1. Data Controller
The data controller is Seowp Wojciech Władziński, ul. Nieborowska 36, 80-034 Gdańsk, Poland, NIP: 9840163453 - owner of the CitationOne service, which comprises the citationone.com website and the app.citationone.com application. This Policy covers both addresses.
2. Data We Collect
We collect only the following data:
- Email address - provided during registration/login, used for authentication and account identification
- Google account data (when using Google OAuth login) - email address and Google account identifier (sub). We do not collect profile photos or other profile fields
- Referral program data (if you participate) - your unique referral code, information about which User referred a given account, and accrued commissions. To pay out commissions, you may voluntarily provide additional data (e.g., bank transfer or invoice details). The referrer sees their referrals only in masked form (without the full email address)
- Company branding data (optional) - company name and logo that you may voluntarily add in Settings to brand your reports
- Audit data - URLs, content of analyzed pages, keywords, and optional project labels that you enter in the tool
- Keys and integrations (optional) - access keys to our API (we store their hash rather than the value itself, together with the name you gave them and the date of last use), and webhook addresses to which we send notifications about completed audits
- IP address - processed transiently when the contact form is submitted, in order to limit the number of messages from a single source. We do not store it in the database
- Contact form data - email address, message content, and optionally your name if you provide it. The form works without logging in, so you may send us this data without holding an account
- Purchase data - when buying credits, you enter your first name, surname, email address and invoice details (e.g., address and, for businesses, tax ID) in the Easytools checkout. Easytools passes your first name, surname and email address to us in the purchase notification so that we can assign the purchase to your account. In the Service database we store only the email address and the transaction data: amount, number of credits and order identifier. Invoice details remain in the Easytools invoicing system
Apart from purchase data, we do not collect surnames, home addresses, phone numbers, or other personal data beyond those listed above. Outside a purchase, we collect a first name only when you voluntarily enter it in the contact form.
You can share a report through a public link. From that moment anyone who knows the address can read it without logging in - including your company name and logo, if you added them. The decision is yours: the link is created only at your request, you can give it an expiry date, and you can revoke it at any time.
3. Purpose of Data Processing
We process your data for the purpose of:
- Creating and maintaining a user account
- Authentication - one-time verification codes (OTP) sent via email, or login via Google OAuth
- Assigning audits to the user account
- Selling credits, issuing invoices, and handling payment refunds and complaints
- Account-related communication (e.g., feedback notifications)
- Operating the referral program - attributing referrals, calculating and paying out commissions (if you participate)
- Sending new feature announcements and tool updates - only with separate, optional consent
- Replying to a message sent through the contact form
4. Legal Basis
We process data based on:
- Art. 6(1)(b) GDPR (performance of a contract) - maintaining your account, authentication, running audits and other analyses, settling credits and operating the referral program. This is the primary basis for processing in the Service: without this data the service you are asking for cannot be provided
- Art. 6(1)(c) GDPR (legal obligation) - retaining billing records and commission data for the period required by tax and accounting law
- Art. 6(1)(f) GDPR (legitimate interest) - replying to a message sent through the contact form (the legitimate interest is answering a person who contacted us on their own initiative), keeping the Service secure and preventing abuse, and establishing or pursuing legal claims
- Art. 6(1)(a) GDPR (consent) - marketing communication, given via a separate checkbox during registration or in Account Settings. You can withdraw this consent at any time in Settings or by clicking the “Unsubscribe” link in the footer of every marketing message. Withdrawal does not affect the lawfulness of processing carried out beforehand, nor your use of the Service
- Art. 6(1)(a) GDPR (cookie consent) - for analytics and marketing cookies (including Microsoft Clarity and Meta Pixel), given via the consent banner shown on your first visit. These cookies are not necessary for the Service to function. You can change your choice at any time in the banner and, for Meta Pixel, additionally disable advertising profiling in your Meta account settings
5. Cookies and Analytics
The Service uses:
- Session cookies (httpOnly) - store a JWT token to maintain the login session (7 days)
- Affiliate cookie (co_ref) (httpOnly) - set when arriving via a referral link; stores the referrer's code for 30 days to attribute the referral after sign-up. Contains no personal data
- Promo code cookie (co_promo) (httpOnly) - set when arriving via a link with a promo code; stores only the code for 7 days to grant the promotional credits after logging in. Contains no personal data
- Google Tag Manager (GTM) - analytics tag management
- Google Analytics 4 (GA4) - traffic and user behavior analysis (anonymous data: pages visited, session duration, events)
- Vercel Analytics - privacy-friendly traffic analytics (anonymized data, no user identification)
- Microsoft Clarity - a behavioral analytics tool: session recordings (session replay) and click and scroll heatmaps. It sets cookies (including _clck, _clsk) and sends Microsoft information about cursor movements, clicks, scrolling, pages visited, screen resolution, device and browser type, and your IP address. Text you type into form fields is masked by default and is not included in the recording
- Meta Pixel (Facebook) - a marketing tool measuring advertising performance. It sets cookies (including _fbp) and sends Meta Platforms information about the pages you visit and about selected actions taken in the Service: signing in, creating an audit, and its completion. Along with these events Meta receives your IP address and browser identifier which - unlike our other analytics tools - may allow your activity to be linked to your Facebook or Instagram account. When you enter the Service from a Meta ad, we also store the click identifier of that ad in the _fbc cookie. It is sent to Meta along with the events and with purchase information, so that a purchase can be attributed to the ad
GA4 may collect data such as approximate location (country/city), device type, browser, and operating system. This data is anonymous and does not allow direct user identification.
