Privacy Policy
Last updated: 29 October 2026
Your privacy matters to us. This policy explains what personal information Citation Creation collects, why we collect it, how we handle it, who we share it with, and the rights you have over it. We never sell your personal information.
Citation Creation ("Citation Creation", "we", "us", or "our") is a product of Virtually Created Pty Ltd (ABN 90 695 908 975), a company registered in New South Wales, Australia. We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where they apply to you, the EU General Data Protection Regulation (GDPR) and applicable United States state privacy laws.
This policy applies to the Citation Creation website and web application, and to the Citation Creation browser extension (together, the "Service"). By using the Service, you agree to the collection and use of information in line with this policy.
What we collect and why
Our guiding principle is to collect only what we need to provide the Service.
Identity and account information
When you create an account, we collect your name, email address, and a password. Your password is always kept secure and is never stored in a form that we or anyone else can read. We use this information to create and secure your account, to provide the Service, and to send you essential account and Service notices.
Billing and subscription information
Citation Creation currently provides a free web plan and does not ask for payment details. If paid web plans become available, payment may be processed by Paddle as merchant of record. In that case, full card details would be entered with Paddle and would not pass through or be stored on our servers; we would retain the subscription and transaction records needed for account history, invoicing, support, and legal obligations.
Content you create and upload
We store the content you create in the Service, including your projects, citations, bibliographies, notes, and preferences, so you can use the Service as intended. AI Import and Paper Review are not currently available. If either feature is enabled later and you choose to use it, we may temporarily store an uploaded PDF or Word document while it is queued and processed. Successful processing is designed to remove the working upload, but cleanup after a failed or interrupted job and deletion of all historical upload artifacts are not yet guaranteed. Do not upload material that requires a stronger deletion guarantee.
Technical and usage data
When you use the Service, we automatically log technical information including your IP address, browser and device type, and activity such as sign-ins, for security, fraud prevention, and diagnostic purposes. We also measure aggregate website traffic, such as how many people visit a page and which site referred them, to understand how the Service is found and used. We use your IP address to estimate your general location (country/region) so we can show prices in an appropriate currency. We also record aggregate usage of features (such as the number of citations or AI extractions you create in a billing period) to apply plan limits.
Cookies and similar technologies
We use a small number of essential cookies to keep you signed in, remember your preferences, and keep your account secure. These are necessary for the Service to function. We do not use advertising cookies. Our website analytics is cookie-free: it sets nothing on your device, does not fingerprint your browser, and cannot follow you to other websites. Because it stores nothing on your device and identifies no individual, it does not require a consent prompt. If we ever introduce analytics that does, we will update this policy and ask for your consent first.
AI processing of submitted material
AI Import and Paper Review are not currently available. If enabled later and you choose to use them, AI Import and Paper Review may transmit submitted material to a third-party AI gateway, which routes the request to a downstream model provider. What is sent depends on the file. For a Word document, we send only the text of its reference list. If the list cannot be found, we show you the document's text and send only the part you choose, or all of it if you ask. For a PDF, your browser keeps the first page and the pages from the reference list on, and removes the rest before the file is uploaded, so those pages never reach us or the AI provider. If your browser cannot find the reference list, or the list starts in the first two pages, the whole PDF is sent. The name of your file is not sent.
We keep operational metadata about requests, including your account, feature and model, token counts, reported cost, the gateway's request or generation identifier, character or citation counts, file type, and detection method, for usage limits, billing, security, and troubleshooting. We do not use submitted documents to train our own models.
Every request we send tells the gateway to use only model providers that it lists as not retaining what they are sent and not using it to train models. Our account with the gateway is set the same way. If no such provider is available, the request is refused and your material is not sent to another provider. These are the gateway's and the providers' own commitments: we cannot inspect their systems, a provider may hold material in memory for a short time while it works, and we do not promise a particular processing location. Provider policies can change; contact us at support@citationcreation.com if you need the current provider details before submitting material.
