Privacy Policy

Last updated: 1 March 2026  ·  Effective: 1 March 2026

1. Overview

This Privacy Policy explains how Holasure OÜ (trading as Citeos) collects, uses, and protects personal data when you visit citeos.ai or interact with our waitlist and referral forms.

We are committed to GDPR compliance. Our analytics provider (Plausible) is cookieless and does not use personal identifiers. No cookie consent banner is required on this site.

2. Data we collect and why

Data	Purpose	Legal basis	Retention
Work email address (waitlist form)	To notify you when early access opens and send you the AI Revenue Signal Gap briefing	Consent — Article 6(1)(a) GDPR	24 months or until deletion request
Your name + colleague name + colleague work email (referral form)	To process your referral and contact your colleague about the pilot programme	Consent — Article 6(1)(a) GDPR	24 months or until deletion request
Anonymous page view data (Plausible Analytics)	To understand how visitors use the site. No cookies. No personal identifiers. No cross-site tracking.	Legitimate interest — Article 6(1)(f) GDPR	Rolling 24-month aggregated data

3. What we do not collect

• We do not use cookies or persistent tracking identifiers of any kind
• We do not collect IP addresses in identifiable form
• We do not build individual visitor profiles
• We do not share your data with advertisers
• We do not sell your data to any third party

4. Data processors

Processor	Purpose	Location	Safeguard
Brevo (Sendinblue SAS)	Waitlist form submission handling, contact storage, and confirmation email delivery	EU (France)	GDPR-compliant, EU infrastructure, DPA available
Formspree Inc.	Referral form submission handling and email notification to Citeos	USA	GDPR-compliant, Standard Contractual Clauses
Plausible Analytics	Anonymous, cookieless website analytics	EU (Germany)	No personal data processed. EU infrastructure only.

5. Your rights under GDPR

As a data subject, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate personal data
• Erasure — request deletion of your personal data at any time
• Restriction — request that we limit processing of your data
• Portability — receive your data in a structured, machine-readable format
• Withdrawal of consent — withdraw your consent at any time without affecting the lawfulness of prior processing
• Objection — object to processing based on legitimate interest

To exercise any right, email thomas@citeos.ai. We will respond within 30 days.

6. Supervisory authority

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):

• Website: www.aki.ee
• Email: info@aki.ee
• Address: Tatari 39, 10134 Tallinn, Estonia

7. International transfers

Waitlist form data is processed by Brevo (Sendinblue SAS) in France, within the European Union. No international transfer occurs for waitlist submissions.

Referral form data is processed by Formspree Inc. in the United States. This transfer is covered by Standard Contractual Clauses as approved by the European Commission, providing adequate safeguards for your personal data.

Analytics data (Plausible) is processed exclusively within the European Union.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is transmitted over HTTPS. Form data is stored with Formspree using industry-standard security practices.

9. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when material changes were last made. We will notify waitlist subscribers of any significant changes by email.

10. Contact

For any questions about this Privacy Policy or how we handle your personal data, contact us at thomas@citeos.ai. We aim to respond within 2 business days.