Privacy Notice

The controller is Ashley Tew trading as WhyCited, a sole trader in the United Kingdom.

WhyCited is currently offered only to people who are at least 18 years old and live in the United Kingdom. We ask you to confirm both facts when you create or review your account. The service is not directed at children and we do not knowingly create accounts for anyone under 18. Please contact us if you believe a child has provided data to us.

• Account and eligibility data: your email address, account identifier, plan, the dates and versions of your legal acceptances, and your declarations that you are 18 or over and a UK resident.
• Subscription and payment data: Stripe customer and subscription identifiers, plan, subscription status and billing dates. Stripe processes your card and payment details; we do not receive or store your full card number.
• Usage data: the number and type of analyses used in each allowance period and the identifiers needed to enforce quotas. We also record the model, token counts, response time and estimated provider cost for each model call so we can monitor reliability, capacity and the commercial sustainability of each plan.
• Analysis request data: only after you explicitly ask for an analysis, the current page and linked-source URLs, link text or selected source title or citation marker, matching bibliography entry where relevant, surrounding sentence and paragraph, neighbouring paragraphs, nearest section heading, and visible source metadata such as title, DOI, author, publisher, publication date and description or abstract.
• Analysis and feedback data: the generated result, job identifier, analysis type, confidence and relationship labels, the current and linked source titles and URLs, rating and any optional feedback comment you choose to submit. Completed results are saved to your account so you can reopen your analysis history.
• Technical and security data: IP address, request time, browser or device information, diagnostic logs and security events generated by our infrastructure providers.
• Communications: messages you send us and the contact information needed to reply.

Do not include confidential, unpublished, special-category or other sensitive personal data in an analysis request or feedback comment.

The extension sends no page or source content merely because you visit a page. It sends the data described above only when you invoke Explain why this source is relevant on a source link or selected source title or citation marker. It does not send your browsing history, credentials, form input, cookies or content from other tabs. It does not bypass paywalls.

• To provide the contract: create and authenticate your account, link the extension, run requested analyses, enforce allowances, take payment and manage subscriptions.
• For our legitimate interests: secure and operate the service, prevent duplicate or abusive accounts, diagnose faults, respond to support requests and improve results using feedback. We balance these interests against your rights and minimise the data used. You may object to this processing.
• To meet legal obligations: maintain tax and accounting records, protect consumer rights, respond to lawful requests and prevent or investigate unlawful activity.

We do not sell personal data. We do not currently send marketing emails and do not ask for marketing consent. If that changes, we will provide a separate, optional choice before sending marketing.

To answer your request, our backend may resolve and retrieve openly available sources through public webpages, publisher pages, public web results and scholarly services such as Crossref, arXiv, OpenAlex and Semantic Scholar. The relevant page context and retrieved source are then processed by Google for standard analyses or Anthropic for deep analyses. These services act as providers supporting the requested analysis.

AI output can be incomplete or wrong. WhyCited does not use automated processing to make decisions about you that produce legal or similarly significant effects. The analysis is a research aid for you to assess.

We disclose only the data needed to the following recipients:

• Supabase for authentication, account records and usage metering;
• Vercel for hosting the website and its server routes;
• DigitalOcean for hosting the analysis API;
• Stripe for checkout, subscriptions, payment and billing support;
• Resend for authentication emails;
• Google and Anthropic for AI processing;
• Crossref, arXiv, OpenAlex, Semantic Scholar, publishers and public web services used to identify and retrieve linked sources;
• Cloudflare for DNS, email routing and related security services;
• professional advisers, regulators, courts or law-enforcement bodies where reasonably necessary or legally required.

We require service providers to protect personal data and use it only to provide their contracted service, subject to their applicable terms.

Some providers may process data in the United Kingdom, European Economic Area, United States or other countries. Where UK personal data is transferred to a country without UK adequacy regulations, we rely as appropriate on the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful safeguard. You may ask us for more information about the safeguard relevant to your data.

• Analysis jobs: temporary processing records are kept in live server memory for about one hour, then removed.
• Analysis history: completed results, their page context and source identifiers are kept with your account until you delete an individual result, close your account or ask us to erase them, subject to any overriding legal need. We do not create a server-side copy of the full source or PDF.
• Model-usage records: model, token, response-time and cost records are retained while needed for billing reconciliation, abuse prevention, service planning and financial analysis. They are not visible to other users and may later be aggregated or anonymised.
• Browser storage: the in-flight record lasts for the browser session. The extension stores the account session locally until you sign out, the session becomes invalid or you uninstall the extension. The primary analysis history is stored with your WhyCited account, not as a device-only browser history.
• Account and usage data: kept while your account is open, then deleted or anonymised when no longer needed, except for records we must retain for law, disputes, fraud prevention or security.
• Payment and tax records: generally kept for up to six years after the relevant transaction or end of the relationship where UK tax, accounting or legal rules require this.
• Feedback and support: kept only while useful to resolve the issue, improve and audit the service, or establish legal claims, then deleted or anonymised. We review this data periodically.
• Technical logs: kept according to the shortest period reasonably needed for security, fault investigation and provider operations, then deleted or anonymised.

The website uses a strictly necessary Supabase authentication cookie to keep signed-in users secure. The extension uses Chrome session and local storage for authentication, preferences and the current job. These technologies are necessary for the service or requested settings, so we do not ask for cookie consent.

We do not currently use advertising cookies, cross-site tracking or non-essential analytics. We will add an appropriate consent choice before introducing any non-essential cookie or similar technology.

We use measures including HTTPS, access controls, server-held provider keys, restricted browser permissions, rate limits, URL validation and output validation. No online service is completely secure, but we review safeguards in proportion to the data and risks involved.

Depending on the circumstances, UK data-protection law gives you the right to access your data, correct it, have it erased, restrict its use, receive a portable copy, and object to processing based on legitimate interests. You may also withdraw consent where consent is the lawful basis, although we do not currently rely on consent for the core service.

Email hello@whycited.com to exercise a right or close your account. We may need to verify your identity and normally respond within one month. You may complain to the UK Information Commissioner’s Office using its data-protection complaint service. We would appreciate the opportunity to address your concern first.

Your email and required account declarations are necessary to create an account and provide the service. Payment information is necessary for a paid plan. Citation context is necessary to perform an analysis. Without the relevant data, we cannot provide that part of the service.

We may update this notice when the service or law changes. We will identify the new effective date and, for a material change affecting existing users, provide a prominent account notice or email before it takes effect where appropriate.