Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

If you have questions about data protection, please contact our Data Protection Officer or reach us at support@ucited.ai.

2. Overview of Data Processing

We process personal data only to the extent necessary to provide and improve the ucited Service, to fulfill contractual obligations, and to comply with legal requirements. This Privacy Policy applies to the websites ucited.ai and ucited.de and the ucited SaaS platform (collectively, the "Service").

The Service is intended exclusively for business customers (Unternehmer) within the meaning of Section 14 BGB. We do not knowingly collect personal data from consumers using the Service.

3. Legal Bases for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Art. 6(1)(b) GDPR – Performance of a contract: Processing necessary to provide the Service, manage your account, and fulfill our contractual obligations.
• Art. 6(1)(f) GDPR – Legitimate interests: Processing necessary for our legitimate interests (e.g., improving the Service, ensuring security, preventing fraud), provided these interests are not overridden by your rights.
• Art. 6(1)(a) GDPR – Consent: Where you have given explicit consent to specific processing activities (e.g., analytics cookies). You may withdraw consent at any time.
• Art. 6(1)(c) GDPR – Legal obligation: Processing necessary to comply with applicable laws (e.g., tax and accounting requirements).

4. Data We Collect

4.1 Account Registration Data

When you register for the Service, we collect:

• Full name and job title
• Business email address
• Company name and address
• Phone number
• VAT identification number (USt-IdNr.)
• Password (stored in hashed form only)

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Retention: As described in section 8.

4.2 Payment Data

We use Stripe, Inc. as our payment processor. When you subscribe to a paid plan through the platform, Stripe collects and processes your payment information (e.g., credit card number, billing address). Some existing customers are invoiced manually; in that case Stripe does not process any payment data. We do not store full credit card numbers on our servers. We receive from Stripe only a truncated card reference, transaction confirmations, and billing details necessary for invoicing.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

We store an opaque payment-method fingerprint provided by Stripe (no card number) to enforce one trial per payment method. This fingerprint and the owner identifier are retained as an anti-abuse marker even after the company or account is deleted (without any link to company data), so the same payment method cannot obtain another trial.

4.3 Usage Data and Service Input

When you use the Service, we process:

• Keywords, brand names, URLs, and prompts you enter into the platform ("Input")
• Results, reports, and analytics generated by the Service ("Output")
• Feature usage patterns, timestamps, and interaction logs

This data is processed solely to provide and improve the Service. We do not use your Input or Output for purposes unrelated to the Service without your consent.

Legal basis: Art. 6(1)(b) GDPR (contract performance); Art. 6(1)(f) GDPR (legitimate interest in service improvement) for anonymized and aggregated usage analytics.

4.4 Server Log Data

When you access the Service, our hosting infrastructure automatically collects:

• IP address (anonymized where technically feasible)
• Date and time of access
• Browser type and version
• Operating system
• Referring URL
• Pages accessed

Server logs are deleted or anonymized after 30 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and system stability).

4.5 Google Sign-In and Google User Data

If you choose "Continue with Google", we use Google Sign-In only for authentication and account creation or account linking. Through Google and our authentication provider Supabase, we receive the following Google user data to the extent you approve it in Google's consent flow:

• Your Google Account email address and whether Google has verified that email address
• Your name or display name from your Google profile
• A technical Google Account identifier needed to uniquely associate the sign-in with your account

We use this data to sign you in, create or link your ucited account, match your Google-verified email address to an invitation, secure your session, prevent abuse, associate support requests with your account, and send transactional emails.

We do not use Google Sign-In to access Gmail, Google Drive, Google Calendar, Google Contacts, or other Google Workspace content. We do not read, modify, create, or delete content in your Google Account.

Google user data obtained through Google Sign-In is not sold, used for advertising, or shared with data brokers. We do not use it to train general AI or machine-learning models. Where information received from Google APIs is transferred to other services, it is transferred only to our processors to provide the features described above, in particular Supabase for authentication and database operations, Resend for transactional email, and Chatwoot for support when you use the support chat.

ucited.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Google OAuth access in your Google Account settings under third-party apps and services.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in secure authentication and abuse prevention).

4.6 Connected Data Sources (Google Search Console, Google Analytics, Google Ads, Bing Webmaster Tools, ChatGPT Ads)

In your ucited account settings you can optionally connect external data sources to a project. For Google services this uses Google OAuth: in Google's consent flow you choose which permission to grant, and afterwards which Search Console property, Google Analytics 4 property, or Google Ads account ucited may read. For Bing Webmaster Tools and ChatGPT Ads you provide an API key that you generate in the respective service.

