Data Processing Addendum
Updated 14 Sep 2026
Roles
This DPA applies when you are a controller (or processor for your client) and CiteBrief processes workspace content as a processor. Account, security, and billing records are processed as a controller as described in the privacy policy.
Instructions
We process brand, prompt, run, and report data only to provide the service, including engine queries, PDF storage, sending, and support. We will not sell that content. Subprocessors are listed publicly and may change with notice on that page.
Security and assistance
Security measures are described on the security page: single-domain auth, tokenized client links, encryption in transit, access logging for admin actions. We will assist with data-subject requests you cannot fulfill in-product (export and deletion request already exist in Settings).
International transfers
Hosting is on Cloudflare. Transfers rely on Cloudflare's published transfer mechanisms. Signed SCCs or a countersigned DPA: email support@getcitebrief.com.
Contact: support@getcitebrief.com