Privacy, plainly.
We process the minimum personal data we need to run the agency — no more.
Who we are
CiteSurge is a product of Marathon Variety LDA, a company registered in Portugal. Marathon Variety LDA operates citesurge.com and the CiteSurge agency workspace, and is the data controller for the information described on this page.
What we collect
When you visit the site
Standard request logs (IP, user agent, referrer, timestamps), anonymized analytics via GA4, and — if you accept them — preference cookies for the chromatic signature toggle.
When you contact us or book an audit
Your name, work email, company, website, and anything you write in the message body. We use it to reply to you and to prepare a pitch.
When you become a client
Billing details processed by Stripe, Google/Auth.js sign-in data, and the domain-level analytics we pull for your client sites. We do not resell, trade, or syndicate any of it.
Why we can process it
Legitimate interest (running the business, responding to enquiries), contract performance (delivering services you hired us for), and consent (analytics cookies you actively accept).
How long we keep it
Enquiries: 18 months from last contact. Client records: the life of the engagement plus seven years for tax compliance. Server logs: 30 days. Analytics: 14 months.
Sub-processors
We use a small set of vendors under GDPR-compliant data processing agreements: Stripe (payments), Google OAuth for sign-in, Postgres-managed hosting, GA4 (analytics), and an AI-engine citation tracker used inside the dashboard. The full list is available on request.
Your rights
Access, correction, deletion, portability, objection, and withdrawal of consent — the standard GDPR set. Write to [email protected]. We reply inside 30 days.
Contact
Data-related questions: [email protected]. Anything else: /contact.
This page is written to be read. It is not a substitute for the full data processing documentation available to clients on request.