Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account & contact information — your name, work email address, company name, role, and any details you provide when you request access, create an account, or contact us.
• Billing information — when you purchase a paid subscription, payments are processed by our payment processor, Stripe. We receive limited billing details such as your billing name, country, the last four digits of your card, card brand, subscription status, and transaction history. We do not collect or store your full payment card number, CVC, or other sensitive cardholder data; that information is transmitted directly to and handled by Stripe.
• Project & usage data — the brands, domains, competitors, prompts, and configuration you add to your projects, along with the analysis results, reports, and history we generate for you.
• Technical & log data — IP address, browser type, device information, pages viewed, and timestamps, collected automatically through cookies and similar technologies for security, diagnostics, and analytics.

2. How We Use Information

• To provide, operate, maintain, and improve the Services.
• To create and administer your account and authenticate sign-ins.
• To process payments, manage subscriptions, and send billing-related communications.
• To generate the monitoring, analysis, and reporting features you request.
• To respond to enquiries, provide support, and send service and transactional messages.
• To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• To comply with legal obligations and enforce our terms.

3. Legal Bases for Processing

Where required by applicable law (such as the EU/UK GDPR), we rely on the following legal bases: performance of a contract with you; compliance with legal obligations; our legitimate interests in operating and securing the Services; and your consent, where applicable. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Payment Processing (Stripe)

We use Stripe, Inc. and its affiliates to process payments and manage subscriptions. When you make a purchase, your payment card details are collected and processed directly by Stripe in accordance with its own terms and privacy policy. Stripe acts as an independent controller of the payment data it collects and is certified under the PCI-DSS standard. We share with Stripe the information needed to complete and manage your transaction (for example, your email, billing details, and subscription identifiers), and we receive back limited confirmation and status data as described above.

For more information on how Stripe handles your data, please review the Stripe Privacy Policy.

5. Service Providers & Sub-Processors

We share personal information with third-party service providers who process it on our behalf, only to the extent necessary to provide the Services and under appropriate confidentiality and data-protection obligations. These include, among others:

• Stripe — payment processing and subscription management.
• Cloud hosting & infrastructure providers — to host the application, database, and store data.
• Email delivery providers — to send transactional and service emails.
• AI / large language model providers — to run the prompts and analyses that power the Services. We do not sell your data to these providers.
• Analytics & security providers — to understand usage and protect the Services.

6. How We Share Information

We do not sell your personal information. We disclose information only: (a) to the service providers described above; (b) to comply with law, regulation, legal process, or enforceable governmental request; (c) to enforce our agreements or protect the rights, property, or safety of CitationWorks Inc., our users, or others; and (d) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy.

7. International Data Transfers

We operate from Japan and work with service providers that may process data in other countries, including the United States and the European Economic Area. Where personal data is transferred across borders, we rely on appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms, as required by applicable law.

8. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Services, and thereafter as necessary to comply with our legal obligations, resolve disputes, maintain security, and enforce our agreements. Billing records are retained for the period required by applicable tax and accounting laws. When data is no longer required, we delete or anonymize it.

9. Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration, including encryption in transit, access controls, and delegation of card processing to a PCI-DSS-certified processor. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Your Rights

Depending on your location, you may have rights to access, correct, update, port, restrict, or delete your personal information, to object to certain processing, and to withdraw consent. Residents of the European Economic Area and United Kingdom have rights under the GDPR; California residents have rights under the CCPA/CPRA (including the right not to be discriminated against for exercising those rights); and individuals in Japan have rights under the Act on the Protection of Personal Information (APPI). To exercise any of these rights, contact us using the details below. You may also have the right to lodge a complaint with your local data protection authority.

11. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and understand how the Services are used. You can control cookies through your browser settings; disabling some cookies may affect functionality.

12. Children's Privacy

The Services are intended for businesses and are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at privacy@citationworks.com.

CitationWorks Inc.
Shibuya, Tokyo, Japan