Privacy policy

Citebeam: AI Visibility · last updated 12 October 2026

1. Who we are

Citebeam: AI Visibility (“the app”, “we”) is a Shopify app operated by the developer named in our Shopify App Store listing. We are the controller of the merchant data described below. Contact for support and privacy requests: jani.prog001+aivisibility@gmail.com.

The app measures how AI answer engines (Perplexity, Google Gemini, Google AI Overviews and, on some plans, ChatGPT) mention and cite a merchant's store compared with competitors the merchant names.

2. Data we read from your store

The app asks Shopify for two permissions, read_products and write_products. With them, and with the basic shop information every app can read, we read:

• your shop name, description and primary domain;
• product titles, handles, product types and the first 200 characters of product descriptions;
• for the AI catalog readiness check: product status, vendor, tags, category and category attributes, SEO title and description, image alt text and image links, collection membership, variant prices, barcodes, option names and stock level;
• collection titles, handles, product counts and the first 200 characters of collection descriptions;
• the name and status of your current plan for this app.

We use them to suggest buyer questions, to build your optional llms.txt file and to apply your plan's limits. We change your products only when you click Apply on a one-click fix you have previewed: the product category, product type, SEO title and description, or image alt text. We save the previous value so you can undo each change, and we never change prices, barcodes, inventory or your theme.

3. Data you give us and what we store

• Settings: your store domain, buyer questions, competitor domains, language, AI engines and the llms.txt on/off setting.
• Catalog readiness results: per product, its score, the checks it failed and the product data listed in section 2; and a log of every fix you applied, with the value before and after it.
• Scan results: for each question and engine, the AI answer, the websites it cited, whether your store or your competitors were mentioned or cited, and the figures we calculate from them, with dates.
• Shopify session data: your shop's myshopify domain and the access token Shopify issues to the app. The app uses shop-level tokens only, so no staff member's name or e-mail is stored.

4. What we do not collect

No data about your customers (no names, e-mails, addresses, orders or payments); the app has no permission to read them. No scripts, pixels, cookies or theme edits on your storefront. The optional llms.txt file is plain text served through a Shopify app proxy and contains only shop, collection and product information. We use no advertising or analytics trackers.

5. Who processes data for us

• Apify Technologies s.r.o. (Czech Republic) runs our measuring tool. It receives your store domain, questions, competitor domains, language and engines.
• Perplexity AI, Inc. (USA), Google (Gemini, and Google Search for AI Overviews, reached through Apify) and, only if ChatGPT is part of your plan, OpenAI (USA) answer the questions. They receive the questions and the language, never your access token.
• Google (Gemini API, USA) writes suggested SEO text and image alt text and picks a product category. It receives the product's title, vendor, type, category, options, tags, the first 600 characters of its description and, for alt text, a small copy of the product image; never customer data or your access token.
• Railway Corp. (USA) hosts the app and its database, which hold the data in sections 2 and 3.
• Shopify provides the platform, sign-in and billing under its own privacy policy.

We do not sell data and do not share it with anyone else unless the law requires it.

6. Why we use the data

To provide the service you installed (performance of our contract with you, GDPR Art. 6(1)(b)), and to keep the app secure, prevent abuse and fix errors (our legitimate interests, Art. 6(1)(f)).

7. How long we keep it

• While the app is installed we keep your settings and scan history so you can see trends.
• When you uninstall, your access tokens are deleted at once.
• 48 hours after uninstalling, Shopify sends us a shop/redact request and we delete all remaining data of your shop.
• Customer data requests (customers/data_request, customers/redact) are answered; we hold no customer data.

8. Your rights

You can ask us to access, export, correct or delete your data, or object to its use, by writing to jani.prog001+aivisibility@gmail.com; we answer within 30 days. Uninstalling the app deletes all of your data within 48 hours. You can also complain to your data protection authority.

9. Transfers outside the EEA

Some processors are in the USA. For these transfers we rely on the safeguards the providers offer, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

10. Security

All traffic is encrypted (HTTPS). API keys are kept as server secrets, never in code; access tokens are stored only in the app's database and are not written to logs. Shopify session tokens and webhook signatures are verified on every request, and the app changes products only after your confirmation.

11. Changes

We will update the date above and, for important changes, tell merchants in the app before they take effect.