Privacy policy

Cited ("the app") is provided by Mahant Digital Inc. This policy explains what the app collects when a Shopify merchant installs it, why, and what happens to it. Last updated 3 November 2026.

What we collect from your store

• Store content through the Shopify Admin API: products, collections, pages, blog posts, legal policies and theme settings. We use it to score your store's AI readiness, build llms.txt and structured data, and draft content you ask for.
• Store settings you enter in the app (brand facts, tracked prompts, competitors, tool switches).
• AI traffic counts from the Cited web pixel: for a visit that arrives from an AI assistant, the assistant's name and the landing page path, counted per day; for an order from such a visit, a one-way hash of the order id, the total and the currency. The pixel never records names, emails, addresses, IP addresses, device ids or anything else about the shopper. To credit an order to the AI visit that led to it, the pixel keeps the assistant's name in a first-party cookie (cited_ai, 30 days) and in session storage on the shopper's browser; nothing else is stored there.
• Crawler fetches of the llms.txt files Cited serves: the path, the requester's user agent (to tell AI crawlers apart) and a salted one-way hash of a truncated IP address, used to count distinct requesters. The IP address itself is never stored.
• Optional connections: if you connect Bing Webmaster Tools, we store its access tokens encrypted and read crawl status for your store's pages.

Customer personal data

Cited does not collect or store personal data about your customers. Requests under customers/data_request and customers/redact therefore return or delete nothing, and we confirm that to Shopify.

Who processes data for us

• Supabase (database) and Railway (hosting).
• OpenAI, Anthropic, Google (Gemini) and Perplexity: to run the prompts you track and to draft and fact-check content. We send your public store content and the prompt; never customer data.
• Sentry: error reports, with request bodies, cookies, headers, query strings, web addresses, emails and tokens removed before sending.
• IndexNow endpoints (Bing and others): the public URLs of pages that changed.
• Microsoft Bing Webmaster Tools, only if you connect it.

How long we keep it

• AI usage records: 13 months. Finished background jobs: 30 days. Discarded drafts: 90 days. Bing crawl status: 90 days.
• The activity log and Proof history: while the app is installed, so you can see what it did.
• After you uninstall, Shopify sends a shop/redact request 48 hours later and we delete every record for your store. App-owned metafields and the web pixel are removed by Shopify when you uninstall.

Your choices

Every tool can be switched off in the app. Nothing Cited writes reaches your storefront without your approval. To ask about or delete your data sooner, email princeisamaliya7@gmail.com.