Privacy Policy

1. Data controller

The controller of personal data is ecopywriting.pl Karol Leszczyński, Papowo Biskupie 119/18, 86-221 Papowo Biskupie, Poland, VAT ID: 9562203948. For any data protection matter contactcontact@cytado.com. This policy coverscytado.com together with the user panel.

2. What data we process

• Account — email address, password (stored only as a bcrypt hash — we never see it), your chosen interface language; when signing in with Google, also your Google account identifier. Verification codes sent by email are stored only as hashes and only until used or expired.
• Project content — the thesis topic you enter, an optional outline, and paragraphs pasted into the source finder. This is the substance of your work — we treat it as confidential and process it solely to provide the service (finding and matching sources, see section 4). We do not publish it and do not share it with other Users.
• Bibliography submitted for checking — the list of sources you paste or upload (text file or PDF). We read only the text of the bibliographic entries; we do not retain the uploaded file after the analysis. We treat this content as confidential and process it solely to verify the sources (see section 4).
• Result history — we store the results of paragraph source searches and bibliography checks together with the query, so you can return to them in the panel and so a repeated query does not have to be computed again.
• AI request log — for diagnostics and cost accounting we store the content of requests sent to the AI model (which may include the topic, outline and paragraphs above) and the model's responses, together with costs. The log is accessible only to the Service administrator and is deleted together with your account.
• API, MCP, add-in and extension requests — if you use the programming interface (including through AI tools connected to the MCP interface, the Microsoft Word and Google Docs add-ins, or the browser extension), we store the content of requests (claims, topics, outlines submitted by you or by a tool acting on your behalf) together with the call log needed for billing — endpoint, channel, time, and the number of items returned and charged. The add-ins and the extension transmit only what you submit — the selected sentence and the topic of your work — never the rest of your document or the content of pages you visit; we have no access to your Microsoft or Google account, your files or your browsing history. You can see the call log in the panel; billing records are retained for the period required by tax law.
• MCP connection diagnostics — after successful authentication, we record the arguments sent to cytado tools and their responses to investigate errors and provide technical support. This is not the full conversation in ChatGPT or another AI application: we receive only what that application sends to our tools. The diagnostic log is accessible only to the Service administrator, is retained for up to 30 days and is deleted earlier if you delete your account. Recognised credentials are masked; oversized entries may be truncated. This log is separate from billing records. The legal basis is our legitimate interest in maintaining a reliable service and resolving technical problems (Art. 6(1)(f) GDPR).
• Google user data (Google Docs add-on). The add-on accesses Google user data solely through Google Workspace APIs and solely to provide its single user-facing feature — finding a verified source for a sentence and inserting a citation footnote. What we access: the text of the sentence you select in the currently open document, and — transiently, within Google's Apps Script environment — the document body, only to locate the position at which to insert the footnote; we never access your other Drive files, your Google account profile or your e-mail. How we use it: the selected sentence (and the topic you type) is sent to our servers to match it against academic publications; the document body is processed entirely within Apps Script and never reaches our servers.Transfer: we do not sell or share Google user data with third parties; to perform the matching, the selected sentence is processed by our AI subprocessor (Anthropic's Claude API), whose commercial terms prohibit using customer data to train models. Raw or derived Google user data is never transferred to any service that would use it for advertising, lending, data brokering or model training.Protection: all transmission is TLS-encrypted; access tokens are stored only as cryptographic hashes; access to production data is limited to the Service administrator. Retention and deletion: submitted sentences are retained in the request log for billing transparency and are deleted together with your account; you can delete your account at any time in the panel, and you can revoke the add-on's access instantly by deactivating its key (Account → API) or in your Google account security settings. The use of raw or derived user data received from Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements.
• Account origin and activity — when you create an account we record where you came from: campaign parameters from the address (utm_*), the referring page, the first path you visited on our site, and the country derived from your browser's time zone (or, if that is unusual, from the language set in it). We do NOT determine location from your IP address and never send your IP to geolocation services. The campaign, referrer and time-zone details come from a cookie stored only with your analytics consent (section 7) — without consent the origin field stays empty and your account works exactly the same. Without consent we still derive the country alone from the Accept-Language header your browser sends with every request anyway — nothing is stored on or read from your device for this, and we keep only the two-letter country code. We also record when the account was last active (last sign-in to the panel and last use of an API key), to tell live accounts from abandoned ones. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR): knowing which channels bring users and whether an account is in use. This data is deleted together with your account.
• Payments — handled by Stripe, which is the controller of payment data (we never see or store card numbers). We receive payment confirmation and the data required for accounting. If you choose PayPal or Klarna on the payment page, the data needed for that payment (including your name, email, amount and currency) is also received by the chosen provider as an independent controller, under its own privacy policy; Klarna may assess your creditworthiness if you choose a deferred or instalment payment. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Correspondence — the content of messages from the contact form together with your email address and, if you request an invoice, the billing details you provide (name, address, VAT ID).
• Transactional email — verification codes for registration and password resets, sent via Amazon SES. We do not send marketing email.
• Technical data — standard server logs (IP address, request time) and usage counters, including a counter of free searches tied to an IP address — for security, service stability and enforcing limits.
• Analytics data — only after you consent in the cookie banner (section 7).

