Privacy Policy

The controllers within the meaning of Art. 4(7) GDPR are:

Dr. Jan Philip Wahle and Lars Kaesberg
Siedlungsweg 24, 37124 Rosdorf, Germany
Email: [email protected]

We are not required to appoint a Data Protection Officer under Art. 37 GDPR and Section 38 BDSG.

We process personal data only to the extent necessary to provide a functional website and the services you request. We do not sell personal data. The following sections describe each processing activity, its purpose, legal basis, and retention period.

Our website and backend services are hosted on servers located in Germany. When you access our site, your browser automatically transmits certain technical data that our web server records in log files:

• IP address of the requesting device
• Date and time of the request
• URL and HTTP method of the request
• HTTP status code returned
• Browser type and version, operating system
• Referrer URL (previously visited page)

Purpose: Ensuring stable operation, security, and abuse prevention.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website).
Retention: Server log files are deleted after 14 days unless further retention is required to investigate a specific security incident.

When you use the Citation Verifier or Citation Updater, you may upload PDF files or paste citation text and BibTeX entries. We process the following data:

• Uploaded PDF files, pasted citation text, and BibTeX content
• Extracted bibliographic metadata (titles, authors, DOIs, arXiv IDs, venue information)
• Processing job status, verification results, and generated exports

PDF files are parsed locally using GROBID, which runs on our own servers and does not transmit your data to any external service.

To verify citations, extracted bibliographic metadata (not the full PDF) is sent to external academic data providers (see Section 6 below).

Content Check and Fix citation. If you purchase the Content Check add-on, we obtain the cited papers from open-access sources (such as arXiv, Unpaywall, or the publisher link found during verification) or use a PDF you upload for this purpose. An AI language model then summarises each cited paper and assesses, for each sentence in your document that cites it, whether the paper supports that sentence. If you use Fix citation, the sentences in your document that cite a reference which could not be found, and candidate records from the academic databases, may be sent to an AI language model so that it can suggest a replacement.

These language-model requests are sent to OpenRouter, Inc., 169 Madison Ave #2404, New York, NY 10016, USA, which processes them on our behalf as a processor under its Data Processing Agreement and forwards each request to an upstream provider that hosts the selected model. We currently use DeepSeek’s V4 Pro model for the Content Check and OpenAI’s GPT-4o mini for Fix citation. We instruct OpenRouter to use only providers that are headquartered in the EU or the USA and that, according to OpenRouter, do not store or use the data for their own purposes; requests are never sent to DeepSeek’s own API or to other providers based in China. OpenRouter does not use the data for model training and, unless prompt logging is enabled for the account, does not store it after routing the request.

Automated classification checks (OpenAI). To make these checks more reliable, our backend sends selected borderline cases to the OpenAI “Decisions” API. This service only classifies: it returns probabilities or a choice between fixed options and does not generate text. Depending on the check, a request contains:

• Matching a reference to a database record: the bibliography entry as written in your document (including its authors, title, and year) and the database record it was matched to
• Reference extraction: bibliography entries from your document that look incomplete or malformed, the neighbouring entries, and the title of your document
• Fix citation: the sentences in your document that cite the reference, and the title, authors, year, and venue of each candidate paper
• Content Check: the title, authors, and year of a cited reference together with the first approximately 3,000 characters of the cited paper’s PDF (retrieved automatically or uploaded by you), to confirm that the PDF is the cited paper; and the sentence in your document that cites the paper together with our summary of the cited paper and, where your citation names a page, an excerpt of that page, to assess whether the paper supports the sentence. This assessment may run alongside the language model described above solely to compare and improve the reliability of our results.

Recipient: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, which processes this data on our behalf as a processor under OpenAI’s Data Processing Addendum (Art. 28 GDPR). OpenAI does not use this data to train its models; it may retain abuse-monitoring logs for up to 30 days. For transfers outside the EEA, see Section 7.

Purpose: Providing the citation checking and updating service you requested, including the Content Check and Fix citation features where you use them, and keeping its results accurate.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures at your request). Classification checks whose results are used only to compare and improve the reliability of our checks are based on Art. 6(1)(f) GDPR (our legitimate interest in accurate and reliable results).
Retention: The source PDF is stored for 30 days after upload so the original-document view remains available, then it is automatically deleted. Extracted text, processing jobs, and analysis results are stored for 90 days so that result pages and exports remain accessible, after which they are automatically deleted.

The BibTeX Formatter runs entirely in your browser. No data you enter into the formatter is transmitted to our servers.

To verify and enrich citation data, our backend queries the following external services:

• Semantic Scholar (Allen Institute for AI, Seattle, USA)
• OpenAlex (OurResearch, USA)
• Crossref (Crossref, USA/UK)
• PubMed / NCBI (National Institutes of Health, Bethesda, USA)
• arXiv (Cornell University, Ithaca, USA)

Only extracted bibliographic metadata (e.g., paper titles, author names, DOIs, arXiv IDs) is sent to these services. We do not intentionally send full uploaded PDFs or personal data of users to these APIs.

