1 Scope and controller
This Policy explains how (CiteClarity, we or us), processes personal information when you use https://citeclarity.co, its research workspace and related support. We act as controller for account, billing and website information. Where we process institutional research content solely on documented instructions, the applicable data processing agreement defines our processor role. Contact: [email protected].
2 Information you provide
We process account details such as email address, display name, authentication identifiers and preferences; research content such as queries, prompts, conversations, collections, notes and references; and any documents you submit through supported features. We also process support correspondence and feedback. If social sign-in is offered and selected, we receive only the identity information and permissions disclosed during that sign-in flow.
3 Usage and transaction information
We may collect IP address, device and browser details, session identifiers, timestamps, feature usage, error logs and security events. Payment providers process payment credentials under their own notices. We receive order identifiers, plan, payment status, billing contact information and limited payment metadata needed for receipts, reconciliation and fraud prevention; we do not require you to send full card numbers or security codes to support.
4 Purposes and legal grounds
We use account and research information to perform our contract: authenticate users, run searches and AI-assisted research, return sources, save work and administer subscriptions. Security, abuse prevention, debugging and proportionate service analytics rely on legitimate interests where that ground is available, balanced against your rights. Tax records and valid legal requests rely on legal obligations. Optional marketing, nonessential tracking and optional model-training use rely on consent where required. You may withdraw consent without affecting earlier lawful processing; we do not treat acceptance of service terms as blanket privacy consent.
5 AI processing and research confidentiality
Queries and the minimum source passages necessary for a requested feature may be processed by other third parties providing model and infrastructure services. Providers must be bound to documented purposes, security and applicable deletion terms. Private research content is not to be used by us or our providers for general model training without your separate, informed opt-in; declining optional training must not prevent core service use. This commitment must also be reflected in provider settings and contracts. We may review limited content to resolve your support request, investigate abuse or meet legal obligations, with access restricted to authorized personnel.
6 Private work and sharing choices
Your private notes, collections and submitted documents are not made public or added to a public literature corpus merely because you use the service. If collaboration or sharing is available, selected recipients and workspace administrators may access content according to the permissions shown. Shared links can be forwarded by recipients. Public publication records and author metadata obtained from licensed or public sources are separate from your private workspace. Do not submit identifiable participant records, patient data, confidential manuscripts or third-party secrets unless you are authorized and the selected service is suitable for that material.
7 Recipients and disclosures
We disclose necessary information to contracted hosting, AI inference, search infrastructure, authentication, payment, email, security and support providers. Institutions may receive seat administration and billing information for their workspaces, with research access governed by disclosed permissions. We may disclose information for valid legal process, protection of rights or a business transfer subject to appropriate safeguards and notice. We do not sell personal information or share it for cross-context behavioral advertising. Any future change to that practice requires advance notice and any legally required choice or consent.
Essential session, security and preference technologies support the service. Nonessential analytics or advertising technologies, if deployed, must be described in the page’s cookie settings and disabled until consent where required. Rejecting optional cookies must be as accessible as accepting them. Browser controls may also block cookies, although necessary functions may stop working. Marketing emails include an unsubscribe option; necessary account, security and transaction messages are separate. We honor legally applicable opt-out preference signals, including Global Privacy Control where required.
9 International processing
Personal information may be transferred to, stored in or accessed from countries outside your country of residence, including the United States and countries in Europe, where our service providers operate. Privacy laws in those countries may differ from those in your country. When personal information is transferred from the European Economic Area, we use a valid adequacy decision where applicable or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. Transfers from the United Kingdom use applicable UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to those clauses, as appropriate. Transfers subject to Swiss law use a recognized transfer mechanism with necessary Swiss adaptations. We assess transfer risks and apply proportionate contractual, technical and organizational measures. We rely on the EU–US Data Privacy Framework or its UK or Swiss extensions only where the recipient’s relevant certification is valid and covers the transfer. Processing in the United States remains subject to applicable federal and state privacy laws; this does not by itself establish an adequate transfer basis under European law. Contact [email protected] to request information about the safeguards applicable to your information, subject to necessary redaction.
10 Security and incident response
We use proportionate technical and organizational safeguards, including access controls, restricted staff permissions, appropriate encryption and incident procedures. No system is completely secure. We investigate suspected incidents and notify affected individuals and authorities when required by applicable law. Protect your sign-in credentials and report suspected compromise promptly.
11 Your rights and requests
Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction, objection, withdrawal of consent, and information about recipients or processing. California and other eligible US residents may also have rights to know categories and specific information, correct inaccuracies, delete information, and opt out of sale, sharing or targeted advertising, without unlawful discrimination. Where applicable, you may use an authorized agent, limit specified sensitive-information uses or appeal a denied request. Contact [email protected]; we verify identity proportionately, normally respond within one month under GDPR or 45 days under applicable US laws, and notify you of any lawful extension. You may complain to your local regulator. We do not make decisions producing legal or similarly significant effects solely by automated processing.
12 Children and changes
The service is intended for adults aged 18 or above and is not directed to children. If we learn that we collected a child’s information contrary to applicable law, we take steps to delete it. Material changes to this Policy are notified through the service or email before they take effect where required; new purposes requiring consent will not be applied retroactively without that consent.
13 Contact and regional representatives
Privacy contact: [email protected].