Legal
Privacy Policy
Last updated: 24 September 2026
What personal data Miscited collects, why, who else handles it, and how to ask for a copy or deletion. It describes the service as it works today.
Who we are
Miscited checks what AI assistants say about companies. “Miscited”, “we” and “us” mean the operator of miscited.com. We decide how your personal data is used, which makes us its “controller” under data protection law.
- hello@miscited.com
What we collect
- When you request an audit: your work email address, the domain you want audited and the time of the request. If you followed a link tagged with one of a few channels, such as LinkedIn or our newsletter, we record that channel name too.
- The audit: a report and a provisional workspace for the domain. They hold the public pages we read, the facts we proposed from them, the questions we asked AI assistants, the answers and citations we received, and copies of the pages those answers cited.
- If you have an account: your email address, a salted hash of your password (never the password itself), your role, your weekly email preference, and a log of account actions, such as sign-ins and approvals, recording who took them and when.
- What you add: facts, questions, notes and settings in your workspace, including any email, Slack or webhook addresses you add for alerts.
- Site visits: daily counts of page views and two interactions (opening the worked example and clicking the main button), grouped by the channel you arrived from. These counts contain no visitor ID, cookie, IP address, browser details or page address, and your browser does not send them if Do Not Track is on.
We do not store IP addresses or browser details (user agents) in our database. To stop abuse, the server counts recent requests per IP address in memory; the count is never written to disk and is cleared when the server restarts. Our hosting provider, Railway, handles IP addresses to deliver the site.
How we use your data
- To run the audit you asked for and show you the report.
- To reply to you and contact you about your audit or account.
- To run the monitoring, weekly briefings and alerts you switch on.
- To keep the service secure and prevent abuse.
- To see, in total, which channels bring visitors to the site.
We do not sell your personal data or use it for advertising.
Where UK or EU data protection law applies, we rely on two legal bases: performing our contract with you, or taking the steps you ask for before one, such as running your audit; and our legitimate interests in running a secure service and understanding, in total, how people find it. You can object to any use based on legitimate interests.
Pages we read
To audit a domain, we fetch up to 12 of its public pages, such as the home, pricing and about pages. We also fetch the pages that AI answers cite, and keep copies as evidence. Our crawler identifies itself as Miscited and follows robots.txt, so a site can block it with a User-agent: Miscited rule. It reads public pages only and refuses private network addresses.
These pages can include personal data, such as names on a team page. We use them only as evidence for the audit and any monitoring that follows.
Who can open a report
Each report has its own long, random link. Anyone with the link can open the report, so share it only with people you trust. Report pages tell search engines not to index them.
Who else handles your data
We use a few providers to run the service. They handle data on our behalf and only for that purpose.
- Railway hosts the application and the database that holds everything described above.
- OpenAI answers the questions we ask about your company. We send only the question text, never your email address or account details.
- Anthropic, Google and Perplexity are supported in the same way but are not switched on. We will update this policy before we use them.
- TypeSafe (api.typesafe.ai) is used for model checking, which is on only when we have configured a TypeSafe API key. When model checking is on, we send TypeSafe the text of the AI answer being checked, your brand and competitor names, and the facts from your truth registry that it is checked against.
- Resend delivers any email the service sends you, such as a weekly briefing you have switched on.
- Slack and webhook addresses you add receive the alerts you set up.
- GitHub, Webflow or WordPress, if you ask us to connect one, receive draft changes for your review, using the access token you give us. Nothing is published automatically.
If you choose to contribute to the AI Brand Accuracy Index, only these fields from your results are pooled with other workspaces: provider, model version, claim type, verdict, industry category and quarter. No brand name, question or answer text is included, no published figure draws on fewer than five workspaces, and you can stop contributing at any time.
We may also disclose data when the law requires it, to protect our rights or someone’s safety, or to a buyer if the business is sold, in which case this policy continues to apply.
International transfers
Railway, OpenAI and Resend are based in the United States, so your data may be processed there. Where UK or EU law applies, we rely on the safeguards in their data processing terms, such as standard contractual clauses.
How long we keep it
We keep audit requests, reports, workspaces and account data until you ask us to delete them; we do not yet delete them automatically. Copies of the pages AI answers cite are kept for as long as a checked citation or a confirmed experiment relies on them as evidence; a copy nothing relies on is deleted once it is more than 180 days old. Sign-in sessions end after 24 hours. Rate-limit counts exist only in memory, and visit counts are daily totals that identify no one.
Your rights
Depending on where you live, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct it;
- delete it;
- restrict how we use it, or object to our using it;
- send it to you or to another service in a portable format.
Email hello@miscited.com from the address you used with us, or tell us how we can confirm it is you. We will reply within one month. You can also complain to the data protection authority where you live or work.
Security
We serve the site over HTTPS, store passwords only as salted scrypt hashes, keep session cookies out of reach of page scripts, check a token on every signed-in form, rate-limit sign-in attempts and audit requests, and give reports links that cannot be guessed. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.
Children
Miscited is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect children’s personal data.
Changes to this policy
When we change this policy, we update the date at the top. If a change significantly affects how we use your data, we will tell account holders before it takes effect.
Contact
Email hello@miscited.com with any question or request about your data.