Privacy policy

RELOAD TECHNOLOGIES - FZCO operates Citation. This policy covers personal information processed through our website, accounts, writing workspace, sharing features, support, and related tools. Contact us at hello@alptekincan.com for privacy questions or requests.

For account administration and operation of Citation, the operator decides why and how personal information is processed. If you use Citation through an organisation, that organisation may separately decide how information in its documents is used. An organisation’s own notice and any applicable data processing agreement may also be relevant.

The operator’s service address, country of establishment, and any required privacy representative remain to be confirmed before publication. This draft does not establish a particular regulator’s jurisdiction or certify compliance with any privacy law.

The information involved depends on the features you use. It may identify you directly or relate to you through your account, a document, or a device.

• Account and profile information: your email address, account identifier, authentication details, display name, avatar, selected role, citation style, onboarding progress, and preferences such as timezone and notifications. Authentication is handled through Supabase. If an external sign in option is enabled and you choose it, we receive the identity information it supplies.
• Your work: document titles and contents, uploaded files and extracted text, folders, source records, citation metadata, document versions, comments, edits, and export requests.
• AI and review activity: prompts, conversation messages, relevant document context, generated responses, accepted or dismissed suggestions, feedback, similarity reports, source matches, and feature usage.
• Collaboration: invitation addresses, membership and access roles, public link settings, mentions, notifications, and presence or editing activity associated with a shared document.
• Connected tools: provider identifiers, authorised access credentials, connection status, queries, selected metadata, and the files or text you choose to import or export.
• Service and support records: usage counters, storage consumption, request status, error references, referral attribution where used, support messages, and diagnostics you choose to include. Hosting and authentication providers may also process IP addresses, browser information, request times, and other connection or security metadata.

You may include personal information about someone else in your work. Only submit it when you are entitled to do so. Citation is not designed as a repository for passwords, identity documents, health records, or similarly sensitive information. Avoid supplying those details unless you have an appropriate legal basis and have confirmed that the service is suitable for your requirements.

We receive information from you when you register, work in Citation, connect a provider, share a document, or contact us. Other users may supply your email address to invite you or include information about you in their content. A connected identity or research provider may return profile information, bibliographic records, public author details, or selected files.

Research and citation features retrieve information from public webpages and databases. Technical information is generated as requests are processed. Browser storage supports sign in, workspace preferences, and recovery of unfinished work, as described in the Cookie policy.

We process information to authenticate you, maintain your profile, save and organise work, format references, import and export files, provide requested AI features, enable collaboration, and answer support requests. Usage and technical records help us enforce limits, prevent abuse, investigate errors, and maintain the service.

Where a law requires a legal basis, the bases proposed for this service are:

• Providing the service you request: account access, document storage, and requested processing needed to perform our agreement with you or take steps at your request before it begins.
• Legitimate interests: proportionate security, abuse prevention, reliability, and support administration, balanced against the interests and rights of the people affected.
• Legal obligations: responding to binding legal requirements and keeping records when the law requires it.
• Consent, where required: processing that legally requires an optional choice. A device permission or acceptance of terms is not a substitute for every consent that may be needed.

These bases require confirmation against the operator’s jurisdiction, intended users, and provider agreements before publication. Required account details are necessary to create and secure an account. Optional features cannot operate without the content or permissions they need, but you may choose not to use them.

When you ask the assistant for help, Citation sends your message and relevant context to OpenRouter and the model provider handling the request. That context can include the current draft, selected text, recent conversation history, and source metadata. Selecting a passage does not necessarily limit processing to that passage. Generated responses and conversation records may be saved with the document.

Similarity checks send passages for analysis through OpenRouter. The configured search tool uses Exa to find public evidence, and Citation may retrieve source pages to compare their content. A search query can itself reveal information from your draft.

Voice input sends recorded audio through OpenRouter to its transcription provider. The current transcription integration uses an OpenAI model. Reading aloud sends text through OpenRouter to its speech provider, currently a Google model. Conversation text can be saved in your workspace. Microphone access is requested through your browser.

Provider routing, model availability, and account settings can change. This policy does not promise that every provider uses the same retention period, that no provider trains on submitted data, or that requests remain in a particular country. Those points require confirmation of the provider terms and settings applying to Citation’s account. Do not send confidential material to these features unless you are authorised to disclose it for this processing.

AI outputs and similarity scores are assistance for your review. Citation is not designed to make decisions with legal or similarly significant effects about people. Automated usage limits can temporarily prevent a feature request; you can contact us for a manual review.

The application uses the following services for the purposes described below. A provider receives the data involved in the feature it supplies, rather than an automatic right to all of your work.

Vercel and Supabase

Vercel hosts the application and processes web requests. Supabase supplies authentication, the application database, and file storage. These services process the account, content, and technical information required for those functions.

OpenRouter, model providers, and Exa

These services process prompts, document context, audio or speech text, and search requests as described above. The downstream provider depends on the model or feature used.

Citation and research sources

Lookups can send a URL, DOI, ISBN, title, author, or search query to Crossref, DOI resolution services, Google Books, Open Library, or the source website. Research integrations can also query PubMed, Semantic Scholar, arXiv, or ORCID when available.

