CiteGist Privacy Policy
Effective date: May 3, 2026 Last updated: May 3, 2026
This Privacy Policy explains how Bemedia Communities Ltd. (Israeli company registration no. 515615946), trading as CiteGist ("CiteGist," "we," "us," "our"), collects, uses, and protects personal information in connection with our platform at citegist.com ("Platform").
EU/EEA residents: This policy satisfies the notification requirements of GDPR Articles 13 and 14. Our EU representative's contact is in Section 12.
California residents: Your rights under CCPA/CPRA are described in Section 9.
1. Who We Are
Data Controller: Bemedia Communities Ltd. (Israeli company registration no. 515615946), trading as CiteGist Legal inquiries: [email protected] General inquiries: [email protected] EU Representative (GDPR Art. 27): [EU REPRESENTATIVE NAME], [ADDRESS], [EMAIL]
Note on Israel's adequacy status: The European Commission has recognized Israel as providing an adequate level of data protection for transfers from the EU/EEA (Decision 2011/61/EU, carried over post-GDPR). This means transfers from the EU/EEA to CiteGist's operations in Israel do not require additional safeguards such as Standard Contractual Clauses.
2. What Personal Data We Process
We process personal data about two distinct groups:
A. Voice Profile Data
Voices are individuals whose professional AI citation visibility CiteGist tracks and publishes. For each Voice, we process:
| Data Category | Source | Notes |
|---|---|---|
| Name | Public sources | As the individual has published |
| Professional title and role | Public sources | Current role at time of data collection |
| Professional niche / category | CiteGist classification | Based on content analysis |
| CiteRank score and sub-scores | CiteGist computation | Derived from public AI citations and web signals |
| Public profile URLs | Public sources | Only links the Voice has published themselves (LinkedIn, Twitter/X, Substack, YouTube, podcast feeds, personal website) |
| AI-generated content style characterization | CiteGist computation | Derived from analysis of the Voice's public content |
| Claimed profile data | Voice themselves | Only if the Voice claims their profile: bio, corrections, profile preferences |
| Outreach suppression record | Voice themselves | Opt-out from CiteGist outreach emails; stored separately |
| Request records | Voice themselves | Correction, flag, freeze, and removal requests submitted by the Voice |
We do not process:
- Private contact information (email, phone, home address)
- Information from behind logins or paywalls
- Financial, health, or political data
- Images or photographs (unless the Voice uploads one after claiming their profile)
B. Website Visitor Data
| Data Category | Purpose |
|---|---|
| IP address | Security, fraud prevention |
| Browser type and version | Analytics, compatibility |
| Pages visited and time on site | Analytics |
| Referring URL | Analytics |
| Cookie data | See Section 11 |
3. Legal Basis for Processing (GDPR Art. 6)
| Processing Activity | Legal Basis | Notes |
|---|---|---|
| Publishing Voice profile and CiteRank score | Legitimate interest (Art. 6(1)(f)) | See Legitimate Interest Assessment, available on request |
| Sending one initial outreach email | Legitimate interest (Art. 6(1)(f)) | Outreach suppression honored immediately and permanently |
| Processing correction/flag/freeze/removal requests | Legal obligation + Legitimate interest (Art. 6(1)(c)/(f)) | Required to fulfill data subject rights |
| Maintaining outreach suppression list | Legal obligation / Legitimate interest | Required to honor opt-out |
| Website analytics | Consent (Art. 6(1)(a)) | Only with your prior consent via cookie banner |
| Responding to legal/regulatory requests | Legal obligation (Art. 6(1)(c)) |
Legitimate interest summary: CiteGist has a legitimate interest in providing transparent, data-driven information about the AI citation visibility of public-figure professionals who have voluntarily entered public discourse. This interest is balanced against individuals' privacy rights through the control mechanisms described in Section 9. Our full Legitimate Interest Assessment (LIA) - which documents the purpose test, necessity test, and balancing test for this processing - is an internal compliance document maintained pursuant to GDPR accountability obligations. It is available on request by emailing [email protected].
4. How We Collect Data
Voice profile data is collected from:
- Public APIs and RSS feeds - LinkedIn public profiles, Substack RSS, podcast directories (Apple Podcasts, Spotify), YouTube public data, personal website metadata
- AI citation analysis - querying AI systems with topic-relevant prompts and analyzing responses for mentions of the Voice
- Public web signals - open-web citation and reference data for the Voice's professional output
- The Voice themselves - when they claim their profile and provide information directly
We do not collect data from behind authentication walls, paywalls, or private channels.
5. How We Use Your Data
Voice profile data is used to:
- Compute and publish CiteRank scores and sub-scores
- Generate AI-assisted characterizations of public content style
- Publish ranked leaderboards by professional niche
- Process and respond to correction, flag, freeze, and removal requests
- Send one initial outreach email to unclaimed Voices (unless suppressed)
- Comply with legal obligations
Visitor data is used to:
- Understand Platform usage and traffic patterns (with consent)
- Ensure Platform security and prevent abuse
6. Data Sharing and Recipients
We do not sell personal data. We do not share Voice profile data with third parties for their own marketing or commercial purposes.
We share data with the following categories of recipients, under data processing agreements where required:
| Recipient Category | Purpose | Transfer Basis |
|---|---|---|
| Hosting / infrastructure providers | Platform operation | SCCs or adequacy decision |
| Analytics providers | Visitor analytics (consent-gated) | SCCs or adequacy decision |
| Legal counsel | Legal advice and dispute handling | Legitimate interest / legal obligation |
| Regulatory / law enforcement | Compliance with legal obligations | Legal obligation |
7. International Transfers
CiteGist is operated by Bemedia Communities Ltd., incorporated in Israel. The European Commission has recognized Israel as providing an adequate level of data protection (Decision 2011/61/EU), which means transfers of personal data from the EU/EEA to Israel are permitted without additional safeguards.
