Last updated 6 October 2026
Citrel AI, an independent studio registered as a sole proprietorship in India and run from Bengaluru, is the controller of the personal data described here. Everything reaches us through the contact form, including any request under this notice.
Only what you type into a form on this site: your name, your work email, your website, and — if you choose to give them — a WhatsApp number, a preferred call time with your timezone, and whatever you write in the message box. Nothing else.
We set no cookies, and there is no advertising pixel or session recorder anywhere on this site. We count visits with Cloudflare Web Analytics, which sets no cookies and does not identify you: it records the page, the referring site, your country and device type, and nothing that follows you between sites. Our host keeps standard server logs, which include IP addresses, for security and troubleshooting. Fonts load from Google Fonts, which means Google sees that request; tell us if that matters to you and we will self-host them.
To reply to you and to run the work you asked for. For an enquiry the basis is our legitimate interest in answering you; for an engagement it is performance of the contract; for keeping invoices it is a legal obligation. We do not sell it, rent it, or add you to a list you did not ask to join, and we will not email you about anything other than the thing you contacted us about.
As few as we can manage, and each one only for the job named:
Google (Forms, Sheets, Workspace) — form submissions and email
Firebase Hosting, a Google service — serving this site and its server logs
Cloudflare — cookieless visit counts on this site
Razorpay — payment processing, for clients only
Anthropic (Claude) — analysis tooling used on public web data during an audit
These providers process data in the United States, the European Union and India, so your data may be transferred outside the country you are in. Where that involves the UK or EU, transfers rely on the providers’ standard contractual clauses.
Enquiries that do not become work are deleted after twelve months. Client records are kept while the engagement runs and then for the period Indian law requires financial records to be retained, which is currently eight years from the end of the financial year. Nothing is kept longer because it might be useful.
The audit needs nothing but your domain name. No logins, no analytics access, no admin rights. For a build we ask for the minimum access required to publish and hand it back when we are done. We do not export, retain or reuse your customer data, and we do not show one client’s data to another.
The analysis runs on publicly available pages and on public answers from AI engines. Where automated tooling is used, including AI systems, it is under human review, and no client material is used to train a model. If you need a data processing agreement before we start, ask and we will sign one.
Access is limited to the people doing the work, accounts carry two-factor authentication, and the site is served over HTTPS only. If personal data of yours were ever exposed, we would tell you and any relevant regulator without delay.
Use the contact form to ask for a copy of what we hold, a correction, deletion, a restriction on how we use it, or a copy in a portable format. We will do it within thirty days and we will not ask you why. You can object to processing based on legitimate interest at any time.
If you are in the UK or EU, these rights are yours under the GDPR, and you may also complain to your national supervisory authority. If you are in India, the same requests are honoured under the Digital Personal Data Protection Act.
This is a service sold to businesses. We do not knowingly collect data about anyone under 18, and we delete it if we find it.
If this notice changes, the date at the top changes with it. Material changes affecting an active engagement are sent to you directly rather than left here to be discovered.