Privacy Policy

The controller responsible for data processing is: Antom Media UG (haftungsbeschränkt) Am BioPark 13 93053 Regensburg Germany Represented by Managing Director: Andreas Ehret Email: info [at] antom.media

A statutory data protection officer is currently not designated. For data protection requests, contact: Email: info [at] antom.media Subject: Data Protection

We process in particular: - master data (name, email address, account data) - contract data (selected plan, billing cycle, status) - payment and transaction data (via payment providers) - usage data (feature usage, limits, logs) - technical data (IP address, browser info, timestamps) - communication data from support requests - for connected websites: data about requests by AI bots and search engine crawlers (see section 9)

Data is processed for: - operation and provision of the App - registration, authentication, and account management - contract execution and billing - support and customer communication - fraud prevention and security - product analytics and improvement Legal bases include: - Art. 6(1)(b) GDPR (contract performance) - Art. 6(1)(c) GDPR (legal obligation) - Art. 6(1)(f) GDPR (legitimate interests) - Art. 6(1)(a) GDPR (consent, where requested)

To provide our services, we use processors and service providers, especially in the areas of: - hosting and infrastructure - payment processing (e.g. Stripe) - email delivery/SMTP - AI services for analytics features - geodata for the place search of the target market (only the place name you enter is sent, via our server, not your IP address) - address completion in the billing details (only the address parts you type are sent, via our server, not your IP address) - database and integration services - Google Tag Manager (only on citetop.ai and only with your consent, see section 11) Such recipients process data only under appropriate contractual safeguards.

If providers outside the EU/EEA are involved, transfers take place only where appropriate safeguards exist, especially EU Standard Contractual Clauses or equivalent mechanisms.

Personal data is stored only as long as necessary for the purposes described. Key criteria include: - contract term and follow-up processing - statutory retention obligations (e.g. tax and commercial law) - legitimate interests in IT security and abuse prevention

In the "Search Analytics" section you can voluntarily connect your own Google Search Console account to CiteTop. To do so, you sign in with Google and explicitly grant CiteTop read-only access (Google OAuth scope "webmasters.readonly"). Data we process: - the list of your Search Console properties - search queries, clicks, impressions, click-through rate and average position for the property and date range you select - the access tokens issued by Google Purpose: solely to display this data to you inside your CiteTop account. Search Console data is fetched live from Google on each request and is not stored permanently on our side. We do not change any settings in your Search Console, do not share the data with third parties, and do not use it for advertising or for training AI models. Storage: we only store the access tokens, and we store them encrypted. "Disconnect" revokes the access at Google and deletes the tokens. You can also remove the access at any time at https://myaccount.google.com/permissions. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. CiteTop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In the “AI Crawlers” section you can voluntarily connect one of your websites to CiteTop – via Cloudflare Worker, WordPress plugin or middleware on Vercel or Netlify. Beforehand you prove that you own the domain (DNS record or verification file). What data we process: - the connected domain and your settings (e.g. bot rendering on or off, excluded paths) - for every request to your website by a known AI bot or search engine crawler: the bot's name (user agent), the requested path, the HTTP status, the time, whether a rendered copy was served, and the result of the authenticity check - the IP address of the requesting bot, solely to check whether the request comes from the bot provider's officially published addresses; it is processed only briefly for this and not stored Requests by humans are not transmitted to us. Bot rendering: if you turn it on, our render service fetches public pages of your domain like a browser and stores the fully rendered page to serve it to AI bots. Pages behind a login and pages with “noindex” are not rendered. The render service runs on our own server in the EU. Retention: reported bot requests are deleted automatically after 90 days at the latest, rendered pages after 7 days at the latest. If you delete your account, all of this data is deleted. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Where the IP address of a request can exceptionally be attributed to a person (e.g. with a fake bot identity), the brief check is based on our legitimate interest in reliable analytics (Art. 6(1)(f) GDPR). If you use the connection on your website, please also mention it in your own privacy policy; the WordPress plugin suggests a text for this.

On citetop.ai/ai-crawler-check you can check without an account whether AI crawlers may read a website. To do so we fetch the homepage, the robots.txt and the llms.txt of the domain you enter – also with the user agents of individual AI bots. What data we process: - the domain you enter and the check result - your IP address, only in memory and for about 24 hours, to limit abuse (number of checks and emails per day) - if you request the report by email: your email address Retention: the report and – if provided – your email address are deleted automatically and permanently after 5 days. Anyone with the link can open the report until then; it contains no personal data. Tips & news: only if you tick the optional box and click the link in our confirmation email (double opt-in) do we store your email address together with the domain, the consent text and the time of confirmation to send you tips and news on AI visibility. Without confirmation the address is deleted with the report. You can unsubscribe at any time via the link in every email; your address is then deleted. Legal bases: the check and sending the report at your request (Art. 6(1)(b) GDPR), abuse prevention (Art. 6(1)(f) GDPR), tips & news based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect.

We use technically necessary storage mechanisms (e.g. session data, local storage, security and server logs) to operate the website and the App securely and reliably. You can manage or delete cookies via browser settings. Disabling technically required functions may limit usability. Error logs: if a technical error occurs in the App or on our server, we store an error log – for example the error message, the affected code location, the page visited without secret parameters, browser, operating system and time. We use open-source error monitoring software that we operate ourselves on our own server in Germany; the data is not shared with third parties. Email addresses are shortened before storage; IP addresses, cookies, passwords, form input and user identifiers are not stored, and there are no screen recordings or session recordings. Error logs are deleted after 30 days. The legal basis is our legitimate interest in secure and error-free operation (Art. 6(1)(f) GDPR). Web analytics with Umami: on citetop.ai and in the App at app.citetop.ai we use the open-source software Umami to measure how our pages are used – for example pages viewed, referrer, device type, browser, operating system and country. Umami runs on our own server in Germany, sets no cookies, does not store full IP addresses and does not build profiles across websites. The data is not shared with third parties. In the App we do not transmit any parameters from the address bar. If you enable "Do Not Track" in your browser, Umami does not record your visits. The legal basis is our legitimate interest in privacy-friendly audience measurement and in improving our service (Art. 6(1)(f) GDPR). Google Tag Manager: only on citetop.ai (not in the App) and only if you agree to "Analytics" or "Marketing" in the cookie banner, we load Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on your choice, the Tag Manager can load analytics services (e.g. Google Analytics) or advertising measurement. Your IP address may be transmitted to Google in the process, including to the USA; Google is certified under the EU-US Data Privacy Framework. We use Google Consent Mode: without your consent the Tag Manager does not load and no analytics or advertising cookies are set. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with future effect via "Cookie settings".

You have, in particular, the right to: - access (Art. 15 GDPR) - rectification (Art. 16 GDPR) - erasure (Art. 17 GDPR) - restriction of processing (Art. 18 GDPR) - data portability (Art. 20 GDPR) - object to processing based on legitimate interests (Art. 21 GDPR) - withdraw consent with future effect You also have the right to lodge a complaint with a supervisory authority.

For privacy-related requests, contact: info [at] antom.media For faster processing, please include subject "Data Protection" and, if available, your account email.