1. Scope
This policy applies to CiteRep accounts, workspaces, support, billing, report generation, and our public website. We aim to manage personal information transparently and consistently with the Australian Privacy Principles where they apply.
2. Information we collect
- Account information: name, email address, password hash, account status, and authentication records.
- Workspace information: organisation names, memberships, roles, invitations, sites, and settings.
- Billing information: Guapocado and Stripe customer and transaction references, products, token balances, usage, refunds, and subscription status. We do not store full card details.
- Support information: messages, attachments or references, and actions taken to resolve a request.
- Service and device information: IP address, user agent, security events, session data, coarse in-app activity, and operational logs.
- Audit information: public URLs and webpage content, extracted facts, report findings, AI prompts and responses, model usage, and cost telemetry.
3. How we collect information
We collect information directly from you, from people who invite you to a workspace, from public websites you ask us to audit, from Guapocado and Stripe when you transact, and automatically when you use the service.
4. Why we use it
We use information to:
- provide accounts, workspaces, audits, reports, support, and billing;
- authenticate users and enforce permissions, daily allowances, and report-token balances;
- operate AI-assisted analysis and measure report cost and quality;
- send transactional messages such as password resets and report notices;
- detect abuse, secure the service, troubleshoot, and meet legal duties;
- improve the service using aggregated or de-identified operational information.
We do not sell personal information or use audit content to build advertising profiles.
5. Disclosure and overseas processing
We disclose information only as needed to operate the service, on your instruction, with your consent, or where legally required. Our current provider categories and locations are listed on the Subprocessors page. Providers may process information in Australia, the United States, Europe, and other locations where they or an AI model provider operate.
6. AI processing and automated decisions
CiteRep sends selected public website content and system-generated questions to configured AI model providers to produce website analysis. Reports concern website readiness and do not make decisions that determine an individual's legal rights or access to essential services. Administrators, rather than AI models, decide account bans, refunds, and support outcomes.
7. Retention
- AI call traces containing prompts and responses are scheduled for deletion no later than 90 days after creation.
- Reports, findings, workspace configuration, and support history remain while the account or workspace is active, unless deleted earlier.
- Session records expire automatically. Operational logs are retained only for the period needed for security and troubleshooting.
- Billing records may be retained after account closure where required for tax, accounting, fraud prevention, or dispute handling.
Backups and provider caches may take a limited additional period to cycle out. See our Crawler and Data Retention Policy for audit-specific details.
8. Security
We use access controls, scoped workspace permissions, encrypted transport, managed infrastructure, and audit logging appropriate to the nature of the information. No system is completely secure. Please report suspected vulnerabilities through our security policy.
9. Access, correction, and deletion
You can update some account and workspace information in the service. To request access, correction, export, or deletion of personal information, email privacy@tensabyte.com or open a support ticket. We may verify your identity and may retain information where the law requires or permits it.
10. Complaints
Send a privacy complaint to privacy@tensabyte.com. Describe the issue and the outcome you seek. We will acknowledge and investigate it within a reasonable period. If you are not satisfied, you may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au.
11. Cookies and local storage
We currently use only storage necessary for authentication, workspace selection, security, and responsive application state. Details are in our Cookie Notice.
12. Children and changes
CiteRep is intended for business users and not for children under 16. We may update this policy as the service or law changes. Material changes will be identified by a new version date and, where appropriate, notified in the service.