Legal
Privacy Policy
Effective April 26, 2026 · Last updated September 15, 2026 · Prime Sentia INC · GDPR · CCPA · LSSICE
§01 · Data Controller
Prime Sentia INC ("Prime Sentia", "we", "us") is the data controller for personal data collected through neogeo.primesentia.io, primesentia.ai, and citabilize.primesentia.ai. Contact for data protection matters: dpo@primesentia.ai. Postal address: 254 Chapman Rd, Ste 208 #26181, Newark, DE 19702, USA.
The canonical Privacy Policy is this page. Machine-readable cookie and analytics disclosure: privacy.json.
§02 · Data We Collect
We collect the following categories of personal data:
Data we collect
| Category | Data | Legal basis |
|---|---|---|
| Account data | Name, work email, hashed password | Contract · Art. 6(1)(b) |
| Organization data | Company name, domain(s) audited | Contract · Art. 6(1)(b) |
| Usage data | Audit runs, sessions, feature interactions | Legitimate interest · Art. 6(1)(f) |
| Technical data | IP address, browser, device type | Legitimate interest · Art. 6(1)(f) |
| Audit content | Crawled pages of submitted domains | Contract · Art. 6(1)(b) |
| Communications | Emails and support messages | Legitimate interest · Art. 6(1)(f) / consent for marketing |
We do not collect special categories of data (Art. 9 GDPR) or data relating to criminal convictions. We do not knowingly collect data from children under 13 (COPPA) or from individuals under 18. If we learn we have collected such data, we delete it.
§03 · How We Use Your Data
- Providing, operating, and improving the GEO platform;
- Processing audit runs and generating AI-assisted reports;
- Managing your account, billing, and authentication;
- Sending transactional communications (account events, audit completions);
- Sending product updates and feature announcements (you may opt out at any time via the unsubscribe link; each commercial message includes our Delaware postal address);
- Detecting and preventing fraud, abuse, or security incidents;
- Complying with legal obligations.
We do not sell, rent, or trade your personal data with third parties for their own marketing purposes.
§04 · AI Processing and Sub-processors
To generate GEO analysis, your submitted domain data is sent as queries to the following AI service providers, which act as sub-processors. The third column links a data-processing addendum where Prime Sentia has one, or the provider's public privacy policy:
AI sub-processors
| Provider | Location | Agreement or policy |
|---|---|---|
| OpenAI | United States | DPA · openai.com/policies/data-processing-addendum |
| Anthropic | United States | Trust Center · trust.anthropic.com |
| Google Gemini | EU / USA | DPA · cloud.google.com/terms/data-processing-addendum |
| Perplexity AI | United States | Privacy Policy · perplexity.ai/hub/legal/privacy-policy |
International transfers to the United States are carried out on the basis of Standard Contractual Clauses (SCCs) as approved by the European Commission (Art. 46(2)(c) GDPR), or under an applicable adequacy decision. AI providers do not use your data to train their general-purpose models under the API agreements Prime Sentia has in place.
§05 · Infrastructure Sub-processors
In addition to AI providers, we use:
Infrastructure sub-processors
| Service | Detail |
|---|---|
| PostgreSQL | Primary database — EU location, Prime Sentia-managed server |
| Qdrant | Vector database for page embeddings — EU location |
| Coolify | Container orchestration on Prime Sentia infrastructure |
| Stripe | Payment processing for checkout and subscriptions — United States |
| Google Analytics 4 | Marketing-page measurement (G-Z0R5LWN3B7) — not loaded on /terms, /privacy, or /bot |
| 360ultra / Mautic | Marketing attribution on non-legal pages (360ultra.primesentia.io) |
§06 · Data Retention
We retain your personal data for the following periods:
Retention periods
| Category | Period |
|---|---|
| Account data | Subscription + 12 months |
| Audit reports & runs | 24 months |
| Usage logs | 12 months |
| Billing records | 7 years (legal obligation) |
After the applicable retention period, data is deleted or irreversibly anonymized. You may request earlier deletion (see §08 — Your Rights).
§07 · Security
Prime Sentia implements technical and organizational security measures in accordance with GDPR Article 32:
- Encryption in transit (TLS 1.2+) and at rest
- Access controls and role-based permissions
- Regular security reviews
- Incident response procedures
In the event of a personal data breach posing a risk to your rights, we will notify the competent supervisory authority within 72 hours (GDPR Art. 33) and inform affected users without undue delay (GDPR Art. 34) where required.
§08 · Your Rights (GDPR)
If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:
Your GDPR rights
| Article | Right | Description |
|---|---|---|
| Art. 15 | Access | Request a copy of your personal data |
| Art. 16 | Rectification | Correct inaccurate data |
| Art. 17 | Erasure | Request deletion (right to be forgotten) |
| Art. 18 | Restriction | Limit processing in certain circumstances |
| Art. 20 | Portability | Receive your data in a machine-readable format |
| Art. 21 | Objection | Object to processing based on legitimate interest |
| — | Withdraw | Where processing is based on consent, withdraw it at any time |
To exercise any of these rights, contact dpo@primesentia.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) or the supervisory authority in your country of residence.
§09 · California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information is collected about you;
- Correct inaccurate personal information we hold about you;
- Delete personal information we hold about you;
- Opt out of the sale or sharing of personal information;
- Non-discrimination for exercising your rights.
Prime Sentia does not sell or share personal information as those terms are defined under CCPA/CPRA. We will respond to verifiable consumer requests within 45 days.
To submit a verifiable consumer request, contact privacy@primesentia.ai.
§10 · Cookies and analytics
Cookie names match production. Google Analytics (G-Z0R5LWN3B7) and Mautic (360ultra.primesentia.io) run on marketing pages. They are not loaded on /privacy, /terms, or /bot.
Cookies
| Cookie | Purpose |
|---|---|
| better-auth.session_token | Citabilize authentication session — HttpOnly, Secure |
| ps_visit_id | Citabilize visitor attribution — up to 1-year TTL, Domain .primesentia.ai |
| primesentia_console | Citabilize console presence hint |
| _ga / _ga_* | Google Analytics 4 on marketing pages (G-Z0R5LWN3B7) |
| mtc_id | 360ultra / Mautic waitlist attribution on marketing pages |
§11 · Prime Sentia as Data Processor
When you submit a domain for auditing, Prime Sentia processes the content of that website on your behalf. In this context, Prime Sentia acts as a data processor and you (the customer) are the data controller for any personal data contained in that website content. You warrant that you have the legal authority to submit the domain for processing. A Data Processing Agreement (DPA) is available on request at dpo@primesentia.ai.
§12 · Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via email and/or a notice on the platform at least 30 days before taking effect. The effective date at the top of this page indicates when the policy was last updated.
Contact — Privacy & DPA requests: dpo@primesentia.ai · General legal matters: privacy@primesentia.ai
Last updated: September 15, 2026. This Privacy Policy is designed to be compliant with GDPR (Regulation (EU) 2016/679) and Spain's LSSICE (Ley 34/2002). California residents have the rights in §09, including correction; we do not sell or share personal information.