We collect account details from Google sign-in, the domains you submit, payment records via Stripe, and usage and advertising analytics. We do not sell personal data. This policy lists every sub-processor and explains how to exercise your rights.
This summary is for orientation only — the full text below is what governs.
Last updated: 28 July 2026
This policy explains how [REGISTERED NAME], [COMPANY OR VAT NUMBER], of [REGISTERED ADDRESS], Israel ("Top Citation Signal", "we") handles personal data in connection with https://topcitationsignal.com.
We are the controller of the personal data described here. For privacy questions or to exercise a right, contact privacy@topcitationsignal.com.
1. What we collect
1.1 Account data. When you sign in with Google, we receive your name, email address, Google account identifier and profile picture. We do not receive your Google password.
1.2 Report data. The domains and URLs you submit, the reports generated for them, and the public information about those domains that our analysis gathers. If you submit a domain, expect the business information on that public website to appear in the report.
1.3 Purchase data. Order records, amounts, currency, timestamps, the Stripe customer, session and payment identifiers, your receipt email, and your recorded confirmation of our purchase terms (see the Refund Policy). Card numbers are handled entirely by Stripe — we never receive or store them.
1.4 Usage and device data. IP address, browser and device type, user agent, pages viewed, referring page, actions taken, and approximate location derived from IP.
1.5 Advertising and attribution data. Advertising identifiers stored in cookies (_fbp, _fbc), click identifiers in URLs, and — for conversion measurement — a SHA-256 hash of your email address transmitted to Meta. Hashing means Meta receives an irreversible fingerprint rather than the address itself; it can still be matched against a hash Meta already holds.
1.6 Communications. Emails you send us, form submissions (profile claims, category requests) and our replies.
1.7 Cookies. See our Cookie Policy.
We do not intentionally collect special-category data (health, biometrics, political or religious views, and the like). Please do not submit it.
2. Why we process it, and on what basis
| Purpose | Data | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Create and secure your account | Account data | Performance of a contract |
| Run a Snapshot or Audit and deliver it | Account, report data | Performance of a contract |
| Take payment, issue receipts, prevent fraud | Purchase data | Performance of a contract; legal obligation |
| Evidence the terms you agreed to at checkout | Consent record | Legitimate interests (defending claims); legal obligation |
| Support and correspondence | Communications | Performance of a contract; legitimate interests |
| Keep the site secure, prevent abuse, enforce limits | Usage, device data | Legitimate interests |
| Understand product usage and improve the Services | Usage data | Legitimate interests; consent where required |
| Marketing analytics, advertising and conversion measurement | Advertising data, hashed email | Consent where required by law; otherwise legitimate interests |
| Publish the Rankings | Public business information | Legitimate interests (journalism, analysis and public information) |
| Comply with tax, accounting and legal duties | Purchase data | Legal obligation |
If you are in Israel, our processing is carried out under the Privacy Protection Law, 5741-1981 and its regulations, including the obligations introduced by Amendment 13. Providing account and payment data is voluntary, but without it we cannot open an account or deliver a paid report.
3. Who we share it with
We do not sell personal data and we do not share it for third-party direct marketing. We share it with service providers who process it on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Google (Sign-In / OAuth) | Authentication | US / global |
| Stripe | Payment processing, fraud prevention, receipts | US / global |
| Supabase | Database and storage of accounts and reports | Regional cloud |
| Railway | Application hosting and logs | US / EU |
| Anthropic | AI analysis that generates report content | US |
| Tavily, DataForSEO, Apify | Web, SERP and public-data research used in reports | US / EU |
| PostHog | Product analytics | US / EU |
| Meta Platforms | Advertising, pixel and Conversions API measurement | US / global |
| Google Ads | Advertising measurement | US / global |
| Resend | Transactional email delivery | US / EU |
We may also disclose personal data where required by law, court order or a lawful request from a public authority; to establish, exercise or defend legal claims — including in response to a payment dispute; and to a successor in a merger, acquisition or sale of assets, subject to this policy.
A note on AI providers. To generate a report, information about the audited domain is sent to third-party AI services. We use providers on terms that do not permit our submitted content to be used to train their public models. Do not submit confidential information you would not want processed by a third-party AI service.
4. International transfers
We operate from Israel and our providers operate globally, so your data may be processed outside your country, including in the United States.
Israel benefits from a European Commission adequacy decision. Where data moves from the EEA or UK to a country without adequacy, our providers rely on the Standard Contractual Clauses or the UK Addendum, together with additional safeguards. To request details of the safeguards for a particular transfer, contact privacy@topcitationsignal.com.
5. How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account is open, then up to 12 months |
| Reports (free and paid) | While your account is open; paid reports kept longer so you can re-download |
| Purchase and consent records | 7 years — required for tax, accounting and dispute defence |
| Usage and analytics | Typically up to 24 months |
| Advertising identifiers | Per the retention of the cookie, generally up to 90 days for _fbc/_fbp |
| Support correspondence | Up to 3 years after the matter closes |
| Server and security logs | Typically up to 90 days |
We keep data longer where a law requires it or where it is needed for an ongoing claim.
6. Your rights
Subject to the law that applies to you, you may:
- Access the personal data we hold about you, and get a copy.
- Correct data that is inaccurate or incomplete.
- Delete your data ("right to be forgotten"), where no overriding obligation requires us to keep it.
- Restrict or object to processing, including profiling — you may object to processing based on legitimate interests at any time.
- Port data you gave us, in a structured, machine-readable format.
- Withdraw consent at any time, without affecting processing already carried out.
- Opt out of targeted advertising and of any "sale" or "sharing" as those terms are defined under US state privacy laws. We do not sell personal data as we understand that term.
- Not be discriminated against for exercising these rights.
To exercise a right, email privacy@topcitationsignal.com from the address on your account. We respond within 30 days, and will tell you if we need longer. We may need to verify your identity first. You may use an authorised agent where the law allows.
If you are unhappy with our response, you may complain to your local supervisory authority — in Israel, the Privacy Protection Authority (הרשות להגנת הפרטיות); in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office.
Deleting your account. Email privacy@topcitationsignal.com. We remove your account and reports, keeping only what tax, accounting and dispute-defence rules require (principally the purchase and consent record).
7. Published rankings and brand profiles
The Rankings concern businesses and brands, built from publicly available information and our own analysis. In most cases that is not personal data. Where a brand profile does include personal data — a founder's name, say — we process it for analysis and public-information purposes under our legitimate interests.
If you believe published information about you is inaccurate, write to corrections@topcitationsignal.com. See our Rankings & Editorial Disclaimer for the correction process.
8. Security
We use HTTPS in transit, access controls, signed session tokens, hashing of identifiers sent to advertising platforms, and payment handling delegated to a PCI-DSS Level 1 processor. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority as required by law.
9. Children
The Services are not directed at anyone under 18 and we do not knowingly collect their data. If you believe a child has given us personal data, contact privacy@topcitationsignal.com and we will delete it.
10. Automated decision-making
Scores and recommendations are generated automatically. They analyse businesses and domains, not individuals, and they do not produce legal or similarly significant effects on you as a person. We do not use automated decision-making to decide whether to grant you credit, employment or a similar benefit.
11. Changes
We may update this policy. The "last updated" date shows the current version. If a change materially affects how we use your personal data, we will give prominent notice on the site and, where required, ask for your consent.
12. Contact
[REGISTERED NAME] [REGISTERED ADDRESS], Israel [COMPANY OR VAT NUMBER]
Privacy: privacy@topcitationsignal.com General: reports@topcitationsignal.com