Where we engage sub-processors based outside Israel or the EU/EEA (for example, cloud infrastructure providers in the United States), we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, incorporated into those agreements.
If you would like more information about our international transfer safeguards, please contact [email protected].
8. Retention
| Data Category | Retention Period | Rationale |
|---|---|---|
| Voice profile data (active, unclaimed) | Until removal is requested and honored, or the Platform ceases operations | Ongoing legitimate interest |
| Voice profile data (claimed) | Until the Voice requests removal or deactivates, + 30 days | Operational necessity |
| Outreach suppression records | Indefinitely | Required to honor the opt-out obligation |
| Correction/flag/freeze request records | 3 years from date of request | Statutes of limitation |
| Removal and GDPR erasure request records | 5 years from date of request | Regulatory compliance documentation |
| Website analytics data | 26 months | Standard analytics retention |
9. Your Rights
EU/EEA Residents (GDPR)
You have the following rights under GDPR:
| Right | What It Means |
|---|---|
| Access (Art. 15) | Request a copy of your personal data we hold |
| Rectification (Art. 16) | Request correction of inaccurate data |
| Erasure (Art. 17) | Request deletion of your data (subject to exemptions - see below) |
| Restriction (Art. 18) | Request that we restrict processing while a dispute is resolved |
| Portability (Art. 20) | Request your data in a structured, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interest |
| Complaint | Lodge a complaint with your national supervisory authority |
Right to Erasure - Public Figure Exemption: Where a Voice is a public figure in their professional domain (a published academic, executive, public commentator, journalist, or equivalent), CiteGist may retain profile data under Art. 17(3)(a) (freedom of expression and information) and Art. 17(3)(e) (public interest in information) even where an erasure request is submitted. We conduct a documented balancing test for each request and explain our decision in writing within 30 days.
If you are a private individual incorrectly classified as a public figure, we will honor your erasure request promptly.
California Residents (CCPA/CPRA)
California residents have the following rights:
- Right to Know: What categories of personal information we collect and how we use it (described in this Policy)
- Right to Delete: Request deletion of your personal information (subject to exceptions)
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt Out of Sale/Sharing: We do not sell or share personal information as defined by CCPA. You may submit an opt-out request at any time, but we do not engage in these activities
We do not discriminate against individuals who exercise their California privacy rights.
All Users
You may also:
- Decline outreach without creating a profile claim, at any time, using the Decline Outreach button on any Voice profile page
- Request a correction to factual information on a Voice profile page
- Request profile freeze (pauses CiteRank recomputation) via the claimed Voice console
How to exercise your rights: Submit requests via the claim flow at citegist.com/voices/[your-name], through our Takedown & Request Policy page, or by emailing [email protected].
For requests submitted under GDPR, we comply with the 30-day response period required by Article 17 (and Articles 15–22 more broadly). We aim to acknowledge your request within 5 business days of receipt and provide a substantive response - including our decision and the legal basis for it - within 30 days. Where a request is complex or we receive a high volume, we may extend this by a further 2 months; if we do, we will notify you within the initial 30-day period and explain the reason for the extension.
10. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include:
- Access controls and authentication for internal systems
- Encrypted data in transit (TLS)
- Isolated, access-controlled storage for sensitive records (suppression list, request records)
- Regular review of data access logs
No transmission over the internet is 100% secure. We cannot guarantee absolute security.
11. Cookies
We use the following categories of cookies. Cookies other than strictly necessary require your prior consent.
| Category | Examples | Requires Consent? |
|---|---|---|
| Strictly necessary | Session management, security | No |
| Analytics | Traffic analysis (e.g., privacy-preserving analytics) | Yes |
| Advertising / tracking | Not used at Phase 1 | N/A |
You can manage cookie preferences at any time via the Cookie Settings link in the footer. Withdrawing consent does not affect the lawfulness of prior processing.
12. EU Representative
Pursuant to GDPR Article 27, CiteGist has appointed the following EU representative for data subjects and supervisory authorities in the EU/EEA to contact:
[EU REPRESENTATIVE NAME] [Address] [Email]
13. Contact and Complaints
Data Controller: Bemedia Communities Ltd. (Israeli company registration no. 515615946), trading as CiteGist
Legal inquiries (GDPR/CCPA rights requests, takedown, legal notices): [email protected]
General and product inquiries: [email protected]
EU residents may contact our EU Representative (Section 12) or lodge a complaint directly with their national data protection authority. A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
Israeli residents may contact the Israeli Privacy Protection Authority (PPA): https://www.gov.il/en/departments/israel_privacy_protection_authority
California residents may contact the California Privacy Protection Agency: https://cppa.ca.gov/
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy. For material changes, we will make reasonable efforts to notify affected individuals.
Related Policies
This Privacy Policy should be read together with CiteGist's other policies:
| Document | What it covers | URL |
|---|---|---|
| Terms of Use | Rules for using the Platform, including acceptable use and FCRA distance | /terms |
| Takedown & Request Policy | How to correct, freeze, or remove a Voice profile; GDPR Art. 17 and CCPA deletion paths | /takedown |
| Copyright Policy (DMCA) | DMCA takedown notices and counter-notices | /dmca |
| Legitimate Interest Assessment | Internal compliance document supporting our Art. 6(1)(f) processing basis - available on request at [email protected] | On request |