In addition, the following AI service providers receive the data described in Section 4:

• OpenAI (OpenAI Ireland Ltd., Dublin, Ireland) — automated classification checks via the Decisions API
• OpenRouter (OpenRouter, Inc., New York, USA) — language-model requests for the Content Check and Fix citation, forwarded to an upstream provider headquartered in the EU or the USA that hosts the selected model (currently DeepSeek V4 Pro and OpenAI GPT-4o mini)

Legal basis: Art. 6(1)(b) GDPR (necessary to provide the service you requested). For the AI service providers, the legal bases stated in Section 4 apply.

The external academic data providers listed in Section 6 are based in the United States. When our backend queries these APIs, our server communicates with servers located in the USA. The transferred data consists of bibliographic metadata, not personal data of users.

To the extent that any personal data is transferred in this process, the transfer to the United States is covered by the EU–US Data Privacy Framework (DPF) adequacy decision of the European Commission of 10 July 2023 (C(2023) 4745). For providers not certified under the DPF, we rely on Art. 49(1)(b) GDPR (transfer necessary for the performance of a contract between the data subject and the controller).

OpenAI: Our contractual partner, OpenAI Ireland Ltd., is located in the EU. OpenAI may transfer data to its affiliates and sub-processors outside the EEA, in particular in the United States. Such transfers are based on agreements containing the EU Standard Contractual Clauses or on an adequacy decision of the European Commission under Art. 45 GDPR.

OpenRouter: OpenRouter, Inc. is located in the United States. The transfer to OpenRouter is based on the EU Standard Contractual Clauses (controller-to-processor module) included in OpenRouter’s Data Processing Agreement. OpenRouter forwards each request to an upstream provider that hosts the selected model; we restrict this to providers headquartered in the EU or the United States that do not store or use the data for their own purposes, and exclude providers based in China.

This website stores the following item in your browser's local storage:

• cookie-consent — remembers whether you accepted or declined analytics, advertising-measurement, and affiliate-attribution cookies. This value is set only when you interact with the cookie banner.

This storage is technically necessary to honour the consent choice you expressly made and is exempt from consent under Section 25(2) No. 2 TDDDG.

In addition, if you consent via the cookie banner, the first-party cmt_affiliate cookie stores the last valid affiliate code for 60 days so a qualifying purchase can be credited to the referring partner. Google Analytics and PostHog also set analytics cookies (see Section 9 below). With your consent, we also use Google Ads conversion measurement; no advertising cookies are set unless you opt in, and data may be transferred to Google LLC (USA) under the EU–US Data Privacy Framework and/or Standard Contractual Clauses. For details, see our Cookie Policy.

Legal basis (GDPR): Art. 6(1)(f) GDPR (legitimate interest in providing a user-friendly interface) for the consent record; Art. 6(1)(a) GDPR (consent) for analytics and affiliate attribution cookies.

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps us understand how visitors use our website so we can improve its content and usability.

Google Analytics uses cookies and similar identifiers (for example _ga and _ga_<container-id>) to collect information such as:

• Pages visited and actions taken on the site
• Approximate location derived from a truncated IP address
• Device, browser, and operating system information
• Referring URL and session duration

We have enabled IP anonymisation so that IP addresses are truncated within the EU/EEA before being stored, and we have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. Google may transfer data to servers located in the United States.

Purpose: Analysis of website use to improve our services.
Legal basis: Your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. No analytics cookies are set before you accept them in the cookie banner.
Retention: Event and user data retention is set to 14 months in Google Analytics; you can clear the cookies from your browser at any time.
Withdrawal of consent: You can withdraw consent at any time by clearing your browser storage or by using the cookie banner again. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

Third-country transfer: To the extent that personal data is transferred to Google LLC in the United States, the transfer is based on the EU–US Data Privacy Framework adequacy decision of the European Commission of 10 July 2023 (C(2023) 4745), under which Google LLC is certified.

You can prevent Google from collecting and processing this data by installing the Google Analytics opt-out browser add-on available at tools.google.com/dlpage/gaoptout.

We also use PostHog, a product-analytics service provided by PostHog, Inc., 965 Mission St, San Francisco, CA 94103, USA (“PostHog”). We use PostHog’s EU Cloud, which stores data on servers located in the European Union (Frankfurt, Germany). PostHog helps us understand which features visitors use so we can improve our tools.

PostHog uses a cookie (ph_<project-id>_posthog) and similar identifiers to collect information such as:

• Pages visited, clicks, and interactions (autocapture)
• Approximate location derived from a truncated IP address
• Device, browser, and operating system information
• Referring URL

We do not enable session recording, and PostHog creates a person profile only once a signed-in user is identified. We have concluded a data processing agreement with PostHog pursuant to Art. 28 GDPR.

Purpose: Product analytics to understand feature use and improve our services.
Legal basis: Your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. No analytics cookies are set before you accept them in the cookie banner.
Withdrawal of consent: You can withdraw consent at any time by clearing your browser storage or by using the cookie banner again. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

Third-country transfer: Although data is stored in the EU, PostHog, Inc. in the United States may access it for support and operations. Such transfers are safeguarded by the EU Standard Contractual Clauses concluded with PostHog.

