Privacy notice

Courtesy translation. This English text is provided for your convenience. The legally binding version is the German one: Datenschutzerklärung. The German text also covers the operator's other services; this notice covers CitedBy only.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

Maximilian Wiese (mxw-it)
Am Jördenberg 9a
23812 Wahlstedt
Germany

Phone: +49 151 59084870
Email: kontakt@mxw-it.com

No data protection officer has been appointed, because the legal requirements for this (§ 38 BDSG, Art. 37 GDPR) are not met.

2. Scope

This notice applies to CitedBy at www.citedby.de. Because the controller is established in the European Union, the GDPR applies to the processing described here regardless of where you are located.

3. Overview

• Without your consent, CitedBy does not recognise you across several visits. If you have consented, our host groups the page views of one visit for the duration of a day under a value derived from the request, without cookies and without storing your IP address (section 8.7).
• We use no social media plugins or share buttons and create no usage profiles.
• Fonts and all other design resources are loaded from our own server. No content is loaded from third parties such as Google Fonts or external CDNs.
• Without your consent, only technically necessary information is stored on your device (section 6).
• The language of this site depends on the address you open. We store no cookie for it and do not evaluate your IP address for it.

4. Hosting

CitedBy is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA ("Vercel").

When you access the service, Vercel automatically collects information in server log files that your browser transmits:

• IP address of the requesting device
• date and time of access
• page or file accessed
• amount of data transferred and access status
• browser type and version, operating system
• referrer URL (page visited before)

This data is technically necessary to deliver the service, to ensure its stability and security (for example defending against attacks) and to analyse errors. It is not combined with other data sources or evaluated for marketing purposes.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and secure provision of our service.

Retention: Vercel stores the log files only for as long as necessary for these purposes and then deletes or anonymises them.

Processing agreement and transfer to third countries: We have concluded a data processing agreement with Vercel under Art. 28 GDPR. The server functions run in the Frankfurt am Main region (eu-central-1), so processing by these functions takes place in Germany. Static content is also delivered through Vercel's worldwide network, which includes locations outside the European Union. Vercel is a US company, so access from the United States, for example for administration and support, cannot be ruled out. The transfer is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) and additionally on Vercel's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). More information: https://vercel.com/legal/privacy-policy

5. Contacting us

If you contact us by email or phone, we store your details (for example name, email address, content of your enquiry) to process your enquiry and for any follow-up questions. We do not pass this data on without your consent.

We receive enquiries to our contact address in a ticket system, which records each enquiry as a numbered case so that nothing is left unprocessed. It processes what you send us: sender address, subject, message text, any attachments and the technical headers of your email. After receipt you automatically get a confirmation with the case number. We run this open source software ourselves on a server rented from IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany ("IONOS"), in a data centre in Logroño, Spain, so processing takes place within the European Union. IONOS only provides the infrastructure and acts as our processor under Art. 28 GDPR. More information: https://www.ionos.de/terms-gtc/AVV/

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to entering into or performing a contract. In all other cases Art. 6(1)(f) GDPR; our legitimate interest lies in processing enquiries in an orderly and complete way.

Retention: Your data remains with us until you ask us to delete it, withdraw your consent or the purpose of storage ceases to apply. Mandatory statutory retention obligations remain unaffected, in particular under commercial and tax law (§ 257 HGB, § 147 AO): currently 6 years for commercial letters and 8 years for accounting records.

6. Information on your device

Without your consent we only store and read information that is strictly necessary for the service you have requested. We do not measure or evaluate your behaviour and do not create a profile from it; no fingerprinting takes place. Legal basis: § 25(2) no. 2 TDDDG and, where personal data is involved, Art. 6(1)(b) or (f) GDPR.

You can delete cookies and local storage yourself at any time in your browser settings. If you block cookies entirely, logging in to CitedBy is no longer technically possible.

Consent and withdrawal: Vercel Web Analytics (section 8.7) requires your consent under § 25(1) TDDDG and is not loaded before you give it. You can withdraw your consent at any time with effect for the future: click "Cookie settings" in the footer and choose "Decline". The page then reloads and Vercel Web Analytics is no longer loaded. The lawfulness of processing up to the withdrawal is unaffected (Art. 7(3) GDPR).

