BrowsePublish an asset

Data protection

Privacy policy

This policy explains which personal data Cite Supply processes, why it is needed, where it is handled, and which choices and rights you have.

1. Controller

Schayan Yousefian
SeitenHafen361, sole proprietorship
Freienwalder Str. 34
13359 Berlin, Germany

Email: info@citesupply.com

2. Hosting, delivery, and security logs

Cite Supply is deployed on Cloudflare's infrastructure. Cloudflare Workers delivers the application; D1 stores relational application data; R2 stores submitted preview images; Analytics Engine receives compact embed-usage measurements; and Cloudflare security, DNS, and network services protect and deliver the website.

When you request a page, technical data such as IP address, date and time, requested URL, response status, referrer, user agent, and security signals can be processed to deliver the request, diagnose errors, prevent abuse, and maintain the service. The legal basis is Article 6(1)(f) GDPR (secure and reliable operation) and, where necessary to provide an account feature, Article 6(1)(b) GDPR.

Cloudflare acts as a processor for the configured services. Processing can take place through Cloudflare's global network, including outside the EEA. Cloudflare's Data Processing Addendum describes safeguards including the EU Standard Contractual Clauses. See Cloudflare's Data Processing Addendum and sub-processor list.

3. Cloudflare Web Analytics

Cite Supply uses Cloudflare Web Analytics, including Real User Measurements (RUM), to understand how public pages are used and how they perform in visitors' browsers. The Cloudflare beacon can process the requested hostname and path, referring hostname, country, browser, operating system, device type, navigation type, page-load timings, and Core Web Vitals. Cloudflare Web Analytics does not record URL query strings.

The beacon does not set analytics cookies and Cite Supply does not use a persistent browser identifier for this measurement. The information is used for aggregate traffic and performance analysis, troubleshooting, and improving the service—not for cross-site advertising or user profiling. Cloudflare describes Web Analytics as a privacy-first service that does not collect or use visitors' personal data.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in measuring whether the public service is used, detecting technical problems, and improving page performance. Cloudflare processes the measurements as our service provider and makes Web Analytics data available in the dashboard for up to six months. The beacon may not run when it is blocked by a browser, extension, or network setting. See the official Cloudflare Web Analytics documentation and Cloudflare's Privacy Policy.

4. Google Analytics 4

If you consent, Cite Supply uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The purpose is audience measurement: understanding how many people visit the public pages, which pages they view, where visits come from, and how visitors move through the site, so that content and navigation can be improved.

Google Analytics is loaded only after you click "Accept" in the cookie banner. Before that, and whenever you decline, no Google script is loaded and no data is sent to Google. Google Analytics is never loaded on sign-in, creator dashboard, submission or admin pages, and never inside Cite Supply embeds shown on other websites. We use Google Consent Mode v2 with all consent types set to "denied" by default; only analytics storage is granted after your consent. Advertising storage, ad personalisation, and Google signals are disabled. IP addresses are not logged or stored by Google Analytics 4.

When active, Google Analytics sets the cookies _ga (distinguishes browsers, lifetime 2 years) and _ga_<container-id> (keeps the session state, lifetime 2 years) and processes usage data such as the pages visited, referrer, approximate location derived from the IP address, browser, operating system, device type, screen resolution, and time of visit. Event-level data is retained in Google Analytics for 2 months and then deleted automatically. User-level data tied to the pseudonymous browser identifier is kept for up to 14 months after your last visit. Aggregated reports without personal data are not affected by these limits.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG (formerly TTDSG). Google may process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision under Article 45 GDPR; in addition, Google relies on the EU Standard Contractual Clauses.

Your choice is stored in your browser's localStorage. You can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer of every page; the Google Analytics cookies are then deleted and no further data is sent. See Google's Privacy Policy and data processing terms.

5. Accounts and sign-in

Creator accounts can use GitHub or Google OAuth. When you choose a provider, you are redirected to that provider and it learns that you are attempting to sign in to Cite Supply. We receive the provider account identifier and, depending on the provider and your settings, display name, website URL, verified email address, and verification status. We store linked sign-in identities so that you can return to the same profile.

Authentication uses secure, HttpOnly, SameSite cookies for the signed-in session and short-lived OAuth state, nonce, or account-linking checks. The regular session cookie lasts up to 30 days. These cookies are necessary to provide the sign-in and account service you request; they are not used for advertising.

The legal basis is Article 6(1)(b) GDPR for account access and Article 6(1)(f) GDPR for fraud prevention and account security. GitHub and Google independently process data under their own privacy policies when their services are used: the GitHub Privacy Statement and Google Privacy Policy.

6. Search, asset actions, and embed measurements

To improve search quality and show creators useful demand signals, we record search wording, normalized search wording, result counts, displayed asset identifiers and positions, detail views, source clicks, and embed or citation copy actions. A random identifier groups events only within the current browser page session. It is kept in memory and is not written to cookies, localStorage, or sessionStorage.