Access is read-only and limited to aggregated performance data: for Google Search Console and Bing Webmaster Tools, queries, pages, clicks, impressions, and positions; for Google Analytics, sessions, users, sources, channels, landing pages, and conversions; for Google Ads and ChatGPT Ads, campaigns, search terms, impressions, clicks, cost, and conversions. We do not create, modify, or delete any content, campaigns, or settings in the connected accounts.

We use this data solely to display it to you in the ucited dashboard alongside your AI visibility data and to compute analyses for your project. Credentials (OAuth refresh tokens or API keys) are stored encrypted with our processor Supabase; the retrieved performance data is stored with Google Cloud (BigQuery) in the EU. The data is not sold, not used for advertising, not shared with data brokers, and not used to train general AI or machine-learning models. Our staff only read this data with your consent, for troubleshooting at your request, for security purposes, or where required by law.

You can disconnect any source at any time in the settings. We then revoke the permission with the provider and delete the credentials and the data retrieved for that connection. You can additionally revoke Google OAuth access in your Google Account settings under third-party apps and services. ucited.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: Art. 6(1)(b) GDPR (contract performance; connecting a source is a feature of the service that you choose to use).

5. Cookies and Analytics

5.1 Essential Cookies

We use cookies that are strictly necessary for the operation of the Service, such as maintaining your login session, security, and your payment provider during checkout. These cookies do not require your consent under § 25(2) TTDSG.

5.2 Google Tag Manager and Google Analytics

We use Google Tag Manager (GTM) to manage tags such as Google Analytics. GTM is loaded with the page so that it can apply your choice in the cookie banner; the analytics and advertising tags it loads become active only after you consent. Until then, Google Consent Mode keeps all analytics and advertising storage disabled, so no such cookies are set and no analytics or advertising data is sent. You can withdraw your consent at any time with future effect.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Legal basis: Art. 6(1)(a) GDPR (consent).

6. Data Recipients and Sub-processors

We share personal data only to the extent the Service requires. The following service providers process it on our behalf; for the free GEO check, those listed in section 4.7 are added:

If you connect a data source (section 4.6), we retrieve the performance data from its provider (Google, Microsoft or OpenAI). We only transmit the stored access and the identifiers of your websites or ad accounts.

AI systems and measurement services are not in this list. For measurements we send them your questions with country and language, the way anyone can ask them, but nothing from your account such as your email address or sign-in data. For website retrieval and research, Bright Data Ltd. (Israel) receives website addresses and Serper receives search queries; OpenRouter, Inc. (USA) passes measurement requests on to further AI models and uses the search service Exa. For analyses and report texts we also use Google Gemini, directly with Google and via OpenRouter, with measurement questions, measurement results, public website content, brand profile and report notes. Personal data may be contained in your inputs, in public website content such as a legal notice, and in measurement results.

We do not sell, rent, or otherwise share your personal data with third parties for their own marketing purposes.

7. International Data Transfers

Some of our sub-processors are based in the United States. Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR
• Adequacy decisions by the European Commission, where applicable
• Additional technical and organizational measures as appropriate

You may request a copy of the applicable safeguards by contacting us at support@ucited.ai.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law:

• Account data: As long as your account exists, also after the contract ends, until you request deletion. Details needed for invoices for the statutory retention periods (6–10 years under §§ 147 AO, 257 HGB).
• Payment records: 10 years (§ 147 AO).
• Server logs: 30 days.
• Connected data sources: Credentials and retrieved performance data for the duration of the connection; deleted when you disconnect the source or delete the project.
• Google Sign-In data: For the duration of your account; OAuth session data is retained according to the session and security settings of our authentication provider.
• Usage analytics (Vercel): Aggregated and anonymized; no personal data retained.
• Customer Data (inputs and measurement results): For the duration of the contract and afterwards, so that you can resume the Service without losing data. After the contract ends, we provide it for export on request; if you request deletion, we delete it within 30 days, except where statutory retention obligations apply (see Terms of Use, Section 9.5).

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – You may request information about the personal data we hold about you.
• Right to rectification (Art. 16 GDPR) – You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR) – You may request deletion of your data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR) – You may request that we restrict processing of your data under certain conditions.
• Right to data portability (Art. 20 GDPR) – You may request to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR) – You may object to processing based on legitimate interests at any time. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3) GDPR) – Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@ucited.ai. We will respond within one month of receiving your request.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for our company is:

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include encryption of data in transit (TLS), access controls, regular security reviews, and secure password hashing.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices or legal requirements. We will notify registered users of material changes via email or in-app notification. The current version is always available at https://ucited.ai/privacy.

13. Contact