Privacy policy

Citebeam: AI Visibility · last updated 22 October 2026

1. Who we are

Citebeam: AI Visibility (“the app”, “we”) is a Shopify app operated by Scher János (sole proprietor), Gyula, Hungary. We are the controller of the merchant data described below. Contact for support and privacy requests: citebeam@proton.me.

The app measures how AI answer engines (ChatGPT, Perplexity, Google Gemini and, optionally, Google AI Overviews) mention and cite a merchant's store compared with competitors the merchant names.

2. Data we read from your store

The app asks Shopify for read_products when you install it. It asks for the second permission, write_products, only when you first click a one-click fix; you can use the readiness check without it. With them, and with the basic shop information every app can read, we read:

• your shop name, description and primary domain;
• product titles, handles, product types and the first 200 characters of product descriptions;
• for the AI catalog readiness check: product status, vendor, tags, category and category attributes, SEO title and description, image alt text and image links, collection membership, variant prices, barcodes, option names and stock level;
• collection titles, handles, product counts and the first 200 characters of collection descriptions;
• the name and status of your current plan for this app;
• for the weekly monitor, a notice from Shopify each time a product is created or edited (the products/create and products/update webhooks). The notice contains the product's id and its product fields; we keep only what section 4 lists.

We use them to suggest buyer questions, to build your optional llms.txt file and to apply your plan's limits. We change your products only when you click Apply on a one-click fix you have previewed: the product category, product type, SEO title and description, or image alt text. We save the previous value so you can undo each change, and we never change prices, barcodes, inventory or your theme.

3. Data you give us and what we store

• Settings: your store domain, buyer questions, competitor domains, language, AI engines and the llms.txt on/off setting.
• Catalog readiness results: per product, its score, the checks it failed and the product data listed in section 2; and a log of every fix you applied, with the value before and after it.
• Scan results: for each question and engine, the AI answer, the websites it cited, whether your store or your competitors were mentioned or cited, and the figures we calculate from them, with dates. The weekly figures (recommendations gained or lost, share of voice, which competitor was named) are calculated from these scan results.
• Weekly monitor data: see section 4.
• Shopify session data: your shop's myshopify domain and the access token Shopify issues to the app. The app uses shop-level tokens only, so no staff member's name or e-mail is stored.

4. Weekly monitor and alerts

The weekly monitor re-checks your store and your AI visibility each week and tells you what changed. To do this we store, per product that was created or edited since your last check:

• the product's title and Shopify product id;
• the codes of the catalog readiness checks it fails (for example "missing image alt text") and its score;
• a fingerprint (a hash) of the product fields the checks read, so an unchanged product is not re-checked;
• timestamps: when the product was last changed, last checked, and when new issues appeared.

We also store the in-app alerts we show you (for example "a competitor overtook you" or "3 products have new catalog issues"): a short title and text, the date and whether you have read it. We do not send these by e-mail. No customer data is stored for any of this: the product notices from Shopify do not contain customer data.

Why: only to run the weekly re-checks and to show you the alerts in the app. Re-checking a changed product uses our own rules on data we read from your store; it does not send the product to an AI provider. We use the data for nothing else.

5. What we do not collect

No data about your customers (no names, e-mails, addresses, orders or payments); the app has no permission to read them. No scripts, pixels, cookies or theme edits on your storefront. The optional llms.txt file is plain text served through a Shopify app proxy and contains only shop, collection and product information. We use no advertising or analytics trackers.

6. Who processes data for us

• Apify Technologies s.r.o. (Czech Republic) runs our measuring tool. It receives your store domain, questions, competitor domains, language and engines.
• Perplexity AI, Inc. (USA), Google (Gemini, and Google Search for AI Overviews, reached through Apify) and, when the ChatGPT engine is ticked (it is by default), OpenAI (USA) answer the questions. They receive the questions and the language, never your access token.
• Google (Gemini API, USA) writes suggested SEO text and image alt text and picks a product category. It receives the product's title, vendor, type, category, options, tags, the first 600 characters of its description and, for alt text, a small copy of the product image; never customer data or your access token.
• Railway Corp. (USA) hosts the app and its database, which hold the data in sections 2, 3 and 4.
• Shopify provides the platform, sign-in and billing under its own privacy policy.

We do not sell data and do not share it with anyone else unless the law requires it.

7. Why we use the data

To provide the service you installed (performance of our contract with you, GDPR Art. 6(1)(b)), and to keep the app secure, prevent abuse and fix errors (our legitimate interests, Art. 6(1)(f)).

8. How long we keep it

• While the app is installed we keep your settings and scan history so you can see trends, and the weekly monitor data and alerts from section 4, until you uninstall the app.
• When you uninstall, your access tokens are deleted at once and we stop recording product changes and sending alerts.
• 48 hours after uninstalling, Shopify sends us a shop/redact request and we delete all remaining data of your shop, including the product titles, issue codes and alerts of the weekly monitor.
• Customer data requests (customers/data_request, customers/redact) are answered; we hold no customer data.

9. Your rights

You can ask us to access, export, correct or delete your data, or object to its use, by writing to citebeam@proton.me; we answer within 30 days. Uninstalling the app deletes all of your data within 48 hours. You can also complain to your data protection authority.

10. Transfers outside the EEA

Some processors are in the USA. For these transfers we rely on the safeguards the providers offer, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

11. Security

All traffic is encrypted (HTTPS). API keys are kept as server secrets, never in code; access tokens are stored only in the app's database and are not written to logs. Shopify session tokens and webhook signatures are verified on every request, and the app changes products only after your confirmation.

12. Changes

We will update the date above and, for important changes, tell merchants in the app before they take effect.