1. Who we are
1.1 Cube27 IT Private Limited (“Cube27”, “we”, “us”) operates CiteLadder, a marketing analytics service that measures how AI assistants and search engines mention and cite a business, which sources they rely on, and which website issues affect that visibility. Our registered office is Plot No. 12, Mulberry Gardens 1, Magarpatta City, Hadapsar, Pune, Maharashtra 411013, India. Contact us at contact@cube27.com.
1.2 This Policy covers the CiteLadder website, hosted application, account administration, purchases, support and data processed through CiteLadder features. For our own account, billing, security and support purposes we decide why and how personal data is processed. For personal data processed on a customer’s instructions, we act on behalf of that customer.
2. Information we process
- Account and workspace — name, work email, authentication identifiers, organisation, roles, invitations and settings, used for sign-in, administration and permissions.
- Billing and tax — billing name, address and country, tax identifiers, plan, transaction references, invoices and payment or refund status, used for payments, entitlements, accounting, tax and disputes.
- Project configuration — domains, brand and competitor information, prompts, markets, languages and selected providers, used to configure analysis and monitoring.
- Website evidence — URLs, publicly accessible page content, technical metadata, extracted facts, links, crawl results and provenance, used for Site Health, reports and comparison.
- AI and content — prompts, relevant project context, instructions, generated responses and drafts, citations and execution metadata, used for requested AI assistance and visibility measurement.
- Connected sources — selected properties, encrypted credentials, search and analytics data, imported payloads and sync history, used for authorised integrations and analysis.
- Server logs you send us — if you connect AI crawler logs, your CDN or server sends request records for your site. We use the client IP address only while processing a record, to verify that a crawler is genuine, and do not store it. We store the crawler identity, the time, the response status and the page path without its query string (URLs that look like secrets are redacted). Detailed request records are deleted after 90 days; daily summaries are kept as project data under this policy’s retention terms.
- Usage and security — IP address, timestamps, device and browser information, requests, errors and operational events, used for security, abuse prevention and reliability.
- Support — messages and any details you choose to provide, used to help you and handle complaints.
- Cookies and browser storage — described in our Cookie Policy at /cookies.
3. Payment details and public information
3.1 CiteLadder does not store complete payment-card numbers, card security codes or payment-authentication secrets. Razorpay, our payment processor, handles those details.
3.2 Public pages and search results may contain personal information. Public availability does not remove our responsibility to handle that information lawfully.
4. Sources and purposes
4.1 We receive information from you and your workspace users, connected accounts, customer-authorised website requests, selected AI, research and data providers, our payment processor, and your use of the Service.
4.2 We use it to deliver requested features, preserve project evidence, manage accounts and billing, respond to support requests, protect the Service, keep it reliable and meet legal obligations. We use only the data reasonably needed for the relevant purpose. Where consent is required, we ask for it for the identified purpose, and optional consent is never a condition of unrelated essential features.
5. Website and project evidence
5.1 A requested crawl processes page bodies to extract relevant information. Extracted content, findings, links and technical provenance can remain in the workspace for history and comparison. AI responses and connected-provider imports may be retained as evidence. Evidence can contain personal or confidential information.
6. AI providers and data use
6.1 An enabled AI feature may send your prompt and relevant project context to the provider used for that feature. The in-app Agent always uses our platform providers (Anthropic or OpenAI); AI answer-engine audit calls you configure with your own API keys (BYOK) run under your own provider account and settings.
6.2 Agent conversations are stored in your workspace so a chat can continue where it left off. This includes the model’s working notes used to continue a chat, which are not all shown to you.
6.3 When you generate prompt suggestions, we may send each suggestion with your project’s business facts to a quality-checking provider, which answers fixed questions about whether the suggestion fits your business and reads like a real buyer’s question. When you run an internal link analysis, we send the provider short descriptions of pairs of your crawled pages, which it uses to answer whether one page should link to the other. Its answers decide which suggestions we show you; they are not used to score your business. Our subprocessor list at /subprocessors names this provider and the data it receives.
6.4 We do not sell Customer Data or use it to train third-party foundation models, and we do not disclose one customer’s private project information to another customer. Provider retention and processing depend on the provider’s service, agreement and configuration; we do not promise that every provider deletes data immediately.
7. Connected Google and other accounts
7.1 We access only the permissions and properties you authorise for an integration. Depending on what you connect, this may include search queries, pages, impressions, clicks, analytics events and associated reporting data. We may retain imported data and derived reports to provide the requested features.