When you apply to our affiliate program, we process your legal name, business or publication name (if provided), contact and PayPal email addresses, website and public profiles, audience and promotion-plan descriptions, postal address, terms acceptance, application status, review notes, and a keyed hash of the application network address for abuse prevention. Approved affiliates receive an affiliate code. Dashboard sign-in links are stored only as one-way token hashes with an expiry and use time. We also process a signed dashboard-session identifier and keep delivery status and aggregate figures for monthly affiliate statements.

For an attributed purchase we retain the affiliate application ID, affiliate code association, Stripe checkout and payment identifiers, plan, amount, currency, commission, status and eligibility dates, the customer account ID where available, and a keyed hash of the buyer email. Affiliates do not receive the buyer’s identity or contact data.

Purpose: Reviewing applications, operating attribution, preventing self-referrals and fraud, providing the private affiliate dashboard, sending monthly performance statements, calculating commissions, making PayPal payouts, and keeping accounting and tax records.
Legal basis: Art. 6(1)(b) GDPR (steps at your request and performance of the affiliate agreement), Art. 6(1)(c) GDPR (legal accounting and tax obligations), and Art. 6(1)(f) GDPR (fraud and abuse prevention). The 60-day browser cookie is based on consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The authenticated dashboard cookie is strictly necessary to provide the requested private area.
Recipients: Amazon SES for transactional email and PayPal for payouts. PayPal processes payout data under its own privacy terms and may process data outside the EEA using its applicable legal safeguards.
Retention: Rejected application data is normally deleted within six months unless needed to handle a complaint or prevent repeated abuse. Approved-partner and commission records are kept for the agreement and applicable statutory accounting and tax retention periods, generally up to ten years.

Keyword research and blog maintenance. To plan and maintain our blog, we use search data (search terms, search volumes, competition metrics, and search results) obtained from DataForSEO and, for our own website, from Google Search Console. Search queries and our own published blog posts may be sent to the OpenAI Decisions API (see Section 4) to classify topics and avoid duplicate articles, and our own instructions and posts may be sent to OpenAI to draft articles. This processing does not involve personal data of website visitors.

Partner research and outreach. To find suitable partners for our affiliate program (for example, websites, blogs, and creators who publish about academic writing), we process publicly available information about them: the URL and domain of a web page, its title and search-result snippet or description, link anchor texts, links to competing services, for creators the public channel or account name, and publicly displayed business contact details (such as a business email address or contact-form URL). We obtain this information from search results and backlink data supplied by DataForSEO and from the public web pages themselves. To assess whether a page is relevant, we may send its title, snippet or description, domain or channel name, and link anchor texts to the OpenAI Decisions API for classification; contact details are not sent. We may contact relevant partners about our affiliate program by email.

Purpose: Identifying and contacting suitable partners for our affiliate program.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in promoting our services through relevant partnerships).
Sources and recipients: DataForSEO (search and backlink data), OpenAI Ireland Ltd. (classification; see Sections 4 and 7), and Amazon SES (sending emails).
Retention: We keep prospect records and contact history while a cooperation may be relevant. Entries whose source is older than three years are no longer used for outreach.
Right to object: You can object to this processing at any time by emailing us or by replying to an outreach email. We will then not contact you again and keep only the minimum information needed to honour your objection (such as your email address or domain on a do-not-contact list).

If you contact us by email, we process your email address, name (if provided), and the content of your message to handle your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
Retention: Correspondence is deleted once the inquiry is fully resolved, unless longer retention is required by law.

Under the GDPR you have the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected].

• Right of access (Art. 15 GDPR) — You may request confirmation of whether we process your personal data and obtain a copy of that data.
• Right to rectification (Art. 16 GDPR) — You may request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR) — You may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR) — You may request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Art. 20 GDPR) — You may request to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR) — You may object to processing based on Art. 6(1)(f) GDPR at any time for reasons relating to your particular situation.
• Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR. The competent supervisory authority for our operations is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
Phone: +49 511 120-4500
Email: [email protected]
Website: www.lfd.niedersachsen.de

You are not legally or contractually obligated to provide personal data to us. However, if you do not provide technical request data (which your browser transmits automatically), you cannot use the website. If you do not submit citation data, you cannot use the Citation Verifier or Citation Updater. Affiliate application and payout details are required only if you choose to apply; without them we cannot review the application, enter the affiliate agreement, or make payouts.

Our citation checking tools use automated processing, including the AI-based checks described in Section 4, to parse, verify, and compare bibliographic references and cited content. This processing does not constitute automated decision-making within the meaning of Art. 22 GDPR. The results are purely informational and do not produce legal effects or similarly significantly affect you.

We use industry-standard technical and organisational measures pursuant to Art. 32 GDPR to protect your data, including TLS-encrypted connections (HTTPS) for all data in transit, access controls on our servers, and regular security updates.

We may update this privacy policy when our processing activities, infrastructure, or legal requirements change. The current version is always available at this URL. Material changes will be noted with an updated date at the top of this page.