access: a copy of the personal data we hold and how we use it.
- Correction: inaccurate or incomplete data put right.
- Deletion: data erased where there is no overriding reason to keep it.
- Restriction: use of the data paused while a question about it is resolved.
- Objection: an objection to processing based on legitimate interests, and an absolute right to stop direct marketing.
- Portability: data a person gave us, in a common machine-readable format.
- Withdrawal of consent: at any time, for processing based on consent, without affecting processing done before the withdrawal.
Requests go to info@citant.ai. We may ask a requester to confirm identity, usually by replying from the email address we already hold. We answer within one month. For complex or multiple requests we may extend that by up to two further months, and we say so within the first month. Requests are free unless they are manifestly unfounded or excessive. An authorized agent may make a request on another person’s behalf with written permission from that person.
How to Make a Privacy Complaint
A privacy complaint can be sent to info@citant.ai. We acknowledge every complaint within 30 days of receiving it and reply in full without undue delay.
Anyone can also complain to their own data protection regulator. In the UK that is the Information Commissioner’s Office. In Canada it is the Office of the Privacy Commissioner of Canada, and in Quebec the Commission d’accès à l’information du Québec. In Australia it is the Office of the Australian Information Commissioner. In the EEA it is the supervisory authority in the country where the person lives or works. In the United States, it is the attorney general or consumer protection agency of the person’s state.
Children
The website and the AI Crawler Access Report are intended for business and professional use by people aged 18 or over, as Section A1 of our Terms of Service states. We do not knowingly collect personal data from anyone under 18, and we delete any such data once we learn of it.
Changes to This Privacy Policy
We update this Privacy Policy by publishing a new version on this page with a new version number and effective date. We tell active clients by email about any change that materially affects how their personal data is handled. Previous versions are available on request by email to info@citant.ai.
| Version | Date | Change |
|---|---|---|
| 1.0 | First publication. |
Contact
Privacy questions, requests, and complaints go to info@citant.ai, and every privacy email receives a reply from Hamza Wamiq or a member of our GEO execution team.