How CyCite handles personal data

Who is responsible

Encelyte Ltd (HE 481928), Limassol, Republic of Cyprus, is the controller. Write to [email protected] for anything on this page.

The one free question

A visitor without an account may ask the research desk once. To keep that to one question per visitor, the desk records a few first-party signals about the browser and network, each stored only as a salted hash, under our legitimate interest in preventing repeat unpaid use of a metered service (Art. 6(1)(f) GDPR). The signals are an approximation, not an identity: two colleagues on one office network may be read as one visitor, in which case the sign-up card appears, and that is the only consequence. They are used for nothing else, never combined with account data, and never shared.

What is stored, and when

• For everyone: a strictly necessary cookie that keeps you signed in, and a second one that marks a browser after its free question. Both are set by cycite.com only, carry a random identifier rather than a name, and need no consent banner.
• For the free question: salted hashes of a first-party browser fingerprint (canvas, screen, device pixel ratio, time zone, languages, platform, concurrency, device memory), of the network address bucket, of the browser identifier, and of the question text. Never the question itself, never the address itself.
• For account holders: name, email address, password hash, plan and allowance, invoices through Stripe, and the security log of sign-ins (address bucket, browser, time).
• For account holders: your threads, that is each question and its answer with the authorities it cites, so a paid answer is never lost when a tab closes. You can delete any thread on the desk.
• For the desk's own review: which authorities were retrieved and cited for each question, and events such as a question read as outside the desk's brief or a rate-limit refusal.

How long

Free-question signals are deleted after 90 days. Retrieval and guard records are deleted after 12 months. Threads stay until you delete them or close your account. Account data lasts for the life of the account and is deleted within 30 days of closure, except invoices, which tax law requires us to keep. Nightly backups are held for a limited period and then overwritten.

Your questions and the AI model

To draft an answer, the desk sends your question, the earlier turns of the same thread and the passages it retrieved to an AI language-model provider in the United States, through a relay service. Your name, email and account details are never sent with them, and the model provider cannot link a question to you. Do not put into a question anything you are not entitled to disclose. The answer is generated from retrieved material and can be wrong: verify every citation against an alternative source before you rely on it.

Who else handles data

Stripe (payments and invoices; EU and United States). Microsoft 365 (verification and password emails from [email protected]; EU). An AI language-model provider (drafts the answers; United States). Cloudflare (network security and delivery of the site; EU and United States). Our own servers are in the Republic of Cyprus. Where data leaves the European Economic Area it does so under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. No advertising network, no analytics service, no data broker.

Your rights

You may ask for access, correction, erasure, restriction, portability, and object to processing based on legitimate interest. Write to [email protected]; we answer within one month. You may also complain to the Commissioner for Personal Data Protection of the Republic of Cyprus, Nicosia.