Last updated: 5 September 2026
Introduction
Lincado Ltd is committed to protecting your privacy. This policy explains how your personal information — meaning any information that identifies you, such as your name, email address or store details — is collected and used when you visit www.citorank.com (the "Website") or install and use the CitoRank app from the Shopify App Store (the "App").
Any reference to "you" or "your" means you as a visitor to the Website or a merchant using the App. Any reference to "we", "us" or "our" is to Lincado Ltd and any contractors who provide services to us in relation to the Website or the App.
This policy applies only to information we collect. It does not cover third-party websites we link to — they have their own privacy policies. By continuing to use the Website or the App, you accept this policy. We may update it from time to time; changes will be posted on this page.
Who we are
We are Lincado Ltd, a company registered in England and Wales under company number 08245344, with our registered office at Sigma House, Oak View Close, Edginswell Park, Torquay, Devon, TQ2 7FF, United Kingdom. We operate this Website and the CitoRank App.
What information do we hold and how is it collected?
From the Website
- If you email us at any of our published addresses, we keep a record of that correspondence so we can reply and handle your enquiry.
- Standard server logs — your IP address, browser type and the pages you request — collected for security and system administration. This is statistical data and is not used to identify individuals.
From the App
- When you install CitoRank, Shopify shares your store name, store domain and account contact details with us so we can provide the service.
- We import your product catalogue — titles, descriptions, prices, variants and product-page content — because analysing it is what the App does. Catalogue data is business data about your products, not personal data about your customers. We do not collect or receive your customers' personal data.
- Billing runs entirely through Shopify. We receive your subscription status and plan; we never see your payment card details.
- We keep records of your App configuration (keywords, settings, preferences) and Credit usage so the service works and your dashboard is accurate.
How do we use information about you?
Your information is used to:
- provide the service — run audits, query AI models about your products, store the results and show them in your dashboard;
- respond to enquiries and provide customer support;
- send service messages about your account (for example, Credit usage or billing notices);
- monitor, develop and improve the Website and the App; and
- investigate suspected breaches of our terms or misuse of the service.
We will only send you marketing email where you have given consent, and every such email includes an unsubscribe link. To stop receiving marketing at any time, use that link or email hello@citorank.com.
Lawful basis for processing
Under Article 6 of the UK GDPR we rely on:
- Contract — processing needed to provide the App to you under our terms, including running your audits and managing your subscription.
- Legitimate interests — replying to enquiries you send us, keeping the service secure, and improving it.
- Consent — marketing communications, where you have opted in.
Which processors do we use?
We use a small number of third-party services to deliver CitoRank:
- Shopify — app installation, authentication and all billing. See Shopify's privacy policy.
- OpenAI, Anthropic and Google — the AI model providers we query on your behalf. The queries we send contain your product and catalogue information (for example product names, categories and page content), because asking the models about your products is the service. We do not send them your account contact details.
- Google Analytics and Microsoft Clarity — website usage measurement and session replay, on this Website only (not inside the App), and only if you accept analytics cookies. See the Cookies section below.
- Hosting and infrastructure providers — who store our databases and run the service.
Some of these providers process data outside the UK, including in the United States. Where they do, we rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or UK adequacy regulations.
Will we share your information with anyone else?
We do not sell your personal information. We may pass it to other parties only as follows:
- to our employees, agents and the processors listed above, to administer the services provided to you;
- if we sell or buy any business or assets, to the prospective seller or buyer of that business;
- if Lincado Ltd or substantially all of its assets are acquired by a third party, in which case personal data held about customers will be one of the transferred assets; and
- to the police, regulatory bodies or legal advisers where required by law, or in connection with any alleged criminal offence or suspected breach of our terms.
Security — how do we protect your information?
We take all reasonable steps to protect your personal information, including encrypted connections and strict access controls. The transmission of information over the internet is never completely secure, so any transmission is at your own risk; once we have received your information we use strict procedures and security features to try to prevent unauthorised access.
