Privacy Policy

1. Controller and contact

Stefan Müller is responsible for this installation and operates it from Gothenburg, Sweden. Contact the operator at hello@citet.eu. Postal contact details are in the operator notice. An institution running a separate installation is responsible for that installation.

2. Account and university sign-in

We store your email address, verification status, display name, profile image when supplied, sign-in provider and account identifier, sessions, and authentication tokens. Stored OAuth access and refresh tokens are encrypted. Session records can include the IP address and user agent used to sign in. Security events record authentication outcomes, account changes, and access revocations, using timestamps, component names, internal account identifiers, and failure categories. When this installation uses a trusted reverse proxy, a keyed hash of the source IP address helps correlate suspicious requests. Security events exclude passwords, tokens, cookies, document contents, and full SAML assertions. Internal account identifiers remain in security records until their retention period expires, including after account deletion. This data lets us identify you, secure your account, and show your identity to collaborators. Account data is necessary to use authenticated features; without it we cannot create a session.

For university sign-in, your institution supplies a stable subject identifier, email address, and name. We store an account reference derived from the institution and subject identifiers, plus your email and name. We do not receive your university password or store the full SAML assertion in your account. Additional affiliation and assurance attributes are not stored or used to assign project roles. An email match alone never links accounts.

University login correlation records expire after ten minutes and are removed after use or during subsequent login cleanup. Signed institution metadata is cached for up to four hours. Your institution remains responsible for its own authentication processing.

3. Documents and collaboration

We store project files, compiled output, source revisions, collaboration updates, membership, invitations, comments, and activity needed to provide the editor. Presence and cursor information identifies connected collaborators. Project files and presentations are accessible to authorized project members. Collaborators can download their own copies.

Account deletion removes account records and projects you own. Cleanup of stored files, object versions, compiled output, and backups made by Citet is queued before the account is removed. Other people's projects remain. Ownership of a shared organization is transferred to a remaining member when needed. Your comments and invitation records are removed. Contributions already incorporated into someone else's document can remain there. Contact hello@citet.eu for an erasure request concerning that data.

4. Optional integrations and AI

Zotero connections store a library reference and API credential to read the library you authorize. Disconnecting removes the connection; citations already added to a project remain. Google Drive backups store encrypted access and refresh credentials and folder references. Backup archives are ordinary ZIP files; Citet does not encrypt their contents before upload.

When you configure and use an AI provider, your prompts and the project text, files, and tool context selected for the task are sent to that provider. Citet stores conversation and run history with the project. Provider credentials are encrypted in the database. AI features can read or change project content as part of the task you request. Your provider's privacy and retention terms apply to data it receives; check them before sending confidential data.

Connections are optional and can be removed in account or project settings. Disconnecting stops future access, but does not remove copies already delivered to another service or revoke credentials at that service. Delete those copies or revoke access there when needed.

5. Hosting, recipients, and contact email

STRATO GmbH hosts the application, PostgreSQL database, and object storage in Germany. Authorized collaborators receive project content and your collaborator identity. Google and your institution process authentication when you choose their sign-in methods. Zotero, Google Drive, and your chosen AI provider receive data when you use those integrations. If invitation email is enabled, its delivery provider receives the recipient, inviter, project name, role, and link.

For the citet.eu hosted service, contact email is received by STRATO and forwarded to the operator's Gmail inbox. STRATO and Google therefore process your email address, message, attachments, and delivery metadata. Correspondence is kept while the request is being handled and for necessary follow-up or a specific legal obligation; unnecessary correspondence is deleted. Avoid sending confidential research data or credentials by email.

6. Purposes and legal basis

Account authentication, document storage, editing, collaboration, compilation, and optional functions you request are processed to provide the service under Article 6(1)(b) GDPR. Security, abuse prevention, operational diagnostics, and handling support requests rely on our legitimate interest in a secure, reliable service under Article 6(1)(f). Data required to comply with a specific legal obligation is processed under Article 6(1)(c). We do not sell personal data, use it for advertising, or make automated decisions with legal or similarly significant effects.

7. Transfers outside the EEA

Core hosting is within the EEA. Google email handling and external sign-in, backup, citation, or AI providers can process data outside the EEA. Locations and safeguards depend on the provider and account used. Contact hello@citet.eu for details of a particular recipient, transfer, or the applicable safeguards. User configuration of an integration does not itself establish a transfer safeguard. This notice does not claim that contractual safeguards have been concluded with every provider.

8. Retention and deletion

• Account and connection records: until account deletion or disconnection. Expired sessions cannot authenticate you and are removed by authentication cleanup.
• Project data and revision history: while the project exists. Archiving hides a project; permanent deletion queues database and storage cleanup.
• Deletion jobs: file references and any encrypted backup credential needed for cleanup remain during retries and are removed from the job on success. Failed cleanup needs operator intervention; the project remains inaccessible while this is resolved.
• Operational container logs: rotated by size, with up to three files of ten megabytes per container on citet.eu. Retention time depends on log volume; there is no fixed fourteen-day deletion rule.
• Security events and monitoring alerts: retained for 30 days. The maintenance worker checks once per minute and deletes expired records. If maintenance is unavailable, cleanup resumes when it recovers. Evidence needed for a specific incident may be copied into a restricted incident record and kept only as long as necessary to investigate it or meet a legal obligation.
• Copies you export, collaborators retain, or external providers retain independently: controlled by the recipient. Citet cannot erase copies outside its access.

9. Your rights

Subject to the GDPR's conditions, you can request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. Send requests to hello@citet.eu. We respond without undue delay and within one calendar month. Where the GDPR permits an extension for a complex request, we explain the reason within that first month.

You may complain to your local supervisory authority or Sweden's Integritetsskyddsmyndigheten (IMY).

10. Browser storage and changes

We use necessary authentication cookies and browser storage for preferences and cached documents. We do not use advertising or analytics cookies. See the Cookie Policy. This notice is updated when processing changes; the date below identifies this version.

Last updated: 2026-10-01.