How Citely protects your data — and, just as important, what isn't in place yet. We describe the real state of our security, without displaying certifications we don't have.
Security is handled seriously and proportionately. Citely mostly handles product data, not payment data or customer profiles. We apply the principle of least privilege and strictly limit what the app can read and write.
The Service relies on reputable hosting and database providers. The final hosting setup is being rolled out; an option for hosting and processing in the EU is planned. The list of providers is in the Privacy Policy.
Citely requests the minimum permissions needed: read access to the catalog and limited write access to metafields in its dedicated namespace. It does not access your store's orders, customers or payments.
You stay in control: uninstalling the app revokes access and removes the added layer. Everything is additive and reversible.
To generate the structured-data layer, some catalog information is sent to an AI model provider (Anthropic), solely to produce the requested output. We select providers whose API terms exclude training on transmitted data. Citely does not train models on your data.
Catalog data is processed while your store is connected and removed on uninstall. Technical logs are kept for a short period. Retention details are in the Privacy Policy.
If you discover a security flaw, write to us at privacy@trycitely.com with the details needed to reproduce it. Please do not exploit it or disclose it publicly before we've had a chance to fix it. We acknowledge receipt and handle good-faith reports in good faith.
What we plan to strengthen as the product grows:
Security or data-protection questions: privacy@trycitely.com.
Write to us at privacy@trycitely.com — we answer directly.