Privacy policy and Google data use
Last updated: June 26, 2026. This page explains CitationGraph core privacy policy for public-site inquiries, invite requests, connected-site telemetry, and Google user data received through Google Analytics, Google Search Console, and Google Ads connections, including GravityAds ads analytics and optimization features available through gravityads.dev, plus region-specific disclosure notes where local law may require more detail.
Who we are
CitationGraph is operated by Gravity Technology. For privacy inquiries, contact analytics@gravity.dev. This entity acts as the data controller (or equivalent under applicable law) for personal data collected through this website and the hosted product.
Public website and inquiries
The public CitationGraph website exists to explain the product, link to the dashboard, and provide reference material. If you join the waitlist, request access, or contact the team, the information you submit is used only to respond to that request and support follow-up communication.
CitationGraph and GravityAds
CitationGraph includes GravityAds, an ads analytics and optimization module available through the gravityads.dev product portal. Google Ads data connected through GravityAds is governed by this CitationGraph Privacy Policy.
Google Analytics, Search Console, and Google Ads connection scopes
When a customer connects Google Analytics 4, CitationGraph requests the Google OAuth scope https://www.googleapis.com/auth/analytics.readonly. When a customer connects Google Search Console, CitationGraph requests the scope https://www.googleapis.com/auth/webmasters.readonly. These scopes provide read-only access to reporting data for the selected GA4 property and verified Search Console sites. When a customer connects Google Ads through GravityAds, CitationGraph requests https://www.googleapis.com/auth/adwords because the Google Ads API uses this scope for Ads account and reporting access. In this verification process, CitationGraph and GravityAds do not create, edit, pause, or delete campaigns, change budgets or bids, manage users, or modify account settings. CitationGraph does not request Gmail, Google Drive, Google Calendar, or other unrelated Google permissions.
Data Accessed: Google user data we read
For a connected GA4 property, CitationGraph accesses Google Analytics reporting data authorized by the user, including GA4 property ID, sessions, users, traffic sources, referrers, campaign/source/medium breakdowns, daily trends, bounce rate, engagement rate, add-to-cart totals, ecommerce purchases, conversion totals, and revenue totals when those metrics are available through the GA4 Data API. For a connected Search Console site, CitationGraph accesses Search Console data authorized by the user, including verified site URL, query, page, date, country, device, search type, clicks, impressions, click-through rate, and average position. For a connected Google Ads account, CitationGraph and GravityAds access only Google Ads data authorized by the signed-in user, including accessible customer/account identifiers, account names, currency and time zone, manager or child account relationships, campaigns, ad groups, ads, keywords, search terms, budget and bidding metadata, dates or segments, and performance metrics such as cost, impressions, clicks, conversions, conversion value, CTR, CPC, CPA, and ROAS. CitationGraph also stores connected property/site/account identifiers and OAuth refresh tokens needed to maintain the user's Google connections.
Data Usage: how we use Google user data
CitationGraph uses connected Google data only to provide user-facing analytics and reporting features. Google Analytics and Search Console data power dashboard reporting, after-click AI traffic analysis, AI/referral attribution validation, source comparison, ecommerce performance summaries, search visibility analysis, query and page diagnostics, content opportunity analysis, GEO/SEO recommendations, and customer-requested reports for the connected site. Google Ads data connected through GravityAds powers ads reporting, attribution, campaign diagnostics, pacing analysis, optimization insights, and customer-requested performance reports inside the user's workspace. CitationGraph does not use Google user data for advertising targeting, sale, surveillance, or generalized AI or machine-learning model training.
Legal bases for processing
Where a legal basis is required, CitationGraph relies on: (a) pre-contractual steps for waitlist and access requests; (b) contract performance for Google reporting data connected by customers; (c) legitimate interests for product improvement and security monitoring; (d) consent where specifically required by applicable cookie or tracking law. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Cookies and tracking technologies
The public CitationGraph website does not set advertising or cross-site tracking cookies. Essential cookies may be used for language preference and session continuity. The hosted product may use functional cookies necessary for authentication, workspace state, and dashboard rendering. CitationGraph does not participate in third-party ad networks or cross-context behavioral tracking.
Storage and retention
CitationGraph stores connected GA4 property IDs, Search Console site identifiers, Google Ads account identifiers, and OAuth refresh tokens while the connections remain active. OAuth refresh tokens are encrypted at rest and used only to refresh the authorized Google connection for the workspace. Synced GA4, Search Console, and Google Ads summaries may be cached or persisted inside the hosted product so the connected workspace can render reports. Analytics event records and imported reporting snapshots in the hosted product are deleted according to the configured retention policy, which is 90 days by default. You may also request deletion of connected Google reporting data.
