Data processing agreement (summary)

For the content your organisation puts into its workspaces, your organisation is the controller and we are the processor. We process it only on your documented instructions: to provide Citation Monster as described in the Terms and the settings you choose.

• No training. We never use your content or usage to train or improve AI models, and our subprocessors are bound not to either.
• Confidentiality. Only staff who need access to run or support the service have it, under confidentiality obligations.
• Security. Encryption in transit and at rest, database-enforced isolation between workspaces, a private file store per workspace, per-workspace keys for stored secrets, scrubbed logs and an audit log of sensitive actions.
• Subprocessors. Only those on the subprocessors page, under written terms at least as protective. We give notice before adding one, and you may object.
• Breaches. We tell you without undue delay, and within 72 hours of becoming aware of a breach affecting your data.
• Your requests. We help you answer people's requests to access, correct, export or delete their data; most can be done in the app.
• Deletion. When you delete a workspace it is removed for good after 30 days; backups expire after up to 60 days. You can export everything first.
• Transfers. Data processed outside the EU, UK or Switzerland is covered by the standard contractual clauses (and the UK addendum).
• Audits. We answer reasonable security questionnaires and share relevant documentation on request.

• Subject matter: providing Citation Monster.
• Data subjects: your users, and people named in the papers and notes you upload.
• Personal data: names and email addresses of users; any personal data within uploaded papers, notes, chats and research.
• Duration: for as long as you use the service, then until deletion as above.