Privacy Policy
Last updated 2 September 2026
Citolume is a WordPress plugin and a hosted service, made by Havoric. This page says what we collect, why, how long we keep it, and who processes it. It is written to be read, not skimmed.
What we collect, and why
When you connect a site — and only after you click Connect in the plugin (nothing is sent before that click) — we store:
- Your site’s domain, because it is what we check the AI engines’ answers for.
- The questions you choose to track, because they are what we ask.
- Scan results: whether your site was cited or mentioned per question per engine, and the URLs the engines cited. This is the product.
- Your site’s title, so we can recognise your brand being named in an answer without a link.
- A licence key, which identifies your site to the service. It is stored in your WordPress database and sent with each request.
If you buy a paid plan, our billing provider collects your email and payment details (see sub-processors below). If you create an account on this site, we store your email address and a hashed password.
That is the list. We do not collect your site’s content, your visitors, your analytics, or your emails.
Product analytics, if you allow them
We use PostHog to see which parts of Citolume people actually use — which pages are read, which buttons are pressed, and where setup is abandoned.
- Nothing is stored on your device until you say yes. Until you answer the banner, PostHog runs in memory only: no cookie, no local storage, and nothing that survives the page. Ignoring the banner is a complete answer.
- If you allow it, a cookie on
.citolume.comkeeps the same anonymous identifier across this site and the app, so a visit here and a sign-up there are one person rather than two. - Once you are signed in we attach your account id and your email address to that record, so support can answer “what did I click” without guessing.
- In the app we record session replays: a reconstruction of what the page looked like as you used it. Everything you type into a form is masked before it leaves your browser, as are your email address and account details on screen. We never record your licence key, your tracked questions or your results.
- Analytics requests are served from
citolume.com/ingest, our own domain, rather than PostHog’s. That is so an ad blocker’s domain list does not silently decide what we can measure — it is not a way around your choice, which is the banner above, and it is honoured either way. - You can change your mind: clear this site’s data in your browser and the banner returns.
What the plugin does entirely on your own server
The crawler log, llms.txt and the crawler-block check run inside your WordPress install and send nothing anywhere. The crawler log records no IP addresses, and human visitors are never recorded — only recognised AI crawlers, the page they fetched, and the date.
How long we keep it
| Data | Kept for |
|---|---|
| Free plan, active site | 12 months of results, rolling |
| Paid plan, active site | Full history while subscribed |
| After a subscription ends | 90 days of results, then deleted; the account is kept |
| Site inactive for 60 days | Scanning stops; data kept per the rows above |
| Account deleted | Everything, immediately |
Uninstalling the plugin stops scans but does not delete your history — a reinstall picks up where you left off. Deleting everything is a deliberate, separate action from your account, and it is honoured completely.
Sub-processors
To run the service we send limited data to:
- Cloudflare — hosts the service and this site; all data lives there.
- AI engine providers — Google (Gemini), OpenAI (ChatGPT), Perplexity, and Anthropic (Claude, when available on your plan): they receive the questions you track, asked as queries. They never receive your key, your email, or anything about your visitors.
- Resend — sends our emails (digests, account emails).
- PostHog — product analytics and session replay, only with your consent (see above). They receive the pages you visit, the buttons you press, and — once you are signed in — your account id and email address.
- Dodo Payments — the merchant of record for paid plans; they process payment details, which never touch our systems.
Export and deletion
You can request an export of your data in a machine-readable format, and you can delete your account — which removes your sites, questions, results and sources immediately. Both from your account area, or by emailing us.
Contact
Havoric — havoric.com. Email hello@havoric.com.