7.2 You may disconnect an integration or revoke permissions through the provider. This stops future access; it does not automatically erase imported history. You can request deletion of that history separately.
8. Recipients and external clients
8.1 We disclose data as needed to infrastructure, AI, research, monitoring and support providers that help us run the Service; to our payment processor; and to connected platforms under your instructions.
8.2 Workspace administrators and authorised members may access information according to their roles. If you authorise an API or MCP client, that client receives the data returned within its permissions and its provider may retain it independently. Once delivered, that data is handled under the client’s terms, not ours, and we are not responsible for it. Revoking access stops future requests.
8.3 We may also disclose information to advisers or authorities where necessary and lawful.
9. AI assistant connections (MCP)
9.1 You can connect an AI assistant to CiteLadder through our MCP server, including as an assistant plugin. The assistant registers itself with a self-declared name and its return address, and you sign in to CiteLadder and approve which workspaces it may use and whether it may make changes.
- Data we collect — the assistant’s registration, your account and the workspaces you approved, the access you granted, when you connected and when the connection was last used. We process each request the assistant sends to answer it and do not keep it, except a change prepared for your confirmation. Access tokens are stored only as keyed hashes.
- Purpose — to authenticate the assistant, answer its requests from the saved records of the workspaces you approved, make a change only after you confirm its preview, limit request rates and keep the connection secure.
- Recipients — the assistant receives only the data its requests return within the access you granted; its provider handles that data under its own terms, as described above. We do not sell this data or use it to train models.
- Retention — an assistant registration never used to connect may be deleted after 24 hours. A prepared change expires after ten minutes if you do not confirm it. A connection lasts until it is revoked, and must be approved again at least every 180 days. Records of ended connections, used approvals and confirmed changes are kept for 180 days for security and audit, then deleted. Each change made through a connection is also recorded in the workspace’s security log.
- Your controls — remove a connection at any time in Settings → MCP connections or from your assistant; it stops working at its next request. Workspace Owners and Admins can remove connections to their workspace. Changes are offered only if you tick Allow changes, and each one is shown for you to confirm first.
10. Retention, export and deletion
10.1 We retain project data, including Agent conversations, while your workspace has access to the Service and until you delete it. Cancelling a subscription does not immediately delete your workspace or its history.
10.2 Once all paid access to a workspace ends, you have 30 days to request an export of supported Customer Data. We then delete or de-identify the workspace’s project data within a further 30 days. A free trial workspace that is not converted to a paid plan is deleted with its data 30 days after the trial ends.
10.3 You can ask us to export supported Customer Data or delete your data at any time by emailing contact@cube27.com. We will verify your identity and authority, then complete a verified deletion request within 30 days. Any backup copies are removed within 90 days after deletion from our active systems.
10.4 When you reject a suggested prompt that was quality-checked, we keep the check’s result, without the suggestion’s text, for up to 180 days to improve those checks.
10.5 We may keep limited billing, tax, accounting, consent, security, fraud or dispute records for the period the law requires. Third-party providers and external clients you authorised may retain their own copies under their terms.
11. Security and international processing
11.1 We use safeguards appropriate to the data and risks, including controlled workspace access, protected credentials, encrypted transport and operational security measures. No online service provides absolute security.
11.2 We operate from India. The Service is hosted on Google Cloud in the United States (us-central1), with Cloudflare delivering the website and app from its global network. Our other providers may process information in other countries; our subprocessor list at /subprocessors gives each provider’s location.
12. Your choices and requests
12.1 Depending on applicable law, you may request access to, correction of, erasure of or a copy of your personal data; withdraw consent; object to or restrict certain processing; nominate a person where that right applies; or complain to the relevant authority.
12.2 Email contact@cube27.com. We may ask for proportionate verification. Withdrawing consent does not invalidate earlier lawful processing but may stop a feature that needs the data. For data controlled by your organisation, direct the request to its workspace administrator; we will assist that organisation as the law requires.
13. Children
13.1 CiteLadder accounts are for adults aged 18 or over. The Service is not directed to children. Contact us if you believe a child’s data has been collected inappropriately.
14. Updates and contact
14.1 We update this Policy when our practices change and give notice of material changes where required.
14.2 Questions or complaints: contact@cube27.com, or Cube27 IT Private Limited, Plot No. 12, Mulberry Gardens 1, Magarpatta City, Hadapsar, Pune, Maharashtra 411013, India. Our contact page at /contact lists every channel. You keep the right to approach the relevant authority.