Privacy Policy

We use the information we collect for the following purposes:

• Providing the Service. To process your research queries, generate reports, manage your library and references, and deliver the features you use.
• Account management. To create and maintain your account, authenticate your identity, and manage your subscription and billing.
• Credit metering. To accurately measure AI resource consumption and apply credit charges based on actual usage.
• Service improvement. To analyze usage patterns, diagnose technical issues, and develop new features. We may use aggregated, anonymized data for these purposes.
• Communications. To send transactional emails (account confirmation, billing receipts, credit alerts), respond to support requests, and, where you have opted in, send product updates.
• Security and compliance. To detect and prevent fraud, abuse, and unauthorized access, and to comply with legal obligations.

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

• Service providers. We share data with third-party vendors who help us operate the Service, including cloud infrastructure providers, payment processors (Stripe, MTN Mobile Money, Airtel Money, M-Pesa), authentication providers (Supabase), and analytics tools. These providers are contractually obligated to use your data only to provide services to us.
• AI model providers. When you use AI-powered features, your research queries and relevant context are sent to third-party AI providers for processing. We only send the content necessary to fulfill your request — not your full account information.
• Legal requirements. We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers. If CiteDash is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Row-level security on database tables to ensure users can only access their own data.
• OAuth-based authentication — we never see or store your password.
• Regular security assessments and dependency auditing.
• Access controls limiting employee access to personal data on a need-to-know basis.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents.

Your data is stored on servers located in the United States and Europe. If you are located outside these regions, your information will be transferred to and processed in these jurisdictions.

We may use aggregated, anonymized usage metrics (such as average query length or popular research topics) to improve the Service. This data cannot be used to identify individual users or reconstruct personal content.

We use the following categories of cookies:

We do not use advertising or third-party tracking cookies. You can control cookie settings through your browser preferences, though disabling essential cookies may prevent you from using the Service.

We retain your personal information for as long as your account is active or as needed to provide the Service. Specific retention periods include:

• Account data. Retained until you delete your account.
• Your content. Research sessions, documents, notes, assignments, review Q&A entries, and library files are retained until you delete them or your account. After account deletion, content is permanently removed within 90 days.
• Billing records. Retained for up to 7 years as required by tax and financial regulations.
• Usage logs. Retained for up to 12 months for security and diagnostic purposes, then anonymized or deleted.
• Support communications. Retained for up to 3 years after the last interaction.

Depending on your location, you may have the following rights regarding your personal information:

• Access. Request a copy of the personal information we hold about you.
• Correction. Request that we correct inaccurate or incomplete information.
• Deletion. Request that we delete your personal information, subject to legal retention obligations.
• Export. Export your data in a machine-readable format using the export features available in the Service.
• Objection. Object to certain processing activities, such as direct marketing.
• Restriction. Request that we restrict processing of your data in certain circumstances.
• Withdraw consent. Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@citedash.ai. We will respond within 30 days. You may also delete your account and all associated data directly from your account settings.

CiteDash operates globally and your information may be transferred to, stored in, and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law, we implement appropriate safeguards for international data transfers, including standard contractual clauses or other legally recognized mechanisms.

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@citedash.ai.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and notify you through the Service or by email.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy, contact us at: