1. Data Controller
The data controller is Seowp Wojciech Władziński, ul. Nieborowska 36, 80-034 Gdańsk, Poland, NIP: 9840163453 - owner of the CitationOne service available at app.citationone.com.
2. Data We Collect
We collect only the following data:
- Email address - provided during registration/login, used for authentication and account identification
- Google account data (when using Google OAuth login) - email address and Google account identifier (sub). We do not collect profile photos or other profile fields
- Referral program data (if you participate) - your unique referral code, information about which User referred a given account, and accrued commissions. To pay out commissions, you may voluntarily provide additional data (e.g., bank transfer or invoice details). The referrer sees their referrals only in masked form (without the full email address)
- Company branding data (optional) - company name and logo that you may voluntarily add in Settings to brand your reports
- Audit data - URLs, content of analyzed pages, keywords, and optional project labels that you enter in the tool
- Contact form data - email address, message content, and optionally your name if you provide it. The form works without logging in, so you may send us this data without holding an account
We do not collect surnames, home addresses, phone numbers, or other personal data beyond those listed above. We collect a first name only when you voluntarily enter it in the contact form.
3. Purpose of Data Processing
We process your data for the purpose of:
- Creating and maintaining a user account
- Authentication - one-time verification codes (OTP) sent via email, or login via Google OAuth
- Assigning audits to the user account
- Account-related communication (e.g., feedback notifications)
- Operating the referral program - attributing referrals, calculating and paying out commissions (if you participate)
- Sending new feature announcements and tool updates - only with separate, optional consent
- Replying to a message sent through the contact form
4. Legal Basis
We process data based on:
- Art. 6(1)(a) GDPR (consent) - given during registration by accepting this Privacy Policy - for account creation and tool usage
- Art. 6(1)(a) GDPR (separate consent) - optional marketing communication consent, given via a separate checkbox during registration or in Account Settings. You can withdraw this consent at any time in Settings or by clicking the “Unsubscribe” link in the footer of every marketing message
- Art. 6(1)(f) GDPR (legitimate interest) - handling correspondence: replying to a message sent through the contact form. The legitimate interest is answering a person who contacted us on their own initiative
- Art. 6(1)(a) GDPR (cookie consent) - for analytics and marketing cookies (including Microsoft Clarity and Meta Pixel), given via the consent banner shown on your first visit. These cookies are not necessary for the Service to function. You can change your choice at any time in the banner and, for Meta Pixel, additionally disable advertising profiling in your Meta account settings
5. Cookies and Analytics
The Service uses:
- Session cookies (httpOnly) - store a JWT token to maintain the login session (7 days)
- Affiliate cookie (co_ref) (httpOnly) - set when arriving via a referral link; stores the referrer's code for 30 days to attribute the referral after sign-up. Contains no personal data
- Google Tag Manager (GTM) - analytics tag management
- Google Analytics 4 (GA4) - traffic and user behavior analysis (anonymous data: pages visited, session duration, events)
- Vercel Analytics - privacy-friendly traffic analytics (anonymized data, no user identification)
- Microsoft Clarity - a behavioral analytics tool: session recordings (session replay) and click and scroll heatmaps. It sets cookies (including _clck, _clsk) and sends Microsoft information about cursor movements, clicks, scrolling, pages visited, screen resolution, device and browser type, and your IP address. Text you type into form fields is masked by default and is not included in the recording
- Meta Pixel (Facebook) - a marketing tool measuring advertising performance. It sets cookies (including _fbp) and sends Meta Platforms information about the pages you visit and about selected actions taken in the Service: signing in, creating an audit, and its completion. Along with these events Meta receives your IP address and browser identifier which - unlike our other analytics tools - may allow your activity to be linked to your Facebook or Instagram account
GA4 may collect data such as approximate location (country/city), device type, browser, and operating system. This data is anonymous and does not allow direct user identification.
Microsoft Clarity cookies are not necessary for the Service to function and only run after you give consent in the banner. Session recordings are used solely to diagnose usability issues; we do not link them to your account data. Microsoft Ireland Operations Ltd. also processes this data for its own purposes described in the Microsoft Privacy Statement, and data may be transferred to the USA under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time in the consent banner.
Meta Pixel marketing cookies are not necessary for the Service to function. Meta Platforms Ireland Ltd. acts as a joint controller for ad measurement, and data may be transferred to the USA under the EU-U.S. Data Privacy Framework. Meta's processing is described in the Meta Privacy Policy. You can object to advertising profiling in your Meta account settings or by blocking cookies in your browser.
We use a Consent Management Platform that lets you accept or reject analytics cookies. Analytics scripts run in accordance with your choice.
6. Third-Party Services
To provide our service, we use the following providers:
- Google (OAuth) - authentication via Google Sign-In (Google receives login information for our service, we receive the email and account identifier)
- Resend - sending emails: verification codes, account notifications, and - subject to separate consent - marketing messages (we share the email address). Messages from the contact form reach us the same way, together with the email address and name entered in the form
- Lemon Squeezy - payment processing as Merchant of Record (receives email, billing data, and buyer's country for VAT purposes). See Terms of Service, section 5
- Neon (PostgreSQL) - storing account and audit data (EU servers)
- Vercel - application hosting and privacy-friendly traffic analytics (Vercel Analytics) (EU/US servers)
- Google Gemini API - content analysis during audits (we share the audited page content, not personal data)
- Bright Data - fetching web page content and Google search results (no personal data shared)
- DataForSEO - keyword search volumes and competitor backlink profile data (no personal data shared)
- Jina Reader - optional fallback for fetching page content (no personal data shared)
- Microsoft Ireland Operations - behavioral analytics and session recording (Microsoft Clarity; we share your IP address, device and browser information, and a recording of your interactions with the page - see section 5). Data may be transferred to the USA under the EU-U.S. Data Privacy Framework
- Meta Platforms Ireland - advertising performance measurement (Meta Pixel; we share your IP address, browser identifier, and information about actions taken in the Service - see section 5). Data may be transferred to the USA under the EU-U.S. Data Privacy Framework
7. Data Retention Period
We retain data for as long as the account exists. Upon account deletion, all associated data (email, audits, results) is permanently removed from the database. The exception is billing data (payment records) and referral-program commission data, which we retain for the period required by tax and accounting law.
Contact form messages are not stored in the database - we deliver them to our mailbox only and keep them there for as long as the matter requires, no longer than 12 months from the last message in the thread.
8. Your Rights
Under GDPR, you have the right to:
- Access your data
- Rectify your data
- Erase your data (“right to be forgotten”)
- Withdraw consent at any time
- Lodge a complaint with a supervisory authority (President of UODO in Poland)
To exercise these rights, please contact the data controller.
9. Security
We apply appropriate technical and organizational measures: encrypted connections (HTTPS/TLS), hashed session tokens (JWT with HS256), one-time verification codes instead of passwords, and access restrictions (admin/user roles).
10. Contact
For matters related to personal data protection, please contact the data controller: Seowp Wojciech Władziński, ul. Nieborowska 36, 80-034 Gdańsk, Poland, email: kontakt@citationone.com.