Data Processing Agreement

The processor under this agreement is DocumentMind LLC, registered in Cheyenne, Wyoming, United States, which operates CiteTrue. The controller is you — the account holder submitting documents that belong to other people.

This Data Processing Agreement forms part of the Terms of Service at /terms. It applies whenever we process personal data on your behalf, which in practice means one thing: you are checking work that is not your own.

A researcher verifying the reference list of their own manuscript does not need this document — there we are the controller of your account data and the Privacy Policy at /privacy governs it. A supervisor screening a cohort of dissertations, an editor checking submitted papers, or a team using a shared CiteTrue plan is a different matter: the authors of those documents are data subjects, you decide what gets submitted, and we act on your instructions. That is where this agreement bites.

We process the documents you submit for one purpose: to produce the verification result you asked for and keep it available in your account. Extracting the reference list, querying scholarly databases, asking a language model whether a matched record supports the citing claim, and storing the outcome — that is the whole of it.

We do not train models on your documents, do not use them to build any product other than your result, and do not disclose them to anyone beyond the sub-processors listed below.

If an instruction from you would in our view breach data protection law, we will tell you rather than carry it out.

Access to production systems is limited to the people who need it to operate or support the service, and everyone with access is bound by a duty of confidentiality that survives the end of their engagement. Unpublished manuscripts are the most sensitive thing this service touches, and they are treated that way.

We maintain the following technical and organisational measures. They are described honestly: this is what a small, focused service actually does, not a list copied from a larger company.

• All traffic is encrypted in transit with TLS. Documents, results and account data are encrypted at rest.
• The database is never queried from the browser. Every read and write goes through our server, which scopes it to the authenticated account before it reaches the database.
• API keys are scoped to the account that issued them and can be revoked by their owner at any time.
• Uploaded documents are stored in private object storage and are served only through short-lived signed links to their owner.
• Access to production systems is limited to the people who operate the service, and is used for operating it — not for reading customer documents.
• The verification service runs separately from the website and the database, and holds no public write path into either.
• Automatic database backups are retained on a rolling window by our database provider.

You give general authorisation for us to engage the sub-processors below. We will update this page before adding or replacing one, and you may object on reasonable data protection grounds — in which case you may stop using the affected part of the service and we will refund the unused part of your period.

The language-model providers deserve a specific note, because they are the ones that see passages of your documents. They are used over their commercial APIs to judge whether a cited source supports a claim. Nothing is sent to them for training.

Processing takes place in the United States. Where you or the authors whose work you submit are in the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914, module two, controller to processor), together with the UK International Data Transfer Addendum where the UK GDPR applies. Those clauses are incorporated into this agreement by reference and prevail over it in the event of conflict.

Most of what a controller needs is self-service: verifications and their results are visible, exportable and deletable from /dashboard, and deleting a verification removes the document behind it from your account.

Where an author contacts us directly about a document you submitted, we will not answer substantively — we will refer them to you, because you are the controller. For anything the dashboard cannot do, and for help with a data protection impact assessment or a consultation with a supervisory authority, write to us and we will assist within the scope of the service.

If we become aware of a breach affecting personal data we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware, with what we know about the nature of the breach, the categories and rough number of records involved, the likely consequences, and the steps taken. Notifying your own supervisory authority and the affected people, where required, remains your decision as controller.

You can delete any verification, and the document behind it, at any time from /dashboard. Deleting your account removes your verification history, results, profile, credits and API keys.

On termination we will, at your choice, delete or return the personal data we hold for you. Export what you need first — results are exportable from the dashboard and through the API.

On reasonable written request, and no more than once a year unless a supervisory authority requires otherwise, we will provide the information needed to demonstrate compliance with this agreement. Where an on-site audit is genuinely necessary, we will agree scope and timing in advance so it does not disrupt the service or expose other customers’ documents.

Where this agreement conflicts with the Terms of Service, this agreement prevails for matters of personal data processing. Where the Standard Contractual Clauses conflict with either, the Clauses prevail.