If you believe you have found a security vulnerability, email security@citorank.com — reports go straight to the engineering team and we acknowledge within 48 hours.
How long do we keep your data?
We keep personal information only as long as it is needed for the purposes above. If you uninstall the App, we delete or anonymise the personal information associated with your account in line with Shopify's mandatory data-deletion requests, except where we are legally required to retain records (for example, billing records for tax purposes). Correspondence is removed no later than five years from your last interaction with us.
Access to your information, correction and your other rights
You have the right to request a copy of the information we hold about you, to have inaccurate information corrected, and — in many circumstances — to have it erased, restricted or ported to another provider. You may also object to processing based on legitimate interests.
To exercise any of these rights, email hello@citorank.com or write to us at the registered office address above. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.
Cookies
A cookie is a small amount of data sent from our server, or by a service we use, and stored on your device. This Website sets the following cookies:
| Cookie name |
Purpose |
Expiry |
| ASP.NET_SessionId |
Strictly necessary. Basic session management used by ASP.NET, essential for the site to work |
20 minutes |
| citorank_consent |
Strictly necessary. Remembers whether you accepted or rejected analytics cookies, so we don't ask again on every page |
6 months |
| _ga |
Analytics — only set if you accept. Google Analytics: distinguishes one visitor from another so we can count visits and see which pages are read |
2 years |
| _ga_NYB2M97QZR |
Analytics — only set if you accept. Google Analytics: keeps track of the current visit for this website's Analytics property |
2 years |
| _clck |
Analytics — only set if you accept. Microsoft Clarity: links your page views together so a session can be replayed as one visit |
1 year |
| _clsk |
Analytics — only set if you accept. Microsoft Clarity: identifies the current session |
1 day |
| MUID, CLID, ANONCHK, SM, MR |
Analytics — only set if you accept. Set by Microsoft on the clarity.ms domain when Clarity runs. Microsoft also uses MUID for its own advertising and analytics products — see Microsoft's privacy statement |
Up to 1 year |
We use Google Analytics 4 to understand how this Website is used: which pages people read, roughly where they arrive from, and which links they follow. We look at that data in aggregate and do not use it to identify individual visitors.
We also use Microsoft Clarity, which records how pages are used — mouse movement, clicks, scrolling and the pages you view — and replays those sessions back to us as anonymised recordings, so we can see where people get stuck. Clarity masks text input by default, so what you type into forms is not captured. We do not run advertising or re-targeting tags of our own, and we have not enabled Google's advertising features; note however that Microsoft sets its own MUID cookie when Clarity runs and uses it across its products, including advertising. Read Microsoft's privacy statement and Clarity's documentation for more.
Analytics cookies are not set unless you agree to them. When you first arrive we ask. Until you accept, Google Analytics runs in a restricted mode that stores nothing on your device, and Microsoft Clarity is not loaded at all — no recording takes place and no request is made to Microsoft. If you accept, we remember that for six months and then ask again. You can change your mind at any time — rejecting is exactly one click, the same as accepting:
(also available as “Cookie settings” in the footer of every page)
If you withdraw consent we stop the recording, delete the analytics cookies set on this domain, and load nothing further — but the cookies Microsoft set on clarity.ms are on their domain, so clear those through your browser if you want them gone. You can also refuse analytics cookies through your browser settings, install Google's opt-out browser add-on, or use Clarity's opt-out page, without affecting how the Website works. Refusing the essential cookies may stop parts of the Website working. Most browsers accept cookies automatically, but you can set yours to refuse them or to show you when one is set — to learn more, see allaboutcookies.org.
Changes to this policy
Any changes we make to this privacy policy will be posted on this page and, where the changes are significant, notified to you by email.
Contact details
Questions, queries or complaints: hello@citorank.com, or write to Lincado Ltd, Sigma House, Oak View Close, Edginswell Park, Torquay, Devon, TQ2 7FF, United Kingdom.
We have notified the Information Commissioner's Office about our data processing activities under registration number Z3610297.