Do not submit confidential, sensitive, embargoed, or unpublished material unless you accept this transmission and the applicable provider practices. If you do not accept them, do not use AI Import or Paper Review for that material; you can add, edit, and format citations manually.
Looking up and checking sources
When you look up a source, verify your citations or run Paper Review, we send details of the cited source, such as its title, authors, year, DOI, ISBN or web address, to public bibliographic indexes and registries: Crossref, DataCite, OpenAlex, Open Library and doi.org. To check a web link we request it from the site it points to. These requests come from our servers. They carry the details of the source being cited and do not include your name, email address or account.
The browser extension
The Citation Creation browser extension reads a page only when you press Cite, or choose to cite it from the right-click menu. At that moment it sends us the page's address, its title, its tags, and the heading, byline and date the article shows. The tags are the details a page gives about itself for search engines and reference managers, such as its author, its publication date and its DOI. The text of the article is not sent. A summary or abstract the page gives in its tags may be among them.
We use these details to build the citation, and look the source up as described under "Looking up and checking sources" above. When you cite a link, or a page whose tags say too little, our server reads the page itself, as it does for an address you type on the site. What you type into the extension's citation form is sent to us so we can show the reference in your style, and again when you save it. A saved citation includes the page's address and title, with the day you cited it, and is kept in your project like any other.
When you open the extension, it asks us for your guest project, or, once you have signed in, for your projects and this month's usage. When the extension is installed, it opens a welcome page on our site. If this browser already has a guest project on the site, the extension takes that project as its own, so your sources stay in one place.
The extension does not read or record the pages you visit but do not cite, or anything you type on other sites. It keeps your citation style, a form you have not finished, your sign-in and the key to your guest project in your browser, and sends each only to Citation Creation.
A guest project made in the extension is reached by a key the extension keeps. The project is deleted 30 days after it was last used, and removing the extension loses the key, and with it the way back to the project. The sign-in lasts a year from the last time the extension is used. You can end it from the extension, or under Settings, Security. While you are signed in, the extension keeps your name, your email address and your plan to show who is signed in, and the project you last chose to save to. It also keeps, for a short time, a check that the sign-in still works.
The extension is offered in three stores, and follows the rules each one sets for the information an extension receives:
- The use of information received through the Citation Creation extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
- The extension follows Mozilla's Add-on Policies for Firefox Add-ons.
- The extension follows the Microsoft Edge Add-ons developer policies.
How we use your information
We use the personal information we collect to:
- provide, maintain, and improve the Service;
- create and secure your account and authenticate your sign-ins;
- process payments and manage your subscription if paid web plans become available;
- respond to your support requests and communicate essential Service notices;
- apply plan limits and prevent abuse, fraud, and security incidents; and
- comply with our legal obligations.
We rely on your consent, the performance of our contract with you, our legitimate interests in running and securing the Service, and our legal obligations as the bases for this processing.
Who we share information with
We do not sell your personal information. We share it only with service providers that help us operate the Service, and only as needed to perform their function. Depending on the available features you use, these providers include or may include:
| Provider | Purpose | Location |
|---|---|---|
| Paddle | Future web payment processing, if paid plans become available | UK / US |
| AI model providers | AI citation extraction and paper review, if those features become available | US |
| Email delivery provider | Sending transactional email (verification, password reset) | US |
| Hosting & infrastructure | Application hosting, database, storage, and caching | See below |
| Content delivery & security | Content delivery, DNS, and protection against malicious traffic | Global |
| Analytics | Cookie-free measurement of aggregate website traffic | Global |
| Monitoring & error reporting | Application performance monitoring and error reporting | Australia |
| Bibliographic indexes | Looking up and checking cited sources | Global |
We may also disclose your information where required to do so by law, to enforce our terms, to protect the rights, property, or safety of our users or others, or in connection with a sale or restructure of our business (in which case we will notify you before your information becomes subject to a different privacy policy).