Data protection and security mechanisms for sensitive data
CitationGraph uses security procedures designed to protect the confidentiality, integrity, and availability of Google user data and other sensitive data. Data in transit between users, CitationGraph services, and Google APIs is encrypted with TLS 1.2 or higher. Data stored in the hosted product is encrypted at rest using Google Cloud default encryption, and OAuth refresh tokens and API credentials are stored in encrypted form. Access to connected Google reporting data is restricted to authorized personnel and service components on a least-privilege basis, administrative access is logged and auditable, and secrets are not exposed in client-side code or application logs. Infrastructure, database, and hosting providers that process data for CitationGraph do so under confidentiality and security obligations.
Retention schedule
Waitlist submissions: retained until the request is fulfilled or withdrawn. Contact form data: retained for up to 12 months after the last interaction. Google OAuth refresh tokens for GA4, Search Console, and Google Ads: deleted within 7 days of disconnection. Synced GA4, Search Console, and Google Ads report data: deleted per workspace retention policy (default 90 days). Server logs: retained for up to 30 days for security and debugging.
Sharing and Limited Use
CitationGraph does not sell Google user data and does not share connected Google Analytics, Search Console, or Google Ads reporting data with unrelated third parties for advertising. Google reporting data may be processed by hosting, database, or infrastructure providers that operate CitationGraph on our behalf and under contractual confidentiality and security obligations. CitationGraph's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
International data transfers
CitationGraph is hosted on Google Cloud (asia-northeast1 region). Data may be processed in jurisdictions where Google Cloud infrastructure operates. Where data is transferred outside the EEA or UK, CitationGraph relies on Google Cloud data processing terms, which include Standard Contractual Clauses or equivalent safeguards recognized under applicable law.
Revocation and deletion
A connected customer can disconnect GA4, Search Console, or Google Ads inside CitationGraph or GravityAds settings to stop future syncs. Access can also be revoked from the customer Google account permissions. If you need assistance deleting connected Google reporting data, contact CitationGraph through the contact page or at analytics@gravity.dev. Deletion requests will be processed within 30 days.
EU, EEA, and UK notices
Where EU, EEA, or UK law applies, Gravity Technology acts as the data controller. Processing purposes, retention periods, recipients, and legal bases are described in the sections above. Individuals may exercise their rights to access, rectify, erase, restrict, object to processing, request data portability, or lodge a complaint with a supervisory authority by contacting analytics@gravity.dev.
California notices
Where California law applies, CitationGraph intends this policy to function together with a notice at collection: the categories of information collected, the purposes of use, and the rights available under applicable California privacy law. CitationGraph does not sell Google user data and does not share it for cross-context behavioral advertising. California residents may request disclosure or deletion by contacting analytics@gravity.dev.
Japan, Korea, and China notices
Where Japan, Korea, China, or similar regional laws apply, CitationGraph may need to provide more specific disclosures about items collected, purpose of use, retention, overseas processing, or entrusted processors. The applicable local-language version of this policy is provided for readability, and CitationGraph may supplement this page with region-specific notices or customer-facing disclosures when required by local law or by the implementation model. The hosted product is not currently marketed to individual consumers in mainland China.
Changes to this policy
CitationGraph may update this privacy policy from time to time. Material changes will be noted by updating the date at the top of this page. Continued use of the website or connected product after a posted change constitutes acceptance of the updated policy.
Common questions
What Google permissions does CitationGraph request?
CitationGraph requests only read-only scopes for connected reporting: https://www.googleapis.com/auth/analytics.readonly for Google Analytics and https://www.googleapis.com/auth/webmasters.readonly for Search Console. It does not request write, publish, account-admin, or site-management permissions.
Does CitationGraph use Google data for ads or model training?
No. CitationGraph does not sell Google user data, does not share it with unrelated third parties for advertising, and does not use Google user data to develop, improve, or train generalized AI or machine-learning models.
How can I stop sync or request deletion?
You can disconnect GA4 or Search Console inside CitationGraph settings, revoke access from your Google account permissions, and contact CitationGraph if you need deletion assistance for connected Google reporting data.
Do you publish separate privacy pages for every country?
Not necessarily. CitationGraph uses one core privacy policy with region-specific disclosures where local law requires more detail. If a market such as China needs a clearer local module or separate notice, CitationGraph may supplement the main policy.