Privacy notice
This text describes what personal data Citability Field Lab collects when you write through this site, what it is used for, and what rights European data-protection law guarantees you. Citability Field Lab is a research practice — there is no marketing department, no advertising stack, and no analytics that follow individuals.
Who is responsible
Citability Field Lab is a research practice that documents how AI-search systems describe and cite local businesses across US regions. For the purposes of the General Data Protection Regulation (GDPR), the controller of the personal data described below is the operator of the site aisearchoptimizations.com. For any privacy question or to exercise a right, write to contact@aisearchoptimizations.com.
What is collected
When you send the contact form, Citability Field Lab receives:
- Your name and email — so the lab can address a reply.
- An optional alternate contact channel (LinkedIn, Telegram, Signal) — only if you fill it in.
- The text you write in the "case" field: the region, business category, prompt wording, and a short note on the AI-search oddity. Only what you decide to share. Nothing is required beyond name and email.
This data is used only to answer what you wrote. You are not added to any mailing list, and your data is not shared with third parties. The lab also keeps the date and time the form was submitted, together with a SHA-256 hash of your IP address plus a salt — this protects the form against automated submissions. The IP address itself is never recorded, nor are browser fingerprints or device metadata.
What is not collected
- No tracking cookies are used. The analytics tool runs without cookies and stores no per-user identifier.
- No remarketing pixels, marketing-automation tags, or ad-network trackers are enabled.
- There is no automated profiling, and no automated decision producing legal effects on you.
- Personal data is neither sold nor transferred to commercial partners. That is not the revenue model — the lab does not have one.
Legal basis for processing
Messages sent through the form are processed on the basis of Article 6(1)(f) of the GDPR (legitimate interest — the lab's documented research activity into AI-search behaviour). The IP hash, which protects the form against abuse, relies on the same basis. Where you also send personally identifiable detail beyond the universal fields, the lab processes it on the basis of your Article 6(1)(a) consent, given by your submitting the message.
How long data is kept
- Form messages: kept for twelve months, then deleted. Messages that informed a published field note are retained as long as the note is published, with personally identifiable detail redacted.
- IP hashes: kept for 90 days — long enough for abuse protection — then deleted.
- Email exchanges: kept while the exchange is active, then deleted within twelve months of the last message.
Your rights
Under the GDPR, you can request access to your data, its rectification, erasure, portability, restriction of processing, or object to it. For any of these requests, write to contact@aisearchoptimizations.com. A reply follows within one month. If you believe the processing does not comply with the law, you have the right to lodge a complaint with the supervisory authority of your country of residence.
International transfers
The infrastructure that serves this site is located in European Union (Germany). Where additional processors (email provider) operate outside the European Union, those transfers rely on standard contractual clauses and on the safeguards published by the recipient.
Changes to this notice
This notice is updated when data-handling practices change. The "Updated" date at the top of the page marks the version in force.