When a Cite Supply embed is actually requested inside an iframe, we count the load. If a referring publisher origin is available, it is stored as a deterministic SHA-256 hash instead of in plain text. Missing or suppressed referrers still increase the aggregate load count but do not create a publisher-site count. We do not store the referring page path in this process.

These measurements are based on Article 6(1)(f) GDPR: understanding whether search and publishing features work, protecting the service from manipulation, and reporting aggregated performance to creators. They are not used for cross-site advertising or sold to data brokers. You can object through the contact address above.

7. Submissions, scans, and preview images

When you submit an asset, we process the canonical, embed, attribution, and preview URLs; title and description; source identity; rights declarations; Creator Terms acceptance; technical scan results; account identifier; review history; and related timestamps. If you upload a preview, the image and technical metadata are stored in Cloudflare R2. Automated scanners may retrieve the public URL you provide and record availability, metadata, embed restrictions, and a temporary preview.

Processing is necessary to perform the creator agreement under Article 6(1)(b) GDPR and to protect the marketplace and publishers under Article 6(1)(f) GDPR. Public listing data and approved previews are visible to visitors. Do not submit credentials, private URLs, or personal data that should not be published.

Some preview images and embeds are delivered directly by the named data source or the creator's approved host. Loading that content sends a request to the external host, which can receive technical request data such as your IP address, user agent, and the requested resource. Opening a source link also transfers you to that provider. The external provider is responsible for its own processing and terms.

Cite Supply does not intentionally use third-party media for behavioural advertising. Asset pages identify the source. Opening some pages automatically loads an approved source preview; interactive embeds load only when the corresponding preview or embed is opened.

9. Email and reports

Messages sent to info@citesupply.com are processed with the sender address, message, attachments, and related correspondence to answer the request, handle a rights notice, or establish, exercise, or defend legal claims. Cloudflare Email Routing forwards incoming mail to a verified destination mailbox; that mailbox provider also processes the message for delivery and storage.

The legal basis is Article 6(1)(b), Article 6(1)(c), or Article 6(1)(f) GDPR depending on the request. Do not send passwords or unnecessary sensitive information.

10. Cookies and browser storage

Public browsing does not use Cite Supply advertising cookies. Cloudflare Web Analytics does not set analytics cookies or persist an analytics identifier in browser storage. Google Analytics cookies are set only after you accept them in the cookie banner (see section 4); your choice is remembered in localStorage under citesupply-analytics-consent-v1 and can be changed at any time via "Cookie settings" in the footer. Necessary authentication cookies are set only when you start or use sign-in, account linking, or the creator dashboard. Because these cookies provide an expressly requested security and account function, they are treated as strictly necessary under Section 25(2) TDDDG.

11. Recipients and international transfers

Data is disclosed only where needed to operate the service, comply with law, or protect legal rights. Relevant recipients can include Cloudflare and its sub-processors, Google if you consent to Google Analytics, the selected OAuth provider, the destination email provider, professional advisers, and authorities where disclosure is legally required. Approved listing content is public.

Where data is transferred outside the EEA without an adequacy decision, the transfer is based on an applicable safeguard such as the EU Standard Contractual Clauses, plus supplementary measures where required.

12. Retention

  • Authentication sessions expire after no more than 30 days.
  • Account, submission, and listing records are kept while the account or listing is active and afterwards where needed for contractual, security, evidence, or statutory retention purposes.
  • Public preview images are retained while used by a listing. Unreferenced R2 previews are tracked by a safety process and become eligible for deletion only after the configured retention and confirmation periods.
  • Search and asset events, embed aggregates, hashed publisher origins, scan jobs, and operational logs are kept only for the period needed for product analysis, security, troubleshooting, and abuse prevention, then deleted or aggregated.
  • Cloudflare Web Analytics data is available through the service for up to six months.
  • Google Analytics event data is retained for 2 months and user-level data for up to 14 months after the last visit; the _ga cookies expire after 2 years or when you withdraw consent.
  • Correspondence is retained until the request is resolved and longer only where legal claims or statutory duties require it.

13. Your rights

Subject to the GDPR's conditions, you can request access, correction, deletion, restriction, data portability, and information about recipients. You can object to processing based on Article 6(1)(f) GDPR. Where processing relies on consent, you can withdraw it for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the competent Berlin authority is the Berlin Commissioner for Data Protection and Freedom of Information. You can find its current contact details on the authority's official website.

Send requests to info@citesupply.com. We may need information to verify that the request relates to you. There is no solely automated decision-making producing legal or similarly significant effects.

14. Changes

We update this policy when the service, providers, or legal requirements change. The current version is published here. Last updated: 1 November 2026.