3. Purposes and legal bases

• creating and running your account, finding and matching sources, generating citations, exports, result history — performance of a contract (Article 6(1)(b) GDPR);
• settlements and sales documents — legal obligation (Article 6(1)(c) GDPR);
• handling correspondence and complaints — performance of a contract and the controller's legitimate interest (Article 6(1)(b) and (f) GDPR);
• service security, anti-abuse limits (including the per-IP counter), protecting forms against bots (reCAPTCHA), and the AI request log for diagnostics and defence against claims — the controller's legitimate interest (Article 6(1)(f) GDPR);
• traffic statistics — your consent (Article 6(1)(a) GDPR), which you may withdraw at any time in the cookie banner.

4. Recipients of data

We use the following providers:

• Amazon Web Services (AWS) — server infrastructure and transactional email delivery (Amazon SES);
• Stripe — payment processing (for payment data Stripe acts as an independent controller);
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal payments, when you choose them (independent controller);
• Klarna Bank AB (publ) (Sweden) — Klarna payments, when you choose them (independent controller);
• Anthropic, PBC (USA) — provider of the artificial intelligence model. Anthropic receives the content necessary to deliver the service: the thesis topic, outline, pasted paragraphs, excerpts of analysed publications, and pasted or uploaded bibliography lists (to recognise the entries). This data is not used by Anthropic to train models (API without training retention);
• Academic databases and public registers — to find and verify sources we send them queries built from your thesis topic or from the bibliography entry being checked (without any data identifying you). These are: OpenAlex, Crossref, Semantic Scholar (Allen Institute for AI), CORE, Unpaywall, DOAJ, DOAB/OAPEN, Europe PMC, Google Books, the German National Library (Deutsche Nationalbibliothek), Biblioteka Nauki (ICM, University of Warsaw), and for domain-specific sources — Statistics Poland (Local Data Bank), the Polish Parliament's legal act register, and case-law databases. These providers are established in the European Union, the United Kingdom and the United States;
• Serper (USA) — web search for publications; we send only search queries generated from the thesis topic or from the bibliography entry being checked (without any data identifying you);
• Text extraction service — the Provider's own infrastructure used to read the content and page numbering of publicly available documents; it processes document addresses and their content, not your personal data;
• Google — Google sign-in (at your choice), reCAPTCHA v3, and — subject to banner consent — traffic statistics in Google Analytics 4;
• Email hosting provider — operates the Provider's contact mailbox, which receives correspondence sent to the address in section 1.

We do not sell your data and do not share it with third parties for marketing purposes. Transfers outside the European Economic Area rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

5. How long we keep data

• account data, Projects and the AI request log — until you delete your account (you can do this yourself in the Account tab; deletion is immediate and irreversible);
• result history — until account deletion; for reusing a stored result we consider entries from the last 30 days;
• correspondence and billing details — for as long as needed to handle the matter, with accounting data kept for the period required by tax law;
• sales documents — 5 years from the end of the tax year (statutory requirement); payment history is also retained by Stripe;
• technical logs and limit counters — no longer than service security and limit accounting require;
• analytics data — according to the tool's retention setting (max. 14 months).

6. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, port it, object to processing based on legitimate interest, and withdraw consent at any time. Requests can be sent to contact@cytado.com. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) — or with the authority in your EU country of residence.

Providing data is voluntary, but without an email address you cannot create an account, and without a thesis topic we cannot search for sources. We do not take decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. Automated assessment applies to publications (how well they match a topic), not to you as a person.

7. Cookies, localStorage and Consent Mode v2

• Essential — the session cookie for signed-in users, protection of Google sign-in (state), and storage of your cookie choice, language and theme preference. The Service does not work without them; they do not require consent.
• Analytics — only with your consent. We operate in Consent Mode v2: analytics is disabled by default and no analytics cookies are stored until you click “Accept” in the banner. You can withdraw consent at any time (“Cookie settings” in the footer). A choice made on the public site also applies inside the panel. This category also covers our own cytado_zrodlo cookie (90 days): it remembers where you came from and is read only at the moment you create an account (section 2). It is set only after you click “Accept”, is never used for profiling or advertising, and is not shared with anyone.
• reCAPTCHA — Google reCAPTCHA v3 protects the sign-in and registration forms and may set its own cookies needed to tell humans from bots.

8. Security

Connections to the Service are encrypted (HTTPS). Passwords are stored only as bcrypt hashes and sessions in a cookie that is not accessible to scripts. Access to the database and the request log is limited to the Service administrator.

9. Changes and contact

We will announce material changes to this policy in the Service. For data protection matters write to contact@cytado.com. The rules of the service itself are set out in the terms of service.