Privacy Policy

1. Data Controller

The data controller is Seowp Wojciech Władziński, ul. Nieborowska 36, 80-034 Gdańsk, Poland, NIP: 9840163453 - owner of the CitationOne service available at app.citationone.com.

2. Data We Collect

We collect only the following data:

• Email address - provided during registration/login, used for authentication and account identification
• Google account data (when using Google OAuth login) - email address and Google account identifier (sub). We do not collect profile photos or other profile fields
• Referral program data (if you participate) - your unique referral code, information about which User referred a given account, and accrued commissions. To pay out commissions, you may voluntarily provide additional data (e.g., bank transfer or invoice details). The referrer sees their referrals only in masked form (without the full email address)
• Company branding data (optional) - company name and logo that you may voluntarily add in Settings to brand your reports
• Audit data - URLs, content of analyzed pages, keywords, and optional project labels that you enter in the tool

We do not collect names, surnames, addresses, phone numbers, or other personal data beyond those listed above.

3. Purpose of Data Processing

We process your data for the purpose of:

• Creating and maintaining a user account
• Authentication - one-time verification codes (OTP) sent via email, or login via Google OAuth
• Assigning audits to the user account
• Account-related communication (e.g., feedback notifications)
• Operating the referral program - attributing referrals, calculating and paying out commissions (if you participate)
• Sending new feature announcements and tool updates - only with separate, optional consent

4. Legal Basis

We process data based on:

• Art. 6(1)(a) GDPR (consent) - given during registration by accepting this Privacy Policy - for account creation and tool usage
• Art. 6(1)(a) GDPR (separate consent) - optional marketing communication consent, given via a separate checkbox during registration or in Account Settings. You can withdraw this consent at any time in Settings or by clicking the “Unsubscribe” link in the footer of every marketing message

5. Cookies and Analytics

The Service uses:

• Session cookies (httpOnly) - store a JWT token to maintain the login session (7 days)
• Affiliate cookie (co_ref) (httpOnly) - set when arriving via a referral link; stores the referrer's code for 30 days to attribute the referral after sign-up. Contains no personal data
• Google Tag Manager (GTM) - analytics tag management
• Google Analytics 4 (GA4) - traffic and user behavior analysis (anonymous data: pages visited, session duration, events)
• Vercel Analytics - privacy-friendly traffic analytics (anonymized data, no user identification)

GA4 may collect data such as approximate location (country/city), device type, browser, and operating system. This data is anonymous and does not allow direct user identification.

We use a Consent Management Platform that lets you accept or reject analytics cookies. Analytics scripts run in accordance with your choice.

6. Third-Party Services

To provide our service, we use the following providers:

• Google (OAuth) - authentication via Google Sign-In (Google receives login information for our service, we receive the email and account identifier)
• Resend - sending emails: verification codes, account notifications, and - subject to separate consent - marketing messages (we share the email address)
• Lemon Squeezy - payment processing as Merchant of Record (receives email, billing data, and buyer's country for VAT purposes). See Terms of Service, section 5
• Neon (PostgreSQL) - storing account and audit data (EU servers)
• Vercel - application hosting and privacy-friendly traffic analytics (Vercel Analytics) (EU/US servers)
• Google Gemini API - content analysis during audits (we share the audited page content, not personal data)
• Bright Data - fetching web page content and Google search results (no personal data shared)
• DataForSEO - keyword search volumes and competitor backlink profile data (no personal data shared)
• Jina Reader - optional fallback for fetching page content (no personal data shared)

7. Data Retention Period

We retain data for as long as the account exists. Upon account deletion, all associated data (email, audits, results) is permanently removed from the database. The exception is billing data (payment records) and referral-program commission data, which we retain for the period required by tax and accounting law.

8. Your Rights

Under GDPR, you have the right to:

• Access your data
• Rectify your data
• Erase your data (“right to be forgotten”)
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority (President of UODO in Poland)

To exercise these rights, please contact the data controller.

9. Security

We apply appropriate technical and organizational measures: encrypted connections (HTTPS/TLS), hashed session tokens (JWT with HS256), one-time verification codes instead of passwords, and access restrictions (admin/user roles).

10. Contact

For matters related to personal data protection, please contact the data controller: Seowp Wojciech Władziński, ul. Nieborowska 36, 80-034 Gdańsk, Poland, email: kontakt@citationone.com.