Legal

Privacy notice

Last updated: 30 September 2026. CiteQ is a product of Kerdos Holding Limited (Hong Kong company number 1986889) (“we”, “us”).

Who we are

CiteQ is a done-for-you service that drafts cited answers to vendor security questionnaires from documents a customer provides under engagement (typically after an NDA). This site is a static marketing website. It is not investment advice and CiteQ is not an investment product. We do not claim SOC 2 certification for CiteQ.

What this marketing site collects

These pages are static files. We do not run an account signup form here. If you email hello@getciteq.com, we receive whatever you put in the message, plus ordinary mail metadata. Hosting and DNS providers may keep request logs (IP address, user agent, time) as part of running a website.

What we collect for a CiteQ engagement

When you hire us to fill a questionnaire, we typically hold: your contact email and related correspondence; an NDA and engagement details; policy documents, standards, and the questionnaire you send us; drafts and exports we produce for you; and, when payment is connected, billing identifiers (for example from Stripe) and invoice records. Server or workspace logs may include IP address and user agent for security.

How we use it

To reply to mail, to perform the questionnaire engagement, to store materials for that engagement, and to take payment when invoicing or Stripe checkout is used. We do not sell personal data. We do not train machine-learning models on customer files.

AI providers that may process document excerpts

Our internal drafting stack (verified from the CiteQ application codebase) can call OpenAI (Chat Completions API; default model currently configured as gpt-4o-mini) when an OpenAI API key is set. In that mode, excerpts from documents you provided may be sent to OpenAI solely to draft answers for the current questionnaire. Those excerpts are not used to train CiteQ. If no OpenAI key is configured, drafting can fall back to extractive retrieval from your documents without calling an LLM. We do not currently configure other LLM vendors (for example xAI) in that codebase.

Mail providers (for hello@getciteq.com), static hosting (currently Netlify for this site), and Stripe (when billing is enabled) are also processors as needed to operate the business.

Storage

Customer materials for an engagement are kept in private working storage for that engagement, not in a public web folder. This marketing site does not host customer files.

Retention

Uploaded documents and working copies for an engagement are retained for 7 days after the engagement ends, then deleted or securely disposed of, unless you ask us in writing to keep them longer (for example for a follow-on pack) or law requires a longer hold. We keep billing and invoice records as the law requires. Email threads may be retained longer for ordinary business correspondence unless you request deletion where applicable.

Your requests

Email hello@getciteq.com to ask what we hold for you, to ask for deletion of engagement files (subject to legal retention), or to ask questions about this notice. That mailbox is live.

This notice is plain English, not legal advice, and not a claim that CiteQ or Kerdos Holding Limited is SOC 2 certified.