7. Encryption

CitedBy uses SSL/TLS encryption for security and to protect the transmission of confidential content. You can recognise an encrypted connection by "https://" in the address bar and the lock symbol in your browser.

8. Processing in CitedBy

CitedBy checks whether and how a business appears in the answers of major AI language models and produces a report from this. The application is in a beta phase.

8.1 Analysis request and report

When you request an analysis, we process the details you enter: business name, industry, city, country, the language of the questions, optionally the website address, and your email address for retrieving the result. From these details we generate search queries, send them to several AI language models and store the result and report in our database so that you can open it again later and download it as a PDF.

If you have a business checked in which you are identifiable as a person, for example a sole proprietorship under your own name, we also process data about you.

Legal basis: Art. 6(1)(b) GDPR (providing the service you requested).

8.2 AI language models through OpenRouter

To carry out the analysis we send the generated search queries to OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA ("OpenRouter").

OpenRouter forwards the queries to the respective model providers, currently including Anthropic, OpenAI, Google, Meta and Perplexity. What is transmitted are the search queries generated from your entries. Your email address and account data are not transmitted. According to its own statements, OpenRouter does not use the content to train models; individual model providers do reserve the right to such use. Please therefore do not enter any personal data in the input fields beyond the business details needed for the check.

Legal basis: Art. 6(1)(b) GDPR. The transfer to the USA is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR). More information: https://openrouter.ai/privacy

8.3 Account and database (Supabase)

For accounts, login and storage we use Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 ("Supabase").

When you register we process your email address and a password you choose, which is stored only as a cryptographic hash. We also store the language in which you registered, so that account emails reach you in that language. For login we set the cookies listed in section 6. The database also holds your analyses and, with a subscription, the related contract data, including the language of your monitoring emails. Supabase sends emails confirming your address, resetting your password and confirming a change of address on our behalf; they contain your email address and a confirmation link.

When registering you confirm that you are at least 18 years old. We store the time of this confirmation as evidence in your account; registration is not possible without it.

You can also voluntarily add a name in your account. This is not required for use; it only serves to address you in your customer account and in support requests and does not go into the report or to the AI providers. You can change or remove the name in your account at any time.

Legal basis: Art. 6(1)(b) GDPR.

Processing agreement and transfer to third countries: We have a data processing agreement with Supabase under Art. 28 GDPR. The database itself runs in the Frankfurt am Main region within the EU. Because Supabase is based in Singapore and no EU adequacy decision exists for Singapore, access from a third country cannot be ruled out; in this respect the transfer is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR). More information: https://supabase.com/privacy

Retention: Account data is stored for as long as your account exists. If you delete your account or ask us to delete it, the account and related analyses are deleted unless a statutory retention obligation applies (section 5).

8.4 Subscription and payment (Paddle)

Payments and subscriptions are handled by Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, and Paddle Payments Limited, The Academy, 42 Pearse Street, Dublin 2, D02 HV59, Ireland, and for purchases in the USA by Paddle.com Inc. (together "Paddle"). For customers from the European Economic Area, the Irish company regularly acts.

Paddle acts as merchant of record. This means that the purchase contract for the subscription is concluded between you and Paddle. Paddle is independently responsible under data protection law for processing your payment and billing data and is not our processor. Paddle's privacy policy applies in this respect: https://www.paddle.com/legal/privacy

We do not receive or store your full payment data, such as card numbers. Paddle reports back to us which subscription exists with which status, a customer and subscription identifier and the email address used for the contract. We store these details in order to provide the subscribed services.

The payment process is displayed by a script from Paddle that is only loaded from a Paddle server when you start a payment. There is no connection to Paddle before that.

Legal basis: Art. 6(1)(b) GDPR. Where data flows to the British company, the transfer is based on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR), which the Commission renewed on 19 December 2025 with effect until 27 December 2031.

8.5 Recurring audits and notifications

As part of a subscription we repeat the analysis automatically at regular intervals and notify you of changes by email. To send these emails we use Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, trading as Resend ("Resend"). Your email address and the content of the message are transmitted.

