Privacy Policy
Last updated: 22 June 2026
Citation Builder is a local SEO citation service developed and operated by IT DEV E.E., Argous 139, 104 41 Athens, Greece (VAT EL802223278), a digital marketing and web development agency based in Greece. In this Privacy Policy, “IT DEV”, “we”, “us” and “our” refer to the company that provides Citation Builder and acts as the data controller for the personal data described below. “Service” means the Citation Builder website, web application and the citation-building and monitoring it performs.
This policy explains what personal data we collect, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable Greek data-protection law.
1. Who is responsible for your data
The data controller is IT DEV E.E., Argous 139, 104 41 Athens, Greece (VAT EL802223278). You can reach us about any privacy matter using the contact details below.
2. The data we collect
- Account data: your name and email address, a securely hashed password, and your account/role and subscription status.
- Business listing data you provide: the information you enter about the businesses you manage so we can build citations: business name, address, phone number, website, categories, opening hours, descriptions and any logo or image you upload. This may relate to you (for a sole trader) or to a business you are authorised to represent.
- Service data: the directories we target for each business, submission and listing status, the public listing URLs we create or find, and screenshots of those listings for your dashboard.
- Billing data: your plan, billing cycle and payment status. Card payments are processed by our third-party payment provider; we do not store full card numbers.
- Usage & technical data: log data, device/browser information and, where you consent, analytics about how the Service is used.
- Communications: messages you send us and your email/marketing preferences.
3. How and why we use your data (legal bases)
- To provide the Service: creating your account, building and monitoring citations, and submitting your business information to directories on your instruction. Legal basis: performance of a contract.
- To take payment: managing subscriptions, invoices and renewals. Legal basis: performance of a contract; legal obligation (tax/accounting).
- To secure and improve the Service: preventing fraud and abuse, maintaining security, and analysing and improving how the Service works. Legal basis: our legitimate interests; your consent for non-essential analytics cookies.
- To communicate with you: service and account messages, support, and (only where permitted or with your consent) marketing. Legal basis: performance of a contract; legitimate interests; consent for marketing.
- To comply with the law: meeting our legal and regulatory obligations and responding to lawful requests. Legal basis: legal obligation.
We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.
4. Publishing your listings to third-party directories
A core part of the Service is submitting and maintaining your business information on third-party online directories and platforms (for example local business directories, mapping/places services and review platforms). When you ask us to build citations, you instruct us to share the relevant business listing data with those directories so they can publish it.
Once your information is published on a directory, that directory is an independent controller of the public listing and handles the data under its own privacy policy and terms. We facilitate the submission but do not control a directory's retention, moderation, display or removal of a listing.
5. Who we share data with (processors & sub-processors)
We share personal data only with trusted service providers that process it on our behalf under contract, and with the directories described above, strictly to operate the Service. These providers fall into the following categories:
- Cloud hosting, database and storage: secure hosting of the application and your data (hosted in the EU), including account authentication and file storage.
- Payment processing: handling subscription billing and card payments.
- Email delivery: sending transactional and verification email.
- Listing and places services, and the third-party directories: publishing and maintaining your business information at your instruction.
We select providers that offer appropriate data-protection safeguards and bind them by contract. We may also disclose data where required by law, to enforce our terms, or in connection with a merger, acquisition or reorganisation (with appropriate safeguards).
6. International transfers
We aim to keep personal data within the European Economic Area (EEA). Where a provider processes data outside the EEA, we rely on an appropriate transfer mechanism (typically the European Commission's Standard Contractual Clauses or an adequacy decision) to protect it.
7. How long we keep it
We keep personal data for as long as your account is active and as needed to provide the Service. After you close your account we delete or anonymise personal data within a reasonable period, except where we must retain certain records (for example invoices) to meet legal, tax or accounting obligations, or to resolve disputes. Listings already published on third-party directories are governed by those directories and may persist there.
8. How we protect your data
We apply appropriate technical and organisational measures, including encryption in transit, access controls, secret management and strict tenant isolation so that each account can access only its own data. No method of transmission or storage is completely secure, but we work to protect your data and to handle any incident responsibly.
9. Cookies
We use strictly necessary cookies to keep you signed in, secure the Service and remember your cookie choice. With your consent we also use analytics cookies (anonymous usage statistics) and marketing cookies. No non-essential cookies are set until you allow them, and you can withdraw or change your consent at any time: .
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected and incomplete data completed;
- have your data erased (“right to be forgotten”), where applicable;
- restrict or object to certain processing, including processing based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing already carried out; and
- lodge a complaint with a supervisory authority: in Greece, the Hellenic Data Protection Authority (HDPA).
To exercise any of these rights, contact us using the details below. We will respond within the time limits set by the GDPR.
11. Additional information for United States residents
If you are a U.S. resident, the following applies in addition to the rights above. Depending on your state (for example California, under the CCPA/CPRA), you may have the right to know what personal information we collect and how we use and disclose it, to access, delete or correct it, and not to be discriminated against for exercising these rights. We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising. To make a request, contact us using the details below; we will verify and respond as required by applicable law.
12. Children
The Service is intended for businesses and the professionals who run them. It is not directed to children, and we do not knowingly collect personal data from anyone under 16.
13. Changes to this policy
We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you.
14. Contact us
For any privacy question or to exercise your rights, contact IT DEV: info@localseocitationbuilder.com.