Privacy Policy

“Account Data” means information about your account and your authorized users: name, business email, organization, authentication identifiers, billing details, and support correspondence.

“Service Data” means technical and operational data the Services generate about the configuration, access, use, performance, availability, and security of the Services — logs, telemetry, diagnostic and error records, feature and event counts, latency and cost metrics, and metadata about interactions with Customer Content, such as whether a generated suggestion was accepted, edited, or dismissed, and how often an item is opened. Service Data excludes Customer Content itself. We do not derive Service Data by analysing the substance of your recordings, transcripts, documents, or the outputs generated from them.

“Customer Content” means the research materials you submit — recordings, transcripts, documents, and the outputs generated from them. Customer Content does not include Service Data. This Policy does not cover Customer Content.

“De-identified” has the meaning given in Cal. Civ. Code §1798.140(m). It does not mean that data is anonymous for the purposes of the GDPR.

Our legal bases are performance of our contract with you, our legitimate interest in operating, securing, measuring and improving the Services and in developing new features, and compliance with legal obligations. You may object to processing based on our legitimate interests by contacting privacy@citaria.com.

The purposes listed for Service Data apply to Service Data generated on or after 4 August 2026.

Our commitments on Service Data. We do not attempt to re-identify any individual, customer, or research participant from de-identified or aggregated Service Data; we do not combine Service Data with data sets obtained from third parties in order to re-identify anyone; and we disclose Service Data outside Citaria only to our service providers acting on our behalf under written data protection terms, or in aggregated form that does not identify any customer, authorized user, or research participant.

We use service providers to operate the Services. The current list, and the data protection terms that apply to each, is published at citaria.com/trust#sub-processors.

We do not sell Account Data or Service Data, and we do not share either for cross-context behavioural advertising.

Account Data and Service Data are processed in the United States. Where personal data originating in the EEA, the UK, or Switzerland is transferred, we rely on the Standard Contractual Clauses as described in our DPA.

We keep Account Data and Service Data for as long as your account is active, and afterwards only as long as needed for the purposes described above or as required by law — for example, billing records for tax purposes.

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your Account Data and Service Data, and to object to or restrict certain processing.

To exercise them, contact privacy@citaria.com. We will acknowledge your request and act on it within the period the applicable law allows — one month under the GDPR, and the period set by your state’s law in the United States — and will tell you if we need an extension that the law permits. We assemble copies of Account Data and Service Data manually on request.

If you are dissatisfied, you may complain to your supervisory authority.

If you took part in an interview and your words appear in Citaria, we did not obtain your information from you, and we have no relationship with you. We hold it only on behalf of the organization that conducted the research — our customer — who decides what happens to it.

Please direct any request about your information to that organization. If you contact us, we will ask you which organization conducted the research so that we can forward your request to it, and we will tell you once we have. We do not search our customers’ content to locate you, because we may only process that content on our customers’ instructions. We will not disclose your information to you directly, because we cannot verify who you are.

This section describes Customer Content, which this Policy otherwise does not cover. We include it here because you are unlikely to have another way to learn it. Our handling of Customer Content is governed by our agreement with the organization that submitted it and by that organization’s instructions, not by this Policy.

Our customers can publish an analysis to a link that anyone holding it can open without signing in. Where a customer does this, the transcript of any recording cited in that analysis, and playback of that recording, become available to anyone holding the link. The customer decides whether to publish; Citaria does not. A published link stops working when the customer un-publishes it or deletes the material, except that a media playback link already issued continues to work for a limited period after that.

This section describes Customer Content, which this Policy otherwise does not cover. We include it here because you are unlikely to have another way to learn it. Our handling of Customer Content is governed by our agreement with the organization that submitted it and by that organization’s instructions, not by this Policy.

We use cookies that are necessary for the Services to work — principally to keep you signed in.

We use speaker separation only within a single recording: the speaker labels our transcription provider returns are applied to that recording alone. Our transcription provider states that speaker embeddings are created on a recording-by-recording basis and are not retained after the transcript is returned to us. Citaria does not store voice prints and does not match speakers across recordings. In our pipeline, participant names are resolved from the transcript text and from the named-entity list our transcription provider returns with it — not by matching voices.

This section describes Customer Content, which this Policy otherwise does not cover. We include it here because you are unlikely to have another way to learn it. Our handling of Customer Content is governed by our agreement with the organization that submitted it and by that organization’s instructions, not by this Policy.

We will post any change here and update the date above. If a change materially affects your rights, we will notify you.

privacy@citaria.com
Citaria, Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, United States