Privacy Policy

VentureCite (“VentureCite,” “we,” “us”) is a company in the United States. We show businesses how AI assistants such as ChatGPT, Gemini and Perplexity describe and cite them. This policy covers the website at venturecite.com and the VentureCite product. We decide why and how your information is used, so we are the controller of it.

If you only visit the website, we do not ask for personal information. Like any website, the servers that host it keep short-lived technical logs so it stays secure and available. These can include:

• IP address
• Browser type and operating system
• The page requested and the time of the request
• The referring page, if your browser sends one

If you create an account, we also collect:

• Your email address and the details you add to your profile
• The version of the Terms and this policy you accepted, and when
• Whether you chose to receive product news and offers, and when
• The brands, websites, competitors and prompts you set up
• The reports, drafts and notes you create in the product
• Your questions to Ask, and the files you attach to them
• Which pages you open, which buttons and links you click, how long pages take to load, and the errors you meet, to improve the product. We never record what you type.
• Billing details. Payments are handled by Stripe; we never see or store your full card number

If you connect Google Analytics, we receive the Google data described in the Google user data section below.

If you email us at engineering@venturecite.com, we receive your email address and whatever you choose to write.

We use information to:

• Provide the product: run the checks you ask for and show you the results
• Send emails you have signed up for, such as reports, and messages about your account
• Keep the website and product running, and fix problems
• Protect them against abuse, fraud and attacks
• Reply to emails you send us
• Meet legal obligations

To follow US sanctions law, we check which country the IP address of a new sign-up belongs to, using a list of IP ranges kept on our own servers (IP Geolocation by DB-IP, db-ip.com). We do not send your IP address anywhere for this check and we do not store the result. When you subscribe, we also check the billing country you give Stripe.

We do not sell your information, share it for advertising, or use it to build a profile of you.

If the GDPR or the UK GDPR applies to you, our legal bases are: your contract with us, to provide the product; our legitimate interests, to keep it secure and working; your consent, for marketing email and for the use of Google Analytics data in Ask; and legal obligation, for records such as invoices.

VentureCite asks AI models questions, reads their answers, and writes drafts for you. To do that we send AI providers the prompts you track, your brand and competitor names, text from your website and the pages that AI answers cite, and what you type into Ask. Files you attach to Ask are sent to OpenAI, and audio you record is sent to OpenAI to be turned into text. When you use publisher outreach, the name and job title of an editor we find on a publisher's own website are sent to OpenAI to help draft the pitch.

The providers that receive this are OpenAI, and OpenRouter, which passes requests to Anthropic, Google, Perplexity, DeepSeek and xAI. Their own terms apply to what they receive. We use the API products of these providers, whose terms say they do not train their models on API data.

Text that VentureCite writes for you is AI-generated. Check it before you publish it. Do not present it as written by a person, and follow the rules of the site where you post it.

You can choose to connect a Google Analytics property to VentureCite. When you do, Google asks for your permission, and with it we access:

• Your Google account email address, so we can show which account is connected
• The list of Google Analytics accounts and properties you can access, so you can choose one
• Read-only reports from the property you choose: sessions, users, engagement, key events, landing pages, countries and traffic sources

Access is read-only. VentureCite cannot change your Google Analytics settings or data.

We use this data to show you how many visitors AI assistants send to your website, inside your VentureCite account and in reports you choose to download. Only you, and the people you invite to your team, can see it.

Ask and connected AI tools can also use these numbers, but only if you turn on “Let Ask and connected AI tools use my Google Analytics numbers” in Settings. It is off until you do. When it is on, the answering AI provider receives aggregate figures for the website of the brand you are asking about: visits from AI assistants, top sources and top landing pages. It never receives your Google account email address. We send these requests only to providers whose terms say they do not train on API data, and we ask OpenRouter not to let any provider keep them. You can turn the setting off at any time. When it is off, no Google data goes into an AI prompt.

We do not sell Google user data, use it for advertising, or use it to train AI models. We do not share it with anyone, except service providers who store it for us, the AI provider that answers a question you asked with the setting on, when the law requires it, or with your consent.

We store the access Google gives us encrypted (AES-256-GCM). Report results are kept for at most 7 days so pages load quickly, then deleted.