Overseas disclosure
We are an Australian business, but the Service relies on cloud infrastructure and service providers located in several countries. Your personal information may be stored or processed in Australia, the United States, the United Kingdom, or other countries in which our providers operate, as shown in the table above.
We may also store or process data in other locations in the future as the Service grows. Wherever your information is processed, we take reasonable steps to ensure it is handled with a level of protection consistent with the Australian Privacy Principles, including by using reputable providers with appropriate contractual data-protection commitments.
How we secure your data
We protect your information using industry-standard security measures. Information sent between your device and our servers is encrypted while in transit, and sensitive information such as your password is kept in a securely protected form. We limit internal access to personal information to those who need it to operate and support the Service. No method of transmission or storage is ever completely secure, but we work continuously to protect your data and to respond promptly to any security incident.
Data retention
We keep your personal information for as long as your account is active and as needed to provide the Service. When you delete your account, we delete your projects, citations, and related account content from our active database. Encrypted database backups can lag behind that deletion and are automatically aged out within 30 days; restoring a backup may temporarily reintroduce older data that must be deleted again. Temporary AI working uploads are designed to be removed after successful processing, but failed or interrupted jobs may leave an upload pending operational cleanup, and deletion of every historical upload artifact is not yet guaranteed. We may retain certain payment, transaction, security, usage, or audit records for longer where required for legal, accounting, fraud-prevention, dispute, or enforcement purposes. AI gateway and model providers and payment providers retain data under their own policies and technical processes.
If you use the Service without an account, your guest project and citations are stored server-side and are available for up to 30 days after your last guest activity. On the website, the project is reached through an encrypted cookie kept in your browser: clearing cookies, changing browsers or browser profiles, or losing that cookie means you can no longer access the old guest project. In the browser extension, the project is reached by the key the extension keeps: removing the extension loses it. Expired guest projects and their citations are permanently deleted from our systems. Creating a free account transfers the guest project to your account and preserves it.
Your rights and choices
You have the right to:
- Access the personal information we hold about you. You can export your account and citation content from account settings, and contact us for other personal information.
- Correct information that is inaccurate or out of date, including by updating your profile in your account settings.
- Delete your account and associated content (see below).
- Complain if you believe we have mishandled your information.
Depending on where you live, you may have additional rights under the GDPR or US state privacy laws, such as the right to object to or restrict certain processing and the right to data portability. We apply these rights to all users where we reasonably can.
To exercise any of these rights, contact us at support@citationcreation.com. If you are in Australia and are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Children and students
The Service is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16. Where the Service is used in an educational setting, we expect the educator or institution to obtain any consents required for students under 16 to use the Service. If you believe a child under 16 has provided us with personal information without appropriate consent, please contact us and we will take steps to delete it.
Deleting your account
You can delete your account at any time from your account settings. When you do, we permanently delete your projects, citations, and related account content from our active database; encrypted backups age out within 30 days. We do not currently guarantee immediate deletion of every temporary uploaded-paper artifact after failed or interrupted processing, every usage or audit record, or material already transmitted to an AI gateway and a downstream model provider. We keep one minimal record that the deletion happened (your former account number, a one-way hash of your email address, and the date) so we can later confirm whether and when your data was removed; it contains no name, email address, or content. If you have ever paid for a plan, we keep your subscription and transaction records for disputes and for our financial records. Your account stays attached to them only as a number: your name, email address, password, and security settings are removed from it. We also keep, for 90 days, a short log of the notifications the payment provider sends us: what happened and its reference numbers, with no name, email address, or card details. The payment provider also keeps its own records under its policies. If you would like help deleting your account or data, contact us at support@citationcreation.com.
Changes and contact
We may update this policy from time to time to reflect changes in our practices or the law. When we make a significant change, we will update the date at the top of this page and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.
If you have any questions about this policy or how we handle your information, please contact us at support@citationcreation.com.
