Privacy policy

§ 1

Who is responsible

Citerra is run by Citerra GbR, a partnership of Fadi Al Eliwi, Fares Al Eliwi, Mauro Maus and Yefan Jiang. Its address is c/o Collective Incubator, Jülicher Straße 209q/s, 52070 Aachen, Germany. That partnership is the controller for the data described on this page. For any privacy question or request, write to contact@citerra.de.

§ 2

What Citerra collects

An account needs an email address and a name, and a waitlist place needs an email address. Without them Citerra cannot sign you in or send the emails you asked for. Nothing else is required.

Waitlist

The email address entered in the waitlist form, plus a record of the consent it was given under. That record is the time, the page, the wording shown, and the IP address the form was sent from. The IP address is deleted after 1 year. Every waitlist email carries a link that stops them. The record of an unsubscribe is kept for 3 years as proof the request was honoured, then deleted. A signup never confirmed is deleted after 30 days.

Newsletter

If you subscribe on the updates page, your address and the same consent record as above, kept and deleted on the same schedule. The list itself is held by Resend, who send the messages. Every message carries a link that removes you, and a request to contact@citerra.de does the same.

Contact form

The name, email address, organization if given, topic and message entered in the contact form. Citerra stores the request in the application database and sends a copy to its own inbox through Resend. Citerra deletes the request 2 years after it was sent. The IP address the form was sent from serves a rate limit only. It is never stored with the message and is deleted within 14 days.

Account

Your email address, name, and organization membership, managed by the authentication provider Clerk.

Content

The documents, source files, uploaded PDFs, and library data you create inside the application, including notes, annotations, AI conversations, generated analysis, and search indexes. Citerra treats this content as confidential, because it can include unpublished research, and it is readable only inside the organization that owns it.

Diagnostics

Error reports with personal data removed. Citerra sets no advertising trackers and never session-records editor surfaces.

§ 3

Why it is processed

Each purpose below names the lawful basis it relies on and the GDPR article behind it. No decision about you is made by automated means alone.

Providing the service (contract, Art. 6(1)(b) GDPR)

Storing and compiling documents, searching literature, and managing citations.

Running the AI features you ask for (contract, Art. 6(1)(b) GDPR)

Citerra sends selected text and retrieved library excerpts to the model provider when an AI action runs. Citerra does not opt API content into model training.

Making a source searchable (contract, Art. 6(1)(b) GDPR)

Citerra splits a source added to a document's library into passages and sends them once to the model provider. The provider returns the index the assistant later retrieves from. This happens when the source is added, not when a question is asked.

Keeping the service reliable and secure (legitimate interest, Art. 6(1)(f) GDPR)

Error monitoring, rate limiting, and abuse prevention.

Answering a message sent through the contact form (contract, Art. 6(1)(b) GDPR, where it prepares or concerns a contract; otherwise legitimate interest, Art. 6(1)(f) GDPR)

Citerra reads the message, replies to the address given, and keeps the exchange to follow it up.

Sending the waitlist and newsletter emails you asked for (consent, Art. 6(1)(a) GDPR)

Consent can be withdrawn at any time through the link in every message, with effect for the future.

§ 4

Where it is stored

Citerra hosts the application database and the files it generates in the EU (Ireland). LaTeX compilation runs in the EU (Frankfurt), on machines that keep no state once a job finishes.

Not every provider in the next section operates inside the EU. The table names where each one operates.

Some providers operate in the United States. For each of them, the transfer rests on the Standard Contractual Clauses of the European Commission (SCCs), contained in that provider's data processing agreement. The table names the providers whose agreement is not yet in force. The clauses are published by the European Commission, and each provider agreement is available on request.

§ 5

Who else processes it

Each provider below handles one slice of the data, and nothing beyond it.

An organization can point Citerra at its own model endpoint, in which case the assistant's answers are generated there instead of at OpenAI. Indexing a source and retrieving from it still reach OpenAI.

OpenAI may retain API content in abuse-monitoring logs for up to 30 days, unless applicable law requires longer retention. Citerra is not approved for zero data retention, which would remove that window.

Citerra queries public indexes: OpenAlex, arXiv, Europe PMC, Crossref, Semantic Scholar and Unpaywall. Searching the literature sends OpenAlex, arXiv, Europe PMC and Semantic Scholar the search terms. Importing or resolving a source sends Crossref, Semantic Scholar and Unpaywall that DOI or title. The assistant's web search sends Brave Search the terms it looks up. All of them are hosted in the United States, except Europe PMC in the United Kingdom. These receive the query, never the document. They process no personal data on Citerra's behalf, which is why the table above does not list them.

§ 6

How long it is kept

Citerra keeps organization data for the lifetime of the organization, plus 30 days after deletion is requested. Citerra then removes it permanently, including uploaded files and search indexes. An organization admin can cancel deletion at any point during those 30 days. That window belongs to the deletion of an organization. A request to erase your own personal data, sent to contact@citerra.de, does not wait for it.

Turning AI off stops new AI processing and hides AI features. It does not delete existing conversations, generated analysis, attachments, or search indexes. An organization admin can delete that retained AI data separately while AI is off. Documents, sources, accepted edits, annotations, and operational usage records remain.

Model-request metadata contains model names, token counts, latency, and identifiers, not prompt or response text. Citerra retains it for 90 days for security, billing, and service measurement.

Citerra removes export bundles and compiled artifacts prepared for download within 24 hours.

Vercel keeps the server logs of requests to citerra.de and the application, including the IP address, for 1 hour.

Citerra keeps a contact form request for 2 years after it was sent, then deletes it. Waitlist and newsletter retention is stated with each of them above.

§ 7

Your rights

Access and portability

An organization admin can export all organization data as a zip from the organization settings page. Anyone else writes to contact@citerra.de, including a member without that role, a waitlist subscriber or a contact form sender. They receive a copy of the data Citerra holds about them (Art. 15 and 20 GDPR).

Erasure

An organization admin can delete retained AI data while keeping the organization. The same admin can schedule deletion of all organization data, with the 30-day grace window described above. Anyone can ask contact@citerra.de to erase the personal data Citerra holds about them (Art. 17 GDPR). That includes a waitlist entry or a contact form request. Citerra erases it unless a legal retention period applies, and names that period if it does.

Rectification and restriction

Write to contact@citerra.de to correct account data or to restrict processing.

Objection

Where processing rests on legitimate interest, you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). Write to contact@citerra.de.

Complaints

Complaints go to the supervisory authority for Citerra or to the authority of your own place of residence. For Citerra that is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, poststelle@ldi.nrw.de.

§ 8

Changes to this policy

Material changes are announced on this page at least 30 days before they take effect, with the date at the top updated to match.

§ 9

Governing language

This policy is published in English and in German, and both versions describe the same service.

The English version governs until counsel has reviewed both texts. Where the two differ before that review, the English wording applies.