Privacy Policy

Kitea is a search-visibility platform operated by Simple Optimum Solutions ("Simple OpS", "we", "us"). Kitea is provided to businesses ("Customers") to manage their own websites, business listings, and marketing channels.

This policy covers kitea.ai and the Kitea application. Questions: support@kitea.ai.

Account information. Name, email address, business name, business address and locations, industry, and billing details. Payment card data is collected and stored by Stripe, never by us.

Connected-account data. When you authorize a connection, we access data from that account strictly to operate the features you enabled. This includes search performance and analytics data, business-listing content and reviews, social page content, and content management system posts and media.

Your published content. We read your website's public pages and existing posts to build the writing-style profile used to draft new content in your voice.

Content we generate. Drafts, published posts, reports, and a full log of every action taken on your behalf.

Free audit requests. When anyone submits a domain for a free audit, we record the domain, publicly available data about it, and a one-way hash of the requester's IP address for rate limiting. The hash is deleted after 7 days.

Report requests. Asking us to email the full report means giving us an email address. We use it to send that report and nothing else. Report requests are deleted after 30 days.

Usage data. Standard server logs, and application error reports via Sentry with personal data scrubbed.

Kitea's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We request read access to Google Search Console and Google Analytics, and management access to your Google Business Profile, only for accounts you explicitly connect.

• We use this data solely to provide and improve the user-facing features you enabled — reporting, content generation, and publishing you have authorized.

• We do not transfer this data to third parties except as necessary to provide those features, comply with applicable law, or as part of a merger or acquisition with notice to you.

• We do not use this data for advertising, and we do not sell it.

• We do not allow humans to read this data, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized.

Kitea requests no restricted Google scopes. We do not request access to Gmail, Drive, or any other restricted scope, and we do not read your email.

You can revoke Kitea's access at any time from your Google Account permissions page or from within Kitea. Revoking access stops the affected features immediately.

• To operate the features you enabled: auditing, tracking, content generation, publishing, citation building, and reporting.

• To generate drafts in your voice, using your own published material as the reference. Your content is used only for your account and is never used to train third-party models or to serve other customers.

• To bill you, support you, and notify you about your account.

• To detect and prevent abuse of the free audit and the platform.

We do not sell, rent, or trade personal information, and we do not use behavioral advertising.

We use the following providers, each processing data only as needed to deliver Kitea:

• Google Cloud and Firebase — application hosting, database, and key management.
• Vercel — web hosting and delivery.
• Anthropic — content generation. Data sent for generation is not used to train Anthropic's models.
• DataForSEO — search-ranking, keyword, and backlink data.
• Stripe — subscription billing and payment processing.
• Amazon Web Services (SES) — transactional email delivery.
• Sentry — error monitoring, with personal data scrubbed.
• Cloudflare (Turnstile) — the check that the free audit is requested by a person, not a bot. It sees the requester's browser and IP address.
• Microsoft — Bing Webmaster Tools data, read-only, for accounts you connect.

Meta, LinkedIn, Apple, your CMS, and — for redirects — your GitHub repository, Cloudflare or Vercel account receive only changes made to your own accounts at your direction: either approved by you item by item, or through automation you switched on for that channel. Automation is off unless you enable it, is enabled per channel rather than globally, and can be switched off at any time, which returns that channel to item-by-item approval. One exception: when Kitea itself moves a page to a new address, it redirects the old address to the new one without asking, because both addresses are known and leaving the old one broken would lose its search ranking.

We do not hand over your data to a government body, law-enforcement agency, or regulator simply because it is asked for.

Every such request goes to a single reviewed address, is checked for legal validity, authority, specificity and proportionality, and is challenged where we find it unlawful or overbroad. Where we are lawfully required to disclose, we disclose the minimum that satisfies the request and nothing more, and we notify you beforehand unless we are legally prohibited from doing so.

The full policy, including how we document each request, is published at [kitea.ai/government-requests](/government-requests).

Kitea serves medical, dental, and aesthetic practices, and is designed to operate entirely outside the scope of protected health information.

• Kitea does not connect to electronic medical records, practice management systems, or any patient database.

• Review responses drafted by Kitea never confirm that someone is a patient and never reference treatment details. This is enforced by an automated check before any draft reaches you.

• Outreach features require a dedicated marketing mailbox, never a clinical inbox, so Kitea never holds credentials to an account carrying patient correspondence.

• Customers must not submit protected health information to Kitea. Free-text fields are screened and obvious patient identifiers are rejected.

Kitea is not a HIPAA business associate and does not enter business associate agreements for this service.

Credentials. Access tokens and API keys are encrypted with a per-customer key using envelope encryption backed by Google Cloud Key Management Service. They are decrypted only at the moment of use, for a single customer.

Isolation. Customer data is stored under a per-customer path, and every read is scoped to the authenticated session's customer. Requests are never scoped from a client-supplied identifier. Automated tests assert that one customer cannot read another's data, and they run on every change.

Access. Simple OpS personnel do not access connected-account data except as described in section 3.

No system is perfectly secure, but we will notify affected Customers without undue delay if a breach affecting their data occurs.

We retain account and content data for as long as your subscription is active.

Export. You can download everything we hold for your account at any time, from Settings → Data, including after cancelling and until the account is deleted.

Credentials for your connected accounts are destroyed immediately when you disconnect a channel or your subscription ends.

When your subscription ends, the rest of your account data is deleted 30 days later. We email you when the subscription ends and again a week before deletion. Resubscribing before then keeps your data; connected accounts need reconnecting, because their credentials were destroyed when the subscription ended.

If a payment fails, our payment processor retries it over two weeks while Kitea keeps working. We email you a week in and again two days before the end. If payment still fails, your subscription ends and the 30-day period above begins.

If you ask us to delete your account from Settings → Data, the subscription is cancelled and the account deleted immediately. You can also email support@kitea.ai; we confirm within two business days and delete it then.

Backups. We keep daily backups for 30 days, so deleted data is gone from them within 30 days of leaving our live systems. A backup is never used to restore an account whose owner asked for it to be deleted.

What we keep. Records we must retain for tax and accounting — your invoices — are held by our payment processor, Stripe, and are not deleted with your account.

Free audit results are kept for 30 days and then deleted.

To request access, correction, export, or deletion, contact support@kitea.ai.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. We honor these requests regardless of jurisdiction. We will not discriminate against you for exercising them.

Kitea is not directed to children and we do not knowingly collect information from anyone under 18.

We will post any changes to this policy on this page and update the date above. Material changes affecting how we handle connected-account data will be notified by email before taking effect.