Privacy Policy
Last updated: 1 September 2026
Your privacy matters to us. This policy explains what personal information Citation Creation collects, why we collect it, how we handle it, who we share it with, and the rights you have over it. We never sell your personal information.
Citation Creation ("Citation Creation", "we", "us", or "our") is a product of Virtually Created Pty Ltd (ABN 90 695 908 975), a company registered in New South Wales, Australia. We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where they apply to you, the EU General Data Protection Regulation (GDPR) and applicable United States state privacy laws.
This policy applies to the Citation Creation website and web application (together, the "Service"). By using the Service, you agree to the collection and use of information in line with this policy.
What we collect and why
Our guiding principle is to collect only what we need to provide the Service.
Identity and account information
When you create an account, we collect your name, email address, and a password. Your password is always kept secure and is never stored in a form that we or anyone else can read. If you enable two-factor authentication, we securely store the information needed to verify your sign-ins. We use this information to create and secure your account, to provide the Service, and to send you essential account and Service notices.
Billing and subscription information
Citation Creation currently provides a free web plan and does not ask for payment details. If paid web plans become available, payment may be processed by Paddle as merchant of record. In that case, full card details would be entered with Paddle and would not pass through or be stored on our servers; we would retain the subscription and transaction records needed for account history, invoicing, support, and legal obligations.
Content you create and upload
We store the content you create in the Service, including your projects, citations, bibliographies, notes, and preferences, so you can use the Service as intended. AI Import and Paper Review are not currently available. If either feature is enabled later and you choose to use it, we may temporarily store an uploaded PDF or Word document while it is queued and processed. Successful processing is designed to remove the working upload, but cleanup after a failed or interrupted job and deletion of all historical upload artifacts are not yet guaranteed. Do not upload material that requires a stronger deletion guarantee.
Technical and usage data
When you use the Service, we automatically log technical information including your IP address, browser and device type, and activity such as sign-ins, for security, fraud prevention, and diagnostic purposes. We also measure aggregate website traffic, such as how many people visit a page and which site referred them, to understand how the Service is found and used. We use your IP address to estimate your general location (country/region) so we can show prices in an appropriate currency. We also record aggregate usage of features (such as the number of citations or AI extractions you create in a billing period) to apply plan limits.
Cookies and similar technologies
We use a small number of essential cookies to keep you signed in, remember your preferences, and keep your account secure. These are necessary for the Service to function. We do not use advertising cookies. Our website analytics is cookie-free: it sets nothing on your device, does not fingerprint your browser, and cannot follow you to other websites. Because it stores nothing on your device and identifies no individual, it does not require a consent prompt. If we ever introduce analytics that does, we will update this policy and ask for your consent first.
AI processing of submitted material
AI Import and Paper Review are not currently available. If enabled later and you choose to use them, AI Import and Paper Review may transmit submitted material to a third-party AI gateway, which routes the request to a downstream model provider. Depending on the feature, this can include uploaded PDF or Word content (including a base64-encoded PDF), extracted document or bibliography text, individual reference text, the uploaded filename and file type, and the instructions needed to extract citations or review a paper.
We keep operational metadata about requests, including your account, feature and model, token counts, reported cost, the gateway's request or generation identifier, character or citation counts, file type, and detection method, for usage limits, billing, security, and troubleshooting. We do not use submitted documents to train our own models.
The gateway states that it does not retain prompt content by default unless prompt logging is enabled. It forwards requests to downstream model providers, whose logging, retention, and model-training practices vary by provider and endpoint. Citation Creation does not currently enforce zero-data-retention routing on each request. We therefore cannot guarantee zero retention, no provider logging, no model training, a particular processing location, or deletion from every downstream provider. Provider policies and routing can change without notice to you; contact us at support@citationcreation.com if you need the current provider details before submitting material.
Do not submit confidential, sensitive, embargoed, or unpublished material unless you accept this transmission and the applicable provider practices. If you do not accept them, do not use AI Import or Paper Review for that material; you can add, edit, and format citations manually.
How we use your information
We use the personal information we collect to:
- provide, maintain, and improve the Service;
- create and secure your account and authenticate your sign-ins;
- process payments and manage your subscription if paid web plans become available;
- respond to your support requests and communicate essential Service notices;
- apply plan limits and prevent abuse, fraud, and security incidents; and
- comply with our legal obligations.
We rely on your consent, the performance of our contract with you, our legitimate interests in running and securing the Service, and our legal obligations as the bases for this processing.
