Privacy Notice — Cite
Citely Limited, company no. 17304722, registered in England and Wales.
Last updated: 22 August 2026 ·
Contact: privacy@citely.co.uk
In short
- Your Cite record belongs to you, not your employer. It goes with you when you leave.
- Nobody sees anything about you outside Cite unless you approve it, each time.
- No organisation — including your employer — can write, edit, weight or delete a citation about you.
- We don’t train AI models on your data, and we never sell it.
- We store your data in the UK.
1. Who we are
Citely Limited operates Cite, a platform for verified professional credentials and structured human citations.
For your identity, your verification status and your portable Cite record, we are the data controller. For information an organisation uploads about its own workforce and projects, we act as processor on that organisation’s instructions — their privacy notice governs that data.
2. What we collect
From you: name, work email, professional history, CV or project documents you upload, LinkedIn profile if you connect it, and your account settings.
From identity verification: we use Didit to verify identity. Didit performs the document, liveness and face-match check. We receive only the outcome — whether it passed, the method, and when. We never receive or store your biometric template or images of your ID.
From others: citations written about you by verified professionals, clients or colleagues; and, if your employer uses Cite, your role, grade, availability and project assignments.
Generated by us: your Authority Score and its components, capability tags extracted from documents you provide, and match results.
3. Why we process it, and our legal basis
| What | Why | Basis |
|---|---|---|
| Your account and profile | To provide the service | Performance of a contract |
| Identity verification | To make citations trustworthy | Your explicit consent (special category data) |
| Publishing citations about you | Because you approved that citation | Consent |
| Matching you to project requirements | To surface you for relevant work | Contract / legitimate interests |
| Inviting client contacts | To let clients cite people they’ve worked with | Legitimate interests |
| Security, fraud and abuse detection | To keep the trust record honest | Legitimate interests |
Your consent is yours alone. Your employer cannot consent on your behalf, cannot enrol you, and cannot see whether you declined. Declining verification means you won’t carry a verified badge — it has no other consequence, and no consequence at all for your employment.
4. AI and automated processing
We use AI to read documents you provide and suggest skills and evidence. You review and approve every extracted item before it appears on your profile.
We do not use your data to train AI models. Model processing is inference-only through an encrypted proxy, and providers do not retain your content for training.
Your Authority Score does not decide anything on its own. A person always reviews and approves before you are proposed for work, and you can see what your score is made of.
5. Who sees what
Your employer, if they use Cite: your profile, your citations, and your availability. They cannot create, edit, weight, hide or delete a citation.
A client, only when you approve it: we produce evidence packs for specific engagements. You approve your inclusion, and which citations appear, every time. Packs expire and can be revoked.
Nobody else. We do not sell your data, share it for advertising, or make your profile publicly searchable without your say-so.
Our processors: hosting (MongoDB Atlas, UK), identity verification (Didit, EU), AI inference providers (OpenRouter to Claude 4.5 Sonnet). A current list is available on request.
6. Where we store it
In the UK — MongoDB Atlas, London region. Encrypted in transit and at rest.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is active, then 12 months |
| Uploaded CVs and documents | 12 months after extraction |
| Citations | Retained as part of the record; see §8 on erasure |
| Verification outcome | Life of account |
| Audit and consent logs | 6 years |
8. Your rights
Access, correction, erasure, restriction, objection, portability, and withdrawal of consent at any time.
On erasure and citations: citations are designed to be tamper-evident, so we don’t silently delete them. If you ask us to erase your data, we remove or irreversibly de-identify everything that identifies you, leaving only a non-attributable integrity record. You can also revoke any individual citation — revocation is recorded openly rather than hidden.
If a citation about you is wrong: tell us. We will contact the issuer, and we can suspend a disputed citation while it is reviewed. We aim to respond within 5 working days.
To exercise any right, contact privacy@citely.co.uk. We respond within one month.
9. Complaints
If you’re unhappy with how we’ve handled your data, please tell us first — but you can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113 at any time.
10. Changes
We’ll post changes here and, where they materially affect you, tell you directly before they take effect.