What we collect, and why.

1. Who we are

Citestep is provided by Genfinish LLP (LLPIN ACY-8116), a limited liability partnership registered in India. We are the data fiduciary under India's Digital Personal Data Protection Act 2023 and the controller under the EU and UK GDPR for everything described here.

Privacy questions, requests and complaints: security@genfinish.com (our Grievance Officer inbox).

2. What this covers

This website (citestep.com); buying a plan; the Citestep desktop agent; and the hosted workspace and review console you open in a browser. Our terms, refund policy and cookie page sit alongside it.

3. What we collect, and why

Visiting this website

• Nothing is stored on your device and no analytics or advertising scripts load. Our host, Vercel, keeps ordinary short-lived request logs (IP address, browser type, pages requested) to serve the site and protect it from abuse.
• Contact form — your email address, message, and a name if you give one. We use it only to reply. Pressing Send loads Google reCAPTCHA to check you are not a bot; see section 4.
• Resend my key — the email address you type. We use it only to find your account and email a fresh key. The request is throttled per address and per IP address; the IP is not kept.

Buying a plan

• Payment is taken on Razorpay's pages. Razorpay collects your card or bank details, name, email and phone number under its own privacy policy. We never see your card details.
• Razorpay tells us: your email address, the plan, the amount and currency, the payment ID and the time. We use these to create your account, email your access key, top up a balance, answer billing questions, and keep the records Indian tax and company law require.

Your account

• Your email address; a one-way hash of your access key (we cannot read the key back — that is why Resend my key issues a new one); your plan and how many minutes and SOPs you have used; the date you joined and when a key was last re-sent.
• To enforce the one-PC seat: a random identifier the agent generates on first run (it is not a hardware serial number and identifies nothing outside Citestep), your PC's name as Windows reports it, when the key was bound, and the agent version.

Recording — only while you press Record

• What the agent captures: screenshots of your screen; your microphone audio; where you click and scroll, and the name of the program in the foreground when you do; and — only if you switch on Capture keyboard, which is off by default — what you type. Everything is uploaded to your workspace as you record.
• What the agent blurs before upload, on your PC: the sensitive fields it can detect — card numbers, email addresses, phone numbers, API keys and tokens, Aadhaar/SSN-style numbers, IBANs, password-like assignments and short one-time codes typed on their own. Password, email and phone fields are blurred by asking Windows where they are. Keystrokes typed into a password, OTP or PIN box are never recorded at all. Our server re-runs the same checks on the transcript and any typed text as a backstop.
• What it cannot blur: anything the patterns do not catch. A person's name on screen, a customer's address in a CRM window, small or low-contrast text, and what you say out loud are uploaded as recorded. Choose what to record accordingly; you are responsible for having the right to record and process it.
• What is produced from it: a transcript of your narration (made on your PC when possible, otherwise on our server), short written descriptions of each screenshot, the SOP draft and every version of it, the citations linking each step to a moment in the recording, processing logs, and per-stage counts of AI tokens used and their cost.

Support

Emails you send us, and our replies. Our founders can open your sessions in the workspace to help you — for support only, and for nothing else.

The legal bases we rely on

Under the GDPR: performing our contract with you (account, plan, recordings, key emails); our legitimate interests in running the service securely and replying to you (request logs, throttling, contact form, support); legal obligation (payment records); and your consent where you choose to turn keyboard capture on. You can turn it off at any time, including mid-recording.

4. Who processes it

We use these companies to run Citestep. Each receives only what its job needs, and only when that job runs.

We use the AI providers' business APIs, not their consumer apps, and send them only the recording being processed. We do not sell personal data, share it for advertising, or use analytics trackers.

5. Where it is stored

Your recordings, transcripts, SOPs and account data are stored on a server we operate in India. AI processing happens on the providers' servers, mostly in the United States, for the duration of that step. Payment data stays with Razorpay in India. If you use Citestep from the EU or UK, your data therefore travels to India and the United States; our processors commit to standard contractual protections for it, and we will update this page if the storage location changes.

6. How long we keep it

• Recordings, transcripts and SOPs stay until you delete the session in the review console — which removes its files and database records permanently — or ask us to delete your account.
• Account data stays while your account exists. If you ask us to delete it, we keep only what Indian tax and LLP law require (payment records, currently eight years) and remove the rest.
• Contact-form and support emails are kept in our mailbox until the matter is closed and then removed in the ordinary course.

7. How we protect it

Everything travels over TLS. Access keys are stored only as hashes. Recordings are served behind your key, through short-lived signed links. Sensitive fields are blurred on your PC before they leave it. We hold no card data. If a breach affects you we will tell you, and the Data Protection Board of India where the law requires it.

8. Your rights

You can ask to see the personal data we hold about you, have it corrected, have it deleted, or withdraw consent you have given (for example by turning keyboard capture off). If you are in India these rights come from the Digital Personal Data Protection Act 2023, and if we do not resolve a complaint you can take it to the Data Protection Board of India. If you are in the EU or UK, the GDPR also gives you the right to restrict or object to processing, to data portability, and to complain to your local data protection authority.

To exercise any of these, email security@genfinish.com from the address on your account. We acknowledge within 48 hours and answer within 30 days.

9. Cookies

This website sets no cookies of its own. The one third-party check (reCAPTCHA, above) loads only when you send the contact form. The review console keeps your access key in your browser's local storage so you stay signed in. Details on the cookie page.

10. Children

Citestep is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you believe we have, email us and we will delete it.

11. Changes

The date at the top changes when this page does. We email plan holders about anything material.

12. Contact and Grievance Officer

security@genfinish.com reaches our Grievance Officer for privacy requests and complaints; support@genfinish.com is for product and billing help. Postal address in section 1.