Email delivery

Authentication emails are handled through the authentication service’s configured delivery system. When transactional delivery is configured, Resend receives invitation recipients and links, or support message content and reply addresses. Support diagnostics are included only when you choose to submit them.

Tools you choose to connect

Available integrations may let you authorise access to an external library, document account, or bibliography feed. Citation stores connection details and protected credentials where needed and retrieves the items you request. Availability and permissions are shown during setup. File exchange and companion tools process the files, selected text, or clipboard content you intentionally supply.

Private account integrations require configuration and your authorisation. A catalog listing does not mean a provider is connected. Disconnecting removes the saved connection in Citation; you may also need to revoke permission in the provider’s account settings. Imported content remains in Citation until separately deleted. A file you download and upload elsewhere is then governed by the receiving service’s practices.

Your access settings determine which other users can see or edit shared work. Workspace owners and authorised members may have access to material within their workspace. A document invitation grants access to that document according to the assigned role. Collaboration may show your display name, avatar, comments, changes, and presence to other participants.

A public document link exposes the shared document and its source details to anyone who obtains the link, without an account. Recipients can retain or redistribute copies. Removing a person or restricting a link cannot recall material already copied or exported. Check the audience before publishing a link.

Information may also be disclosed when necessary to respond to a binding legal requirement, investigate abuse, protect rights or safety, or handle a lawful business transfer. Any such disclosure must have an appropriate basis and be limited to the relevant purpose. These possibilities do not mean that user documents are routinely made public.

The current application does not include advertising pixels or an advertising audience integration. This statement does not eliminate the processing by providers described in this policy. Whether a particular disclosure has a regulated meaning such as a “sale” or “sharing” must be assessed under the law and contracts that apply.

Hosting, authentication, AI, research, and email providers may process information in countries other than where you live. Some features send information through more than one provider. We do not currently offer a verified commitment that all data stays within a particular region.

Before publication, the operator must confirm the actual hosting and storage regions, relevant international transfers, and any required safeguards under applicable law. No particular adequacy decision, contractual transfer mechanism, or provider certification is asserted in this draft. Contact hello@alptekincan.com for the information needed to assess your own requirements before submitting restricted data.

Saved work and related records remain associated with your account or workspace to support access, collaboration, document history, and requested features. Moving an item to Trash makes it recoverable; it does not immediately erase it. An authorised owner can use permanent deletion to remove the item’s application records. File cleanup can finish separately through the storage cleanup process.

Closing a browser, signing out, disconnecting an integration, or removing a shared link does not delete the corresponding account or all related content. Document exports and copies held by other users are outside Citation’s deletion controls. Unsynced changes and interface preferences can also remain on your device until cleared or replaced.

There is no general automatic account deletion control or verified universal retention deadline in this version. Contact hello@alptekincan.com for account closure, access, or erasure requests. We need to verify authority and consider shared work and any lawful reason to retain particular records. If a request cannot be fully fulfilled, we should explain why and identify the applicable review or complaint route.

Retention decisions must take account of the purpose of a record, the life of the account or document, security and dispute needs, and legal requirements. Provider logs, backups, support records, and operational records can have separate retention periods. The operator must confirm those periods and deletion procedures before publication; this draft does not promise immediate erasure from all backups or provider systems.

You can update available profile settings, export documents, manage invitations and public links, disconnect tools, and use Trash or permanent deletion where your role permits. You can decline microphone access or avoid AI features. Browser storage can be cleared using your browser’s controls, subject to the consequences explained in the Cookie policy.

Depending on where you live and the law that applies, you may have rights to obtain a copy of personal information, correct it, request deletion, restrict processing, receive portable data, withdraw consent, or complain to a privacy regulator. Where applicable, additional rights can include opting out of certain disclosures or targeted advertising, limiting certain uses of sensitive information, using an authorised agent, or appealing a refusal.

Your right to object: where applicable, you may object to processing based on legitimate interests because of your particular circumstances, and to direct marketing. Send your objection to hello@alptekincan.com. Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of processing before withdrawal.

To make a request, tell us which account or information is involved and what you want us to do. We may ask for proportionate information to verify identity or authority. Do not email a password or identity document unless a secure and necessary process has been agreed. We will handle requests within the period required by applicable law and explain any permitted extension or exception. You should not be penalised for exercising a legal privacy right.

You may raise a concern with the regulator available to you under applicable law. For example, people with applicable UK rights can contact the Information Commissioner’s Office. The operator’s own competent regulator remains to be confirmed.

Citation is not intended for children under 13. The eligibility terms also require any permission or higher minimum age required by local law. We have not implemented a parental consent workflow. If you believe a child has supplied personal information without the necessary permission, contact us so the circumstances can be reviewed and appropriate action taken.

Schools, employers, and researchers must assess their own obligations before uploading student, employee, participant, or confidential research information. A public link, AI request, or external integration can disclose that information beyond the original group. This general service notice is not an institutional data processing agreement.

Access controls, session handling, validation, and other application safeguards are described in the Security policy. No online service can guarantee that unauthorised access or loss will never occur. Protect your credentials and choose sharing settings carefully.

We will update this policy as the service and its processing change. The date at the top identifies the latest revision. Material changes should be brought to your attention through an appropriate notice, and consent should be obtained where required before new optional processing begins. Contact hello@alptekincan.com for questions about this policy or a previous version.