This Privacy Policy explains what personal data we collect when you use Citalira, why we use it, who we share it with and the rights you have.
1. Who is responsible for your data
[Company legal name], trading as Citalira, registered office at [Registered address] (“we”, “us”), is the controller of the personal data described in this policy, except where section 3 says we act as a processor. For any privacy question or request, contact us at [Privacy email].
2. Personal data we collect as a controller
- Account data: your name, email address, a securely hashed password, and whether you confirmed your email.
- Security and sign-in data: records of your sign-in sessions, the browser user agent, and a one-way hash of your IP address that we use to detect abuse. We do not keep your IP address in readable form in these records.
- Site and usage data: the address of each website you connect, the versions of WordPress, the plugin and your booking plugin, the number of AI interactions used, and aggregate counts of conversations and bookings.
- Billing data: your plan, purchases, their status and amounts, and the identifiers Paddle gives us. Paddle collects your payment details; we never receive or store your full card number.
- Communications: messages you send us and our replies.
- Newsletter: if you subscribe to Citalira news, your email address and the record of your confirmation.
- Technical data: server and error logs that may include request details and identifiers, kept for a limited time for security and troubleshooting.
3. Visitor data we process on behalf of our customers
When a business uses Citalira Cloud on its website, the messages its visitors send to the assistant, the assistant’s replies, and details a visitor gives to book an appointment, such as their name, are processed by us on behalf of that business. Before a message reaches us, the plugin replaces visitors’ email addresses and phone numbers with placeholders and keeps the real values on the business’s website; a contact detail written in a format the plugin does not recognise may still reach us. For this data the business is the controller and we are its processor, so its own privacy notice applies and requests should go to the business first. We process this data only to provide the Service to the business.
We do not receive visitors’ IP addresses: the plugin sends us only an opaque key derived from it with a secret that stays on the business’s website. Conversation content is deleted 30 days after the last message in the conversation, or earlier if the business deletes it. Data the booking system returns for a reply, such as services, staff and available times, is deleted after 7 days. The business can erase a visitor’s conversations through the WordPress privacy tools; the plugin deletes them in Citalira as well.
4. Why we use your data and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account and provide the Service | Account, site and usage data | Performance of our contract with you |
| Process purchases, subscriptions and refunds with Paddle | Account and billing data | Performance of our contract; legal obligations |
| Send service emails (email confirmation, password reset, balance and billing notices) | Account data | Performance of our contract |
| Keep the Service and accounts secure and prevent fraud and abuse, including repeated free Pilots | Security and sign-in data, technical data | Our legitimate interest in protecting the Service and our customers |
| Fix errors and improve the Service | Technical, site and usage data | Our legitimate interest in a reliable product |
| Answer your questions | Communications | Performance of our contract; legitimate interest |
| Send Citalira news | Newsletter data | Your consent, which you can withdraw at any time |
| Keep accounting records and comply with the law | Billing data | Legal obligation |
We do not sell personal data, use it for advertising, or use customer or visitor data to train AI models.
5. Who we share data with
We share personal data only with the following recipients, and only as needed for the purposes above:
- Paddle (Paddle.com Market Limited and its affiliates), our reseller and Merchant of Record, which processes your purchases, payments, taxes, invoices and refunds as an independent controller under its own privacy policy.
- OpenAI, which provides the AI models that generate the assistant’s replies and receives the conversation content needed for each reply, with visitors’ email addresses and phone numbers already replaced by placeholders.
- Resend, which delivers our emails.
- Cloudflare, whose Turnstile challenge protects sign-up, sign-in and other forms from bots and processes browser and device signals to do so.
- [Hosting provider], which hosts our servers and databases in [Hosting region].
- Professional advisers such as lawyers and accountants, under a duty of confidentiality.
- Authorities such as law enforcement, regulators and courts, where we are required by law or need to protect our rights.
- A buyer or successor if our business is reorganised, merged or sold, under equivalent protections.
Our service providers act as processors on our instructions under written agreements, except Paddle as described above.
6. International transfers
Some of our providers process data outside the UK and the European Economic Area, including in the United States. Where this happens, we rely on an adequacy decision or regulations where available, or on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum or Agreement, together with additional safeguards where needed.
7. How long we keep data
- Account data: for as long as your account is open. When you delete your account in the dashboard, your sites are disconnected and their conversations erased at once, and the account is erased for good after a 14-day grace period that protects against mistakes.
- Sign-in sessions: a session stays valid for up to 30 days; its record is then kept only as long as needed to investigate security incidents.
- Visitor conversations (processed for customers): 30 days after the last message, or earlier if the customer deletes them; booking system data used for a reply, after 7 days.
- Billing records: for as long as tax and accounting law requires, usually six to ten years. Records of AI interactions used are kept for accounting without conversation content.
- Newsletter data: until you unsubscribe or withdraw consent; unconfirmed sign-ups are removed automatically.
- Logs and error reports: for a limited period, typically no more than 90 days.
8. Your rights
Depending on where you live, including under the UK GDPR and the EU GDPR, you have the right to access your personal data, have it corrected, have it erased, restrict or object to our processing, receive it in a portable format, and withdraw consent at any time where we rely on consent. To exercise these rights, email [Privacy email]. We will respond within one month, which may be extended by two further months for complex requests, as the law allows. We may need to confirm your identity first.
You also have the right to complain to a data protection supervisory authority, such as the UK Information Commissioner’s Office or the authority in the EU country where you live or work. We would appreciate the chance to address your concern first.
If you are a visitor of a website that uses Citalira, please contact that business to exercise your rights over the conversation data; we will help it respond.
9. Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit, encryption of secrets at rest, hashed passwords and identifiers, access controls, and keeping only the data we need. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires.
10. Cookies and browser storage
Our website uses only cookies that are strictly necessary for it to work: a session cookie and an XSRF-TOKEN cookie that protects forms against cross-site request forgery. When you sign in to the dashboard, your session tokens are kept in your browser’s session storage and removed when you close the tab or sign out, which also ends the session on our servers. Cloudflare Turnstile may use browser storage to tell people from bots on our forms. We do not use analytics or advertising cookies. Because these are strictly necessary, we do not ask for cookie consent; you can block cookies in your browser, but parts of the site may then stop working.
11. Children
Citalira is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18 as a customer.
12. Changes to this policy
We may update this policy from time to time. We will show the date of the latest change at the top of this page and, if a change is significant, tell customers by email or in the dashboard.
13. Contact
[Company legal name]
[Registered address]
Privacy requests: [Privacy email]