Legal basis: Art. 6(1)(b) GDPR, because the notification is part of the subscribed service. We have a data processing agreement with Resend under Art. 28 GDPR; the transfer to the USA is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) and additionally on certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). More information: https://resend.com/legal/privacy-policy

8.6 Case record in the ticket system

We also record every analysis you start yourself as a case in the ticket system described in section 5. It includes the details from section 8.1, the plan used and, after the run, the result in brief. The purpose is internal traceability: we can see which analyses were requested and whether they ran without errors, and refer back to them if questions arise.

You are not recorded as the requesting person in this case, so no message goes to you from the ticket system. Audits repeated automatically under a subscription do not create a case.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in properly processing and being able to trace the analysis requests we receive. Retention: the case is deleted once it is closed and there is no reason to keep it; otherwise the periods in section 5 apply.

8.7 Audience measurement with Vercel Web Analytics

We use Vercel Web Analytics, a service of our host Vercel, to measure how many people use the application, which pages they view and how they find us. We want to see whether the explanations and the questions page are read and where visitors drop off.

What is processed. With each page view a small script, loaded from our own address, sends Vercel the page viewed, the page visited before (referrer), the time of the visit and details of browser, operating system and device type; from the IP address Vercel derives an approximate location at the level of country, region and city. The content of your analyses, your business details, your email address and your account are not transmitted, and the measurement is not linked to your account.

Only with your consent. The service sets no cookies. However, its script reads the page viewed, the referring page and browser and device details in your browser and sends them to Vercel. We treat this as access to your device within the meaning of § 25(1) TDDDG and therefore only load the script after you click "Accept" in the banner. Without consent no measurement takes place. To group the page views of a visit, Vercel forms a value (hash) from the request, which expires automatically after 24 hours. According to Vercel, the measurement data is not stored linked to your IP address or any other identifier of your person. We only see the evaluation in aggregated form, create no usage profiles and do not combine the data with other data sets.

Legal basis: your consent, Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw it at any time with effect for the future, as described in section 6. Retention: the value for a visit expires after 24 hours; Vercel provides the aggregated data to us for twelve months.

Processing agreement and transfer to third countries: Vercel processes the data for us as a processor under the agreement named in section 4. The evaluation takes place on Vercel servers in the United States. The transfer is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) and additionally on Vercel's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). More information: https://vercel.com/docs/analytics/privacy-policy

8.8 Cancellation and withdrawal through the website

You can cancel a CitedBy subscription without logging in using the "Cancel contracts here" button and withdraw from it using "Withdraw from contract here"; both are in the footer of every page.

What is processed: your name, the email address for the confirmation, the contract and, if you wish, the subscription or order number; for a cancellation also its type, for an extraordinary cancellation the reason, and the date on which the contract is to end. In addition the date and time of receipt. To match your declaration to your subscription, we compare the email address with our contract data (sections 8.3 and 8.4).

Purpose: to receive your declaration, to confirm receipt immediately, to implement it at Paddle and to be able to prove receipt later.

Recipients: we store the declaration at Supabase (section 8.3). We send the confirmation to you and a copy to us through Resend (section 8.5). To implement it we pass the necessary details to Paddle (section 8.4).

Legal basis: Art. 6(1)(c) GDPR in conjunction with § 312k and § 356a BGB, which oblige us to receive and confirm it, and Art. 6(1)(b) GDPR for handling your contract.

Retention: three years from the end of the year in which the declaration was received (regular limitation period, § 195 BGB). We then delete it.

9. External links

Our service contains links to external websites. When you click an external link you leave our service; the privacy policy of the respective provider then applies. We have no influence on how external providers process data.

10. Your rights

Where the legal requirements are met, you have the following rights:

• Access to the personal data we process (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data stored with us (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to the processing at any time on grounds relating to your particular situation.

An informal message to kontakt@mxw-it.com is enough to exercise your rights.

Right to lodge a complaint: you have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel, Germany
Phone: +49 431 988-1200
Email: mail@datenschutzzentrum.de
https://www.datenschutzzentrum.de

11. Obligation to provide data

Providing personal data is neither legally nor contractually required. For an account and a subscription, the details named in section 8 are necessary; we cannot provide this service without them.

12. Automated decision-making

No automated individual decision-making including profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) takes place. The AI-based analysis described in section 8 assesses the visibility of a business in AI answers; it does not make a decision about you as a person.

13. Changes to this notice

We reserve the right to adapt this notice if the legal situation, our service or the data processing changes. The version published on this website applies.

---

As of: November 2026