What we collect, and what we never will.

CitePark is a research operating system — a workspace for validating a research question, writing and generating LaTeX documents with AI assistance, and keeping the experiments, references, figures and drafts behind a paper in one place.

CitePark is run by an individual, not a company. It is operated by Soumyajit Mondal, based in India and contactable at Kolkata, West Bengal, India, trading as "CitePark" ("we", "us"). No company has been incorporated for it yet, and we would rather tell you that than borrow the language of one.

It changes nothing about your rights. Under India's Digital Personal Data Protection Act, 2023 a data fiduciary is whoever decides why and how personal data is processed — a person or a company alike — so the obligations in this policy are owed to you by the named individual above, personally, and every right in Your rights can be exercised against them.

This policy covers the marketing site at citepark.com and the product application at app.citepark.com. They are one service on two hosts and share one account system, so one policy governs both.

If CitePark becomes a company

We intend to incorporate. When that happens the new company takes over as data fiduciary, and your data moves to it — which is a change you are entitled to know about rather than discover. So: we will name the company on this page and tell you by email before the handover, the new entity will be bound by this policy as it stands until you are given notice of any change, and nothing about what we collect or who processes it changes merely because the operator's legal form has. If you would rather not continue with the new entity, you can close your account and have your data deleted under Your rights.

Information you give us

• Account details. Your email address and a password, or — if you sign in with Google — the name, email address and profile picture Google returns for that account. We never receive your Google password.
• Your research content. Projects, LaTeX documents and their revision history, references and bibliographies, uploaded datasets and figures, diagrams, and the prompts and instructions you give the AI features.
• What you write to us. The contents of support emails and anything you send through the contact form, including whatever you choose to put in it.

Information created when you use CitePark

• Account state. Which plan you are on, whether Premium is active, and the dates the current term runs between.
• Payment records. When you buy Premium we store the Razorpay order and payment identifiers, the plan and billing period you chose, and the date your access runs to. We never receive or store your card number, CVV, UPI PIN or bank credentials — those are entered on Razorpay's checkout and stay with Razorpay.
• Technical and usage data. IP address, browser and device type, pages and features used, timestamps, and error diagnostics. This is the ordinary log data any hosted service produces, and we use it to keep the service working and secure.

What we do not collect

We do not run advertising or third-party analytics trackers, we do not buy personal data from data brokers, and we do not build advertising profiles. We ask for no data that the feature you are using does not need.

CitePark sets no advertising or tracking cookies. What it does store in your browser is the machinery of staying signed in, and it is listed in full:

All of it is strictly necessary to provide the service you asked for. You can clear it from your browser at any time; the effect is that you will be signed out.

We process personal data only for these purposes:

We do not sell personal data, and we do not share it for anyone else's marketing. Where we rely on your consent you may withdraw it at any time — see your rights — and doing so does not undo processing that was lawful before you withdrew it.

Drafting, editing, Unlimited LaTex document and diagram creation and diagram generation work by sending the relevant part of your document, prompt or reference list to an AI model provider, which returns the result. This is the only way those features can work, and it happens only for the request you made.

We do not use your research content to train AI models, and we contract with our model providers on terms that prohibit them from training on content submitted through our account. If that ever changes it will be an opt-in you are asked for explicitly, never a quiet edit to this page.

Two things worth knowing before you paste something in. AI output can be wrong — including citations that look real and are not — so it needs checking; that is covered in the Terms. And if your work is under an NDA, covers patient or personal data, or is otherwise restricted by your institution, satisfy yourself that sending it to a cloud service is permitted before you do.

We run CitePark on infrastructure operated by others. Each of these processes data only on our instructions and only for the purpose listed:

Beyond those, we disclose personal data only when:

• you ask us to, or you share a project with someone yourself;
• the law requires it — a valid order from a court or authority with jurisdiction over us. Where we are permitted to tell you, we will;
• it is necessary to establish or defend a legal claim, or to protect the rights and safety of our users or the public;
• the business is incorporated, merged, acquired or reorganised — in which case the new entity is bound by this policy, and you will be told before anything about it changes. See Who we are.

Some of the providers above operate outside India, so your data may be stored or processed abroad. Where that happens we rely on contractual protections with the provider and transfer only what the service needs, and we do not transfer personal data to any country the Central Government has restricted under the DPDP Act.

• Your account and content — for as long as your account exists. Delete your account and we delete them within 30 days, except where a clause below requires otherwise.
• Backups — deleted content can persist in encrypted backups for up to 90 days before it is overwritten in the ordinary rotation.
• Payment and tax records — kept for as long as tax and company law requires, which is longer than your account may last. These are transaction records, not your research.
• Logs and diagnostics — typically 90 days, longer only where an investigation into abuse or a security incident is open.

Traffic to CitePark is encrypted in transit with TLS, and data is encrypted at rest by our storage providers. Passwords are stored only as salted hashes — we cannot read yours, which is why a reset replaces it rather than reminding you of it. Access to production data is limited to the people who need it to operate and support the service. Payment verification happens on our server against a signature we check ourselves; a tampered browser cannot grant itself Premium.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires. You can help by using a strong, unique password and not sharing your account.

As a Data Principal under the DPDP Act you have the right to:

• Know what personal data of yours we hold, what we do with it, and who we have shared it with;
• Correct data that is inaccurate, and complete data that is not;
• Erase your personal data where we no longer need it for the purpose it was collected for, or for a legal obligation;
• Withdraw consent at any time, with the same ease as it was given;
• Nominate someone to exercise these rights on your behalf in the event of your death or incapacity;
• Complain — to our Grievance Officer first, and to the Data Protection Board of India if we do not resolve it.

Much of this you can do yourself in your account settings. For anything else, write to imsoumyajitmondal@gmail.com from the address on the account and we will respond within 30 days. We may need to confirm it is you before acting, and we will say so if a request is one we are legally required to refuse in part.

If you are in the European Economic Area or the United Kingdom, you also have the rights to data portability, to object to processing based on legitimate interests, and to complain to your national supervisory authority.

CitePark is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to imsoumyajitmondal@gmail.com and we will delete it.

We will update this page when the product changes what it collects or how it is handled. The date at the top moves whenever the substance does. If a change materially affects your rights we will tell you by email or in the application before it takes effect, rather than relying on you to notice.

For any question about this policy, or to exercise a right under it, write to imsoumyajitmondal@gmail.com.

Grievance Officer: Soumyajit Mondal — the operator of CitePark, who answers these personally
Email: imsoumyajitmondal@gmail.com
Address: Kolkata, West Bengal, India

Complaints are acknowledged promptly and resolved within 30 days. If you are not satisfied with the outcome you may complain to the Data Protection Board of India.