Who we share information with
We do not sell your personal information. We share it only with service providers that help us operate the Service, and only as needed to perform their function. Depending on the available features you use, these providers include or may include:
| Provider | Purpose | Location |
|---|---|---|
| Paddle | Future web payment processing, if paid plans become available | UK / US |
| AI model providers | AI citation extraction and paper review, if those features become available | US |
| Email delivery provider | Sending transactional email (verification, password reset) | US |
| Hosting & infrastructure | Application hosting, database, storage, and caching | See below |
| Content delivery & security | Content delivery, DNS, and protection against malicious traffic | Global |
| Analytics | Cookie-free measurement of aggregate website traffic | Global |
| Monitoring & error reporting | Application performance monitoring and error reporting | Australia |
We may also disclose your information where required to do so by law, to enforce our terms, to protect the rights, property, or safety of our users or others, or in connection with a sale or restructure of our business (in which case we will notify you before your information becomes subject to a different privacy policy).
Overseas disclosure
We are an Australian business, but the Service relies on cloud infrastructure and service providers located in several countries. Your personal information may be stored or processed in Australia, the United States, the United Kingdom, or other countries in which our providers operate, as shown in the table above.
We may also store or process data in other locations in the future as the Service grows. Wherever your information is processed, we take reasonable steps to ensure it is handled with a level of protection consistent with the Australian Privacy Principles, including by using reputable providers with appropriate contractual data-protection commitments.
How we secure your data
We protect your information using industry-standard security measures. Information sent between your device and our servers is encrypted while in transit, and sensitive information such as your password is kept in a securely protected form. We limit internal access to personal information to those who need it to operate and support the Service. No method of transmission or storage is ever completely secure, but we work continuously to protect your data and to respond promptly to any security incident.
Data retention
We keep your personal information for as long as your account is active and as needed to provide the Service. When you delete your account, we delete your projects, citations, and related account content from our active database. Encrypted database backups can lag behind that deletion and are automatically aged out within 30 days; restoring a backup may temporarily reintroduce older data that must be deleted again. Temporary AI working uploads are designed to be removed after successful processing, but failed or interrupted jobs may leave an upload pending operational cleanup, and deletion of every historical upload artifact is not yet guaranteed. We may retain certain payment, transaction, security, usage, or audit records for longer where required for legal, accounting, fraud-prevention, dispute, or enforcement purposes. AI gateway and model providers and payment providers retain data under their own policies and technical processes.
If you use the Service without an account, your guest project and citations are stored server-side and are available from this browser for up to 30 days after your last guest activity. Access depends on an encrypted, browser-only cookie: clearing cookies, changing browsers or browser profiles, or losing that cookie means you can no longer access the old guest project. Expired guest projects and their citations are permanently deleted from our systems. Creating a free account transfers the guest project to your account and preserves it.
Your rights and choices
You have the right to:
- Access the personal information we hold about you. You can export your account and citation content from account settings, and contact us for other personal information.
- Correct information that is inaccurate or out of date, including by updating your profile in your account settings.
- Delete your account and associated content (see below).
- Complain if you believe we have mishandled your information.
Depending on where you live, you may have additional rights under the GDPR or US state privacy laws, such as the right to object to or restrict certain processing and the right to data portability. We apply these rights to all users where we reasonably can.
To exercise any of these rights, contact us at support@citationcreation.com. If you are in Australia and are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Children and students
The Service is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16. Where the Service is used in an educational setting, we expect the educator or institution to obtain any consents required for students under 16 to use the Service. If you believe a child under 16 has provided us with personal information without appropriate consent, please contact us and we will take steps to delete it.
Deleting your account
You can delete your account at any time from your account settings. When you do, we permanently delete your projects, citations, and related account content from our active database; encrypted backups age out within 30 days. We do not currently guarantee immediate deletion of every temporary uploaded-paper artifact after failed or interrupted processing, every usage or audit record, or material already transmitted to an AI gateway and a downstream model provider. We keep one minimal record that the deletion happened (your former account number, a one-way hash of your email address, and the date) so we can later confirm whether and when your data was removed; it contains no name, email address, or content. Payment and transaction records, if applicable, remain with the payment provider under its policies. If you would like help deleting your account or data, contact us at support@citationcreation.com.
Changes and contact
We may update this policy from time to time to reflect changes in our practices or the law. When we make a significant change, we will update the date at the top of this page and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.
If you have any questions about this policy or how we handle your information, please contact us at support@citationcreation.com.