What we do with your data.

1. Controller

Qualmia OÜ (trading as Citehelm), Vindi 8, 11315 Tallinn, Estonia, registry code 14677901. E-mail: [email protected]. We have not appointed a data protection officer; we are not required to. Contact the address above for any question about this notice.

2. What we process, why, and on which legal basis

2.1 Visiting the site

Our host, Cloudflare, records technical access data for every request: IP address, date and time, requested URL, referrer, browser and operating system, HTTP status. We use it to deliver the site, to keep it secure and to diagnose errors (legitimate interest, Art. 6(1)(f) GDPR). Logs are kept for up to 30 days. The site is served as static HTML without tracking scripts; no cookie is set until you consent to analytics (section 4).

2.2 The request form (Snapshot / Audit)

When you request a Snapshot or an Audit we process the data you enter: name, work e-mail, company, website, market and language, your buyer questions, competitors and your message. The form is handled by a Cloudflare Pages Function and stored in our request register at Airtable; a confirmation is sent to you and a notification to us by e-mail. Purpose: to answer your request, prepare the Snapshot or the Audit offer and hold the intake call (steps prior to entering into a contract, Art. 6(1)(b) GDPR). The form contains an invisible field that people do not fill in; submissions that fill it are discarded as spam. We keep requests that do not lead to a contract for 12 months, then delete them.

2.3 E-mail and booking

If you write to us, we process your e-mail address, name and the content of your message to answer you (Art. 6(1)(b) or (f) GDPR). Our mailbox runs on Google Workspace. If you book an intake call through our booking page, Google Calendar's appointment scheduling processes the name and e-mail you enter and creates an event in both calendars; Google's privacy policy applies to that page. Correspondence is kept as long as needed for the business relationship and for statutory retention (up to seven years for accounting records under Estonian law).

2.4 Clients and client projects

During an engagement we process the business contact data of the client's staff (name, role, work e-mail, phone) to perform the contract (Art. 6(1)(b) GDPR) and keep it for the statutory retention period. Measurement data — which AI engines cite which websites — concerns companies and public web pages; we do not require or process personal data of our clients' customers. Where a client gives us read access to server logs or analytics for an audit, we process only aggregated crawler and traffic statistics and delete raw exports when the audit is delivered.

2.5 Publications

We publish anonymised, aggregated findings from our work. We name a client only with the client's written consent (legitimate interest in demonstrating our work, Art. 6(1)(f) GDPR; the consent is the client's, as a company).

3. Recipients and transfers outside the EU

We use the following processors under data processing agreements (Art. 28 GDPR). Where data leaves the EEA, the transfer rests on an adequacy decision (EU–US Data Privacy Framework) or on the EU standard contractual clauses.

We do not sell or rent personal data, and we do not share it with advertisers.

4. Cookies and analytics

The site works without cookies. If you accept analytics in the banner, we load Google Analytics 4, which sets cookies (_ga, _ga_*, 13 months) and reports page views and events to Google with a truncated IP address. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25 TDDDG), which you can withdraw at any time by clearing the site's cookies or via the link in the footer; the choice itself is remembered in your browser's local storage. Without consent nothing is loaded and nothing is stored.

5. Your rights

You may ask us for access to your data, rectification, erasure, restriction of processing, and a copy in a portable format; you may object to processing based on legitimate interest, and withdraw a consent with effect for the future. Write to [email protected]. You also have the right to lodge a complaint with a supervisory authority — ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority of your own member state.

6. Security

The site is served over TLS only; the request form is protected against automated abuse; access to our registers is limited to the people who need it and secured with two-factor authentication. No transmission over the internet is completely secure; e-mail is not encrypted end to end unless you arrange it with us.

7. Changes

We update this notice when our processing changes. The current version is always at citehelm.com/privacy.

Last updated 2026-10-07. See also the imprint and the terms of service.