Data processing agreement

Our standard terms for handling the data you give us. They apply automatically when you use Citesheet. If you need a signed copy, or want to use your own DPA, email us.

Last updated 23 October 2026.

1. Who is who

“You” are the company that uses Citesheet and decides what data to upload (the controller). “We” are Citesheet, processing that data only on your behalf (the processor). This agreement is part of our terms; if the two disagree about your data, this agreement wins.

2. What we process and why

• Data: the documents, questionnaires and answers you upload or create, and the names, job titles and email addresses of your users. Your documents may contain personal data, such as names of staff in a policy.
• Purpose: to answer your questionnaires from your documents, show you the proof, and run and secure the service. Nothing else.
• Duration: until you delete the data or your account, plus the periods in section 7.

3. Your instructions

We process your data only as you instruct us through the product, these terms and your written requests. If we believe an instruction breaks data protection law, we tell you. We never sell your data or use it to train AI models.

4. Confidentiality and security

Only people who need access to run the service have it, and they are bound to keep it confidential. We keep the measures described on our security pagein place, and we do not reduce them.

5. Subprocessors

You allow us to use the companies listed on our subprocessors page. We give each of them obligations at least as protective as these. We tell you at least 30 days before adding or replacing one that handles your documents; if you object on reasonable grounds and we cannot resolve it, you may stop using the service and we delete your data. We remain responsible for our subprocessors.

6. Helping you

• If someone asks you to access, correct or delete their personal data, we help you do it (most of it you can do yourself in the app).
• We give you the information you reasonably need for your own security reviews and data protection assessments, and we answer reasonable questionnaires about our security once a year.

7. Deleting your data

You can delete documents, questionnaires or your whole company in the app at any time; they are erased from our systems within minutes. Database backups, once we are on Supabase Pro, are kept for at most 7 days. An audit log of actions (ids and times, no document text) is kept for one year. When you leave, we delete everything unless the law requires us to keep it.

8. Breaches

If we become aware of a breach affecting your data, we tell you without undue delay and within 72 hours, with what we know, what we are doing about it, and a contact. We keep you updated as we learn more.

9. Transfers

Your data is stored and processed in the United States and by the providers listed on the subprocessors page. Where the law requires safeguards for such transfers (for example the EU Standard Contractual Clauses), we put them in place with you and with our providers.

10. Liability and law

Liability under this agreement follows the limits in our terms. This agreement is governed by the same law as our terms.

Want this signed, or prefer your own DPA? Email hello@citesheet.com.