This policy explains what CiteBuilt collects when you use Citebuilt, why, and what control you have. It covers https://citebuilt.com and the Citebuilt application.
What we collect
- Account data — name, email address, organisation and role. Sign-in is handled by Clerk; we never see your password.
- Project content — the documents, drawings, photos and register entries you and your team upload.
- Billing data — handled by Paddle. We receive the subscription plan, status, renewal date and seat count. We never receive or store your card number.
- Technical data — log entries such as IP address, timestamps and error traces, used to run and secure the service.
How we use it
- To provide the service: storing, indexing and searching your content, and generating AI analysis you ask for.
- To bill you, through Paddle, and to apply the entitlements of your plan.
- To support you when you contact us, and to notify you about material changes to the service.
- To keep the service secure, diagnose faults and prevent abuse.
We do not sell personal data, and we do not use your project content for advertising.
AI processing
To answer a question or run a review, relevant extracts of your content are sent to the AI model providers we use for that feature. They process the extract to return a result and are contractually bound not to use it to train their models. Which providers are used depends on the model configured for your workspace.
Sharing
We share data only with the processors that make the product work: Clerk (authentication), Paddle (payments and tax), our hosting and database providers, and the AI model providers described above. We also disclose data where the law requires it.
Where data lives and how long we keep it
Content is stored on servers operated for CiteBuilt and is kept while your account is open. After an account is closed we delete or anonymise project content within 90 days, except where we must retain records (for example, invoices) to meet legal obligations.
Security
- Traffic is encrypted in transit over HTTPS.
- Every project is scoped to its owning organisation; access is checked on each request.
- Access to production systems is restricted to the operators who need it.
Your rights
You can request a copy of your personal data, ask us to correct it, or ask us to delete it. Depending on where you live you may also object to or restrict certain processing, and complain to your data protection authority. Write to [email protected] and we will respond within 30 days.
Cookies
We use only the cookies and local storage needed to keep you signed in and to remember interface preferences. We do not run third-party advertising trackers.
Children
Citebuilt is a business tool and is not directed at anyone under 16.
Changes
If we change this policy materially we will update the date above and notify account holders by email.