Privacy Policy

Last updated: 7 August 2026

Citation Builder is a local SEO citation service developed and operated by IT DEV E.E., Argous 139, 104 41 Athens, Greece (VAT EL802223278), a digital marketing and web development agency based in Greece. In this Privacy Policy, “IT DEV”, “we”, “us” and “our” refer to the company that provides Citation Builder and acts as the data controller for the personal data described below. “Service” means the Citation Builder website, web application and the citation-building and monitoring it performs.

This policy explains what personal data we collect, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable Greek data-protection law.

1. Who is responsible for your data

The data controller is IT DEV E.E., Argous 139, 104 41 Athens, Greece (VAT EL802223278). You can reach us about any privacy matter using the contact details below.

2. The data we collect

• Account data: your name and email address, a securely hashed password, and your account/role and subscription status.
• Business listing data you provide: the information you enter about the businesses you manage so we can build citations: business name, address, phone number, website, categories, opening hours, descriptions and any logo or image you upload. This may relate to you (for a sole trader) or to a business you are authorised to represent.
• Service data: the directories we target for each business, submission and listing status, the public listing URLs we create or find, and screenshots of those listings for your dashboard.
• Billing data: your plan, billing cycle and payment status. Card payments are processed by our third-party payment provider; we do not store full card numbers.
• Usage & technical data: log data, device/browser information and, where you consent, analytics about how the Service is used.
• Communications: messages you send us and your email/marketing preferences.

3. How and why we use your data (legal bases)

• To provide the Service: creating your account, building and monitoring citations, and submitting your business information to directories on your instruction. Legal basis: performance of a contract.
• To take payment: managing subscriptions, invoices and renewals. Legal basis: performance of a contract; legal obligation (tax/accounting).
• To secure and improve the Service: preventing fraud and abuse, maintaining security, and analysing and improving how the Service works. Legal basis: our legitimate interests; your consent for non-essential analytics cookies.
• To communicate with you: service and account messages, support, and (only where permitted or with your consent) marketing. Legal basis: performance of a contract; legitimate interests; consent for marketing.
• To comply with the law: meeting our legal and regulatory obligations and responding to lawful requests. Legal basis: legal obligation.

We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.

4. Publishing your listings to third-party directories

A core part of the Service is submitting and maintaining your business information on third-party online directories and platforms (for example local business directories, mapping/places services and review platforms). When you ask us to build citations, you instruct us to share the relevant business listing data with those directories so they can publish it.

Once your information is published on a directory, that directory is an independent controller of the public listing and handles the data under its own privacy policy and terms. We facilitate the submission but do not control a directory's retention, moderation, display or removal of a listing.

5. Who we share data with (processors & sub-processors)

We share personal data only with trusted service providers that process it on our behalf under contract, and with the directories described above, strictly to operate the Service. These providers fall into the following categories:

• Cloud hosting, database and storage: secure hosting of the application and your data (hosted in the EU), including account authentication and file storage.
• Payment processing: handling subscription billing and card payments.
• Email delivery: sending transactional and verification email.
• Listing and places services, and the third-party directories: publishing and maintaining your business information at your instruction.

We select providers that offer appropriate data-protection safeguards and bind them by contract. We may also disclose data where required by law, to enforce our terms, or in connection with a merger, acquisition or reorganisation (with appropriate safeguards).

6. International transfers

We aim to keep personal data within the European Economic Area (EEA). Where a provider processes data outside the EEA, we rely on an appropriate transfer mechanism (typically the European Commission's Standard Contractual Clauses or an adequacy decision) to protect it.

7. How long we keep it

We keep personal data for as long as your account is active and as needed to provide the Service. You can close your account yourself at any time from Settings › Danger zone in the app. Deletion there is immediate and permanent: it removes your login, your profile, every business location you added, every submission record, and the screenshots and logos we stored for you.

Three things survive that deletion, and we want to be plain about them. Invoices and payment records are held by our payment provider and retained for as long as tax and accounting law requires. Listings already published on third-party directories are governed by those directories, not by us, so they may persist there until each directory removes them (we will help you request removal if you ask). Email suppression records (an address that unsubscribed or hard-bounced) are kept precisely so we do not email that address again. If your account still has an active subscription, cancel it on the Billing page first: we do not delete an account while a subscription is live, so that nobody is left paying for an account that no longer exists.

8. How we protect your data

We apply appropriate technical and organisational measures, including encryption in transit, access controls, secret management and strict tenant isolation so that each account can access only its own data. No method of transmission or storage is completely secure, but we work to protect your data and to handle any incident responsibly.

9. Cookies

We use strictly necessary cookies to keep you signed in, secure the Service and remember your cookie choice. With your consent we also use analytics cookies (anonymous usage statistics) and marketing cookies. No non-essential cookies are set until you allow them, and you can withdraw or change your consent at any time: Manage cookie preferences.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected and incomplete data completed;
• have your data erased (“right to be forgotten”), where applicable;
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out; and
• lodge a complaint with a supervisory authority: in Greece, the Hellenic Data Protection Authority (HDPA).

Two of these rights are self-service, so you do not have to wait for us. Signed in, go to Settings in the app:

• Access and portability: Export your data downloads a single machine-readable JSON file containing your profile, your subscription details, every location you added, every directory submission with its status and listing URL, and any NAP audit results. Screenshots and logo images are binary files and are not in the JSON, so ask us and we will send them.
• Erasure: Danger zone deletes your account immediately and permanently, subject to the retention points in section 7 above.

For correction, restriction, objection, withdrawal of consent, or anything the two buttons above do not cover, contact us using the details below. We will respond within the time limits set by the GDPR.

11. Additional information for United States residents

If you are a U.S. resident, the following applies in addition to the rights above. Depending on your state (for example California, under the CCPA/CPRA), you may have the right to know what personal information we collect and how we use and disclose it, to access, delete or correct it, and not to be discriminated against for exercising these rights. We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising. To make a request, contact us using the details below; we will verify and respond as required by applicable law.

12. Children

The Service is intended for businesses and the professionals who run them. It is not directed to children, and we do not knowingly collect personal data from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you.

14. Contact us

For any privacy question or to exercise your rights, contact IT DEV: info@localseocitationbuilder.com.