C CitePage
Start free →
Home › Data Processing Addendum

Legal · Summary

Data Processing Addendum — the plain-English summary.

When you upload case records, CitePage handles them as your processor — we process that content only to provide the service to you. This is the readable summary of how that works. A full, signed DPA (and a BAA, where you need one) is available on request.

Effective: July 2026 · CitePage · 1738 SW 57th Ave #407, Miami, FL 33155 · hello@citepage.com

This summary supplements our Terms of Service and Privacy Policy. It describes, in plain terms, how CitePage processes the case content you upload ("Customer Content") on your behalf. It is a readable overview — not a substitute for a signed agreement. If your engagement needs a countersigned DPA or BAA, see Signed DPA / BAA below.

In one line: you are the controller of your Customer Content; CitePage is your processor; we process it only to provide the service, on your instructions, and never to train AI or for our own purposes.

1.Roles & scope

  • ControllerYou (the customer / expert)
  • ProcessorCitePage
  • Subject matterProcessing case records to produce page-cited chronologies, flags, and audit trails
  • DurationFor as long as your account is active, until deletion or termination
  • Types of dataCase records you upload, which may include medical records / PHI and privileged litigation material
  • Data subjectsIndividuals referenced in your case records (e.g., patients, parties, witnesses)

2.Processing only to provide the service

We process Customer Content solely to provide and support the service, following your documented instructions (which include your use of the product's features). We do not use your Customer Content for our own purposes, we do not sell it, and it is never used to train or fine-tune any AI model. Where we're legally compelled to process it otherwise, we'll tell you unless the law prohibits it.

3.Subprocessors

We use a small set of subprocessors to deliver the service, each bound to process data only to provide their function to us:

SubprocessorPurposeLocation
AnthropicAI processing (Claude API) — reads records to build the chronology; contractually barred from training on the contentUnited States
Fly.ioApplication hosting and encrypted storage of Customer ContentUnited States
CloudflareContent delivery (CDN) and cookieless website analytics (no Customer Content)Global CDN
PorkbunDomain registration and DNS only — no Customer ContentUnited States

If we add or replace a subprocessor that processes Customer Content, we'll update this list. The canonical list lives on our Trust & Security page.

4.Security measures

We maintain technical and organizational measures appropriate to the sensitivity of the data, including:

  • Encryption in transit (TLS/HTTPS) and storage on encrypted infrastructure at rest.
  • Tenant isolation — each customer's Customer Content is scoped to that account.
  • Access limited to what's needed to run and support the service.
  • An exportable audit trail of AI-assisted actions on each case.

Full detail, and an honest account of what we don't yet claim, is on the Trust & Security page.

5.Deletion & return on request or termination

You can delete any case and its source files at any time from your account. On request, or on termination of your account, we will delete or return Customer Content in the ordinary course, subject to limited retention required by law. We're also rolling out an option to auto-delete original records once your chronology is built, so only the cited timeline is retained.

6.Assistance & incident notice

We'll provide reasonable assistance to help you respond to requests from individuals exercising their data rights and to meet your own compliance obligations, taking into account the nature of our processing. If we become aware of a security incident affecting your Customer Content, we'll notify you without undue delay and share what we reasonably can to help you respond.

7.Signed DPA / BAA on request

Many experts and their retaining counsel are fine with this summary. If your engagement requires a countersigned Data Processing Addendum — or a Business Associate Agreement (BAA) for HIPAA-covered arrangements — we can provide one on request. Email security@citepage.com or hello@citepage.com and we'll work through what you need.

Honest note: a standard BAA and formal security certifications are in progress. CitePage does not currently claim to be "HIPAA compliant" or "SOC 2 certified." We'll put those claims here only once they're real — with specifics.

8.Contact

Questions about data processing? Email security@citepage.com or hello@citepage.com.

CitePage
1738 SW 57th Ave #407
Miami, FL 33155
United States