Privacy policy

Nordcite is a product of STAROMEDA OÜ · registry code 17380642 · Pärnu, Estonia · VAT EE102928132. STAROMEDA OÜ is the data controller for everything described here and can be reached at hello@nordcite.com.

This policy covers the Nordcite website, the ordering and intake flow, the reports we deliver and the emails we send about an order.

We ask for as little as the job needs. There is no account to create and no profile behind the scenes.

• When you order: your email address, and the company name and invoice details you provide. We need them to take the order, deliver the report and issue an invoice. Legal basis: performance of our contract with you.
• When you send brand details: the brand's domain and name, up to three competitor domains, the market you bought and any notes you add. We need them to write the queries and to recognise the brand in Google's answers. Legal basis: performance of our contract.
• The report itself: search queries, the answers Google showed in the market you bought, the pages Google cited, and a screenshot of each with the time it was taken. These are public search results, not information about you. If a person's name happens to appear in a public result, it stays in the exhibit as part of the evidence. Legal basis: our legitimate interest in producing an accurate, checkable report.
• Email we send: the order confirmation, the link to send brand details and the link to the finished report. Legal basis: performance of our contract. We do not run a newsletter and do not send marketing to customers.
• Technical logs: our hosting and database providers keep short-lived records of requests (IP address, time, path) to keep the service running and to spot abuse. Legal basis: our legitimate interest in security. We do not use them to build any picture of you.

The public pages set no cookies at all. There is no analytics, no advertising tag, no social widget and no third-party script that follows you — which is also why you were not asked to dismiss a cookie banner.

Sign-in cookies are the only cookies on the site, and both are strictly necessary: one for our own internal admin area, set only for us, and one set only if you sign in by email link to see your reports, which keeps you signed in and does nothing else.

Report pages and the brand-details page are private documents behind an unguessable link. They are sent with instructions not to cache them and are excluded from search engines.

We keep the list of companies involved as short as we can, and we do not sell or share personal data with anyone for their own purposes.

Rows and files are stored in the European Union: the database in Frankfurt, the file storage in the EU, the server functions in Frankfurt.

Some of the providers above are companies headquartered outside the EU. Where they process personal data on our behalf, they do so under the data processing terms in their agreements with us, which include the European Commission's standard contractual clauses or an equivalent transfer mechanism.

Ask us to delete earlier and we will, as far as the accounting rule allows.

• Order and invoice records: seven years, because Estonian accounting law requires it.
• Brand details, captured results, exhibits and report files: 24 months after delivery, so you can come back to the report and so we can answer questions about it. Then deleted.
• Emails about an order: 24 months.
• Technical logs: as long as the provider keeps them, typically days to a few weeks.

Under the GDPR you can ask for a copy of the personal data we hold about you, have it corrected, have it deleted, have its use restricted, receive it in a portable form, or object to processing we base on legitimate interest.

Write to hello@nordcite.com. We answer within one month, and we do not ask you to justify the request. Deletion is the one we get most: say the word and the report, its files and your details go, except the invoice records the law makes us keep.

If you think we have handled your data badly, you can complain to the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), the supervisory authority in Estonia, or to the authority where you live.

Files are stored privately and reached only through links that expire. Report pages open only for the person holding the link, and the internal admin area is limited to one address with a password.

Nothing is perfectly safe. If a breach affects your data, we will tell you and the supervisory authority as the GDPR requires.

Nordcite is a business service. It is not offered to or aimed at anyone under 16.

We update this page when the service changes, and the date at the top changes with it. If a change matters to you — a new provider handling your data, a new purpose — we say so in the email we send about your order.