You can disconnect Google Analytics from a brand at any time in VentureCite. We then delete that brand's cached reports. Once no brand of yours uses the connection, we revoke our access at Google and delete the stored token. You can also remove VentureCite's access at https://myaccount.google.com/permissions. If you delete your VentureCite account, we revoke the Google access and delete the stored token and cached reports when the account is purged, 30 days after you delete it.

VentureCite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

We do not set advertising cookies or run third-party analytics on the website or the product. When you sign in, your browser stores a session so you stay signed in. Your browser may also store preferences such as your theme. These stay on your device.

Our pages load fonts from Google Fonts, so Google receives your IP address when a page loads. The booking window on the Enterprise plan loads a scheduler from Calendly only when you open it. Videos in the Library play from YouTube's privacy-enhanced domain only when you press play.

We use a small number of service providers to run VentureCite. They process information only to provide their service to us:

• Supabase: sign-in and our database
• Render: hosting. Render uses Cloudflare to serve traffic, so Cloudflare handles requests to the site
• Stripe: payments and invoices
• Resend: email delivery
• Sentry: error monitoring
• OpenAI, and OpenRouter with the model providers behind it (Anthropic, Google, Perplexity, DeepSeek, xAI): the AI work described above
• Google: the Analytics APIs, when you connect them, and Google Fonts
• Jina: when we read a public web page for you, the address of that page goes to Jina's reader service
• Calendly: the booking window, when you open it
• Have I Been Pwned: when you choose a password, the first five characters of its hash go to this service, which says whether the password appeared in a breach. The password itself never leaves us

We also read a public source, Wikidata. Brand and competitor names go to it as search terms.

We send service messages that you cannot turn off, because they are part of running your account: verification and sign-in codes, billing notices, team invitations, and notices about missions assigned to you or due dates. Help and support replies come in the same way.

The weekly visibility report is on by default, and every report carries an unsubscribe link and our postal address. Product news and offers are sent only if you tick the box at sign-up or in Settings, and you can untick it at any time. Unsubscribing from one kind of email does not stop the others.

Server logs are kept only as long as needed for security and reliability, then deleted. Account data is kept while your account is open. When you delete your account, we end your subscription at once and the account is permanently deleted 30 days later, except where the law requires us to keep a record, such as billing records. Deletion also removes your audit trail, failed email records, files you uploaded to support, your Google access and your Stripe customer details. Invoices that Stripe already issued keep their own copy.

Some records are deleted on a schedule even while your account is open:

• Accounts that never confirm their email address: deleted after 14 days
• Failed email records: 90 days
• Audit records: 2 years
• Product usage records: 90 days in full and 180 days as daily summaries. AI tool (MCP) activity logs: 90 days.
• Payment webhook records: 180 days
• Team invitation and activity history: 1 year
• Old website scans and AI Pages checks: only the latest are kept

Emails are kept for as long as needed to handle your message and any follow-up.

We are in the United States, and our providers process information in the United States and other countries. If you are in the EU, the UK or another region with transfer rules, your information moves outside your region when you use VentureCite. We rely on the safeguards our providers offer, such as standard contractual clauses.

VentureCite is served only over HTTPS. Access tokens from connected services are encrypted at rest, and access to our systems is restricted to the people who need it. No website or network is completely secure, so we cannot guarantee absolute security.

Depending on where you live, including under the GDPR in the EU and UK and under US state privacy laws, you may have the right to:

• Ask what information we hold about you
• Ask us to correct or delete it
• Object to or restrict how we use it
• Withdraw a consent you gave, such as for marketing email or for Google Analytics data in Ask
• Complain to your local data protection authority

You can download your data and delete your account yourself in Settings. To make any other request, email engineering@venturecite.com. We reply within 30 days and will not treat you differently for asking. We do not have a representative in the EU or the UK.

VentureCite is built for businesses and is not directed at children under 16. We do not knowingly collect information from children. If you think a child has sent us information, email engineering@venturecite.com and we will delete it.

If we change how VentureCite handles information, we will update this page and the “Last updated” date above. If the change is material, we will tell you in the product or by email before it applies and ask you to accept it again.

Questions about this policy or your information: engineering@venturecite.com.