Privacy Policy

This Privacy Policy explains how Citely Limited (“Cite”, “we”, “us”) collects, uses and safeguards personal data when you use our platform at cite.citely.co.uk. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We take data protection seriously. If you have questions or want to exercise any of the rights below, please contact us at privacy@citely.co.uk.

1. Who we are

Cite is a trading name of Citely Limited, a company registered in England and Wales under company number 17304722. Our registered office is at Office 1, Izabella House, 24-26 Regent Place, Birmingham, B1 3NJ.

Citely Limited is registered as a data controller with the UK Information Commissioner's Office under registration number ZC196287, effective 13 October 2026 and due for renewal on 12 October 2027. For formal data-protection enquiries — subject access, rectification, erasure, portability or objection — contact dpo@citely.co.uk. General privacy queries can go to privacy@citely.co.uk.

2. What personal data we collect

We only collect data that we need to operate the service and that you have knowingly provided. The categories we hold are:

3. How we use your data (lawful bases)

We rely on the following lawful bases under UK GDPR Article 6:

• Contract — to provide the Cite service you have signed up for: creating portfolios, issuing and receiving Cites, generating tailored CVs, sharing public pages.
• Legitimate interests — to improve the platform (aggregate analysis of feature usage), to detect and prevent fraud or abuse, to maintain security and system integrity. We balance these interests against your rights and give you controls where feasible.
• Consent — for non-essential cookies (analytics, marketing) and for marketing emails. You may withdraw consent at any time via the cookie preferences or your account settings; withdrawal does not affect the lawfulness of processing done beforehand.
• Legal obligation — where we must retain records to meet statutory, tax or regulatory duties.

4. Automated processing and AI

We use large language models (LLMs) to help analyse job descriptions, extract structure from CV uploads, and surface signals from the evidence you provide. These models produce suggestions, which you review before anything is published to your portfolio or a shared Signal Card. No decision that materially affects you is made without a human in the loop.

Our current LLM providers are OpenAI, Anthropic and OpenRouter. Requests to these providers are made over encrypted channels and the content of uploaded documents may be transmitted to them for the sole purpose of generating the requested output. We do not permit providers to train models on your data under our commercial agreements with them.

5. Sharing your data

We share personal data with a limited set of processors who help us run the service:

• Infrastructure: cloud hosting, database, CDN and content delivery.
• LLM providers: as described above, strictly for the purpose of generating the output you have requested.
• Identity: LinkedIn (for OIDC sign-in) and Google (if you choose Google sign-in).
• Email and messaging: when these services are wired we will update this list.

We do not sell personal data. We do not share your data with third parties for their own marketing purposes.

6. International transfers

Some of our processors (notably LLM providers) are based in the United States. Transfers outside the UK are protected by the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and where applicable the Data Privacy Framework adequacy decision. A copy of the safeguards in place is available on request from privacy@citely.co.uk.

7. How long we keep data

• Active accounts: for as long as your account is active and we have a legitimate purpose to retain the data.
• Deleted accounts: hard-deleted within 30 days of your deletion request, except where law or a legitimate interest (for example, fraud prevention records) requires longer retention.
• Backups: encrypted backups are retained for up to 35 days before rotation.
• Consent and audit logs: up to 6 years, aligned with limitation periods under UK law.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (export via Account settings).
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data; see the deletion flow in Account settings.
• Restriction of processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection to processing based on legitimate interests.
• Withdraw consent at any time.

To exercise any of these rights, email dpo@citely.co.uk. We will respond within one month, as required by UK GDPR. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to resolve any concerns directly first.

9. Security

We implement technical and organisational measures proportionate to the risk, including TLS in transit, encrypted storage at rest for sensitive fields, access controls, security headers (CSP, HSTS, frame denial), rate limiting, and audit logging. No system is perfectly secure, but we work continuously to reduce risk and we notify you and the ICO if a breach materially affects your rights.

10. Children

Cite is not intended for anyone under 16. If you believe a child has registered, contact us at privacy@citely.co.uk and we will take appropriate action.

11. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on the platform; the Last updateddate at the top of this page always reflects the current version.