Microsoft Clarity cookies are not necessary for the Service to function and only run after you give consent in the banner. Session recordings are used solely to diagnose usability issues; we do not link them to your account data. Microsoft Ireland Operations Ltd. also processes this data for its own purposes described in the Microsoft Privacy Statement, and data may be transferred to the USA under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time in the consent banner.
6. Third-Party Services
To provide our service, we use the following providers:
- Google (OAuth) - authentication via Google Sign-In (Google receives login information for our service, we receive the email and account identifier)
- Resend - sending emails: verification codes, account notifications, and - subject to separate consent - marketing messages (we share the email address). Messages from the contact form reach us the same way, together with the email address and name entered in the form
- Easytools - checkout, payment processing and issuing invoices on behalf of the Operator (collects the buyer’s first name, surname, email address and invoice details). See Terms of Service, section 7
- Neon (PostgreSQL) - storing account and audit data (EU servers)
- Vercel - application hosting and privacy-friendly traffic analytics (Vercel Analytics) (EU/US servers)
- Google Gemini API - content analysis during audits. We share the content of the audited page; if it contains personal data published within that content (for example an author's name), it reaches the provider along with it
- Bright Data - fetching web page content and Google search results. We share the addresses to fetch; the fetched content may contain personal data published within it
- DataForSEO - keyword search volumes and competitor backlink profile data (no personal data shared)
- Jina Reader - a fallback route for fetching page content, on the same terms as Bright Data
- Microsoft Ireland Operations - behavioral analytics and session recording (Microsoft Clarity; we share your IP address, device and browser information, and a recording of your interactions with the page - see section 5). Data may be transferred to the USA under the EU-U.S. Data Privacy Framework
- Meta Platforms Ireland - advertising performance measurement (Meta Pixel; we share your IP address, browser identifier, and information about actions taken in the Service - see section 5). Data may be transferred to the USA under the EU-U.S. Data Privacy Framework
7. Data Retention Period
We retain data for as long as the account exists. Upon account deletion, all associated data (email, audits, results) is permanently removed from the database. The exception is billing data (payment records) and referral-program commission data, which we retain for the period required by tax and accounting law.
One-time login codes expire after 10 minutes and are removed from the database once you log in. API keys remain on the account until you revoke them; a revoked key is retained as a hash so that the record of requests made with it stays intact.
Contact form messages are not stored in the database - we deliver them to our mailbox only and keep them there for as long as the matter requires, no longer than 12 months from the last message in the thread.
8. Your Rights
Under GDPR, you have the right to:
- Access your data and receive a copy of it
- Rectify your data
- Erase your data (“right to be forgotten”)
- Restrict processing
- Data portability - receive data processed under a contract or consent in a machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time - for processing based on consent
- Lodge a complaint with a supervisory authority (President of UODO in Poland)
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. The scores produced by the tool concern the analysed content, not the person.
To exercise these rights, please contact the data controller.
9. Security
We apply appropriate technical and organizational measures: encrypted connections (HTTPS/TLS), cryptographically signed session tokens (JWT, HMAC-SHA256) in a cookie inaccessible to scripts, one-time verification codes instead of passwords, and access restrictions (admin/user roles).
10. Contact
For matters related to personal data protection, please contact the data controller: Seowp Wojciech Władziński, ul. Nieborowska 36, 80-034 Gdańsk, Poland, email: kontakt@citationone.com.