Privacy Policy

This English version is a convenience translation. The German version is legally binding: Datenschutzerklärung.

In short: your Word files stay on your computer and are never uploaded. The plugin sends only your licence key and a random device identifier to our payment provider Lemon Squeezy – nothing from your documents. The website sets no cookies, uses no tracking scripts and builds no profiles. In detail:

1. Controller

Represented by its director Nazar Moskalenko. RAVIA OPS LIMITED operates CiteMove as a brand.

2. This website

Hosting and server logs

The website is hosted as a static site on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you open a page or download the plugin, Cloudflare processes the connection data that is technically necessary: IP address, date and time, requested address, amount of data transferred, browser and operating system (user agent) and the previously visited page (referrer). Cloudflare uses this data to deliver the site, to protect it from attacks and to compile anonymous traffic statistics (numbers of requests, countries and browsers, not tied to individual people), and keeps it only as long as that requires. We do not see log files ourselves, only those statistics. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). A data processing agreement is in place with Cloudflare; for transfers to the USA see section 8.

No cookies, no tracking

The website sets no cookies, uses no tracking scripts and embeds no third-party content. The fonts are served from our own server. When you click “Buy pass” you leave the site for the Lemon Squeezy checkout (section 3).

Language choice in your browser

When you click “DE | EN” at the top or dismiss the notice about the English version, your browser remembers that choice in its localStorage. This is not a cookie: the value stays in your browser, is not transmitted to us or to anyone else, and only serves to greet you in your chosen language on your next visit. You delete it through your browser's site data. Legal basis: § 25(2) no. 2 TDDDG (a function you expressly requested).

3. Buying a pass (Lemon Squeezy)

We sell the passes (Thesis Pass, Annual Pass) through Lemon Squeezy, operated by Link, LLC (formerly Lemon Squeezy LLC), 222 Main Street, Suite 500, Salt Lake City, UT 84101, USA. Lemon Squeezy acts as the merchant of record: when you buy, you are taken to the Lemon Squeezy checkout page. There Lemon Squeezy processes the data needed for the purchase: name, e-mail address, country or billing address, payment details (through Lemon Squeezy's payment processors) and the generated licence key. Lemon Squeezy issues the invoice and remits VAT.

From Lemon Squeezy we receive your e-mail address, name, country, order number, the product bought and the licence key, so that we can help with questions about the purchase, the key or a refund. We never see your payment details. We keep this information as long as your pass is valid and we may have to answer questions about it, and delete it afterwards unless statutory retention duties require otherwise.

Legal basis: Art. 6(1)(b) GDPR (contract). Lemon Squeezy processes data in the USA; according to its own statements on the basis of the standard contractual clauses approved by the EU Commission (section 8). More in Lemon Squeezy's privacy policy: lemonsqueezy.com/privacy.

4. The CiteMove plugin in Zotero

Your documents stay with you

CiteMove reads and writes your Word file exclusively on your computer. Neither the document, nor the sources it contains, nor your Zotero library are transmitted to us or to anyone else. Your original is never modified; CiteMove saves a new file next to it.

Checking the pass key

To convert, you need a pass. For this the plugin connects to Lemon Squeezy's licence service (api.lemonsqueezy.com) in three cases:

• When activating, it sends your licence key and a randomly generated name for your computer (e.g. “citemove-3f9a…”) that reveals nothing about you or your device. Lemon Squeezy responds with an instance identifier.
• Before every conversion, it sends the key and that instance identifier to check whether the pass is still valid. Without an internet connection, the last successful check counts for 14 days.
• When you click “Remove pass”, it sends the key and the instance identifier so that the activation becomes free for another computer.

Nothing else is sent: no document names, no content, no sources, no plugin version, no usage statistics. As with every internet connection, Lemon Squeezy's server sees your IP address. Lemon Squeezy records on how many computers a key is active. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (protection against unauthorised use).

On your computer the plugin stores in Zotero's preferences: the key, the instance identifier and instance name, the pass's expiry date, the time of the last check and the pass's name. “Remove pass” in the settings deletes all of it.

Automatic updates

Zotero checks regularly whether a new version of the plugin is available and fetches the file update.json from citemove.com for that. This produces the connection data at Cloudflare described in section 2 (IP address, Zotero version in the user agent). You can switch the update check off in Zotero under Tools → Plugins. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an up-to-date, error-free plugin).

5. “We do it for you”

If you use this service, you send us your Word file by e-mail together with your name, e-mail address, citation style and deadline. We use the file solely to convert and check the citations, and send the finished file back to you by e-mail. Only the person doing the conversion has access. The file is not passed on to third parties and not uploaded to cloud services. We delete the file and the version created from it 7 days after delivery, from all devices and from the mailbox.

For the invoice, which you receive by e-mail from RAVIA OPS LIMITED, we process the details it requires (name, billing address); your bank transfer is visible on our bank account. The e-mail correspondence and the invoicing records we keep as long as tax law requires. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (retention duties).

The same applies if you send us a document for troubleshooting: we use it for nothing else and delete it 7 days after the problem is solved.

6. Contact by e-mail

If you write to us, we process your details to answer your request. We delete the correspondence once it is settled and no statutory retention duties stand in the way. Legal basis: Art. 6(1)(b) GDPR (request in the context of a contract or before concluding one) or Art. 6(1)(f) GDPR.

E-mail to hello@citemove.com is received and stored by Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The sole purpose is answering your request. Google may also transfer the data to the USA; the basis for that is the EU-U.S. Data Privacy Framework and the EU Commission's standard contractual clauses (section 8). Please bear in mind that unencrypted e-mail could be read in transit; on request we name another way to send files.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Simply write to the e-mail address above.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Irish Data Protection Commission. You may also contact the supervisory authority where you live, in Germany for example the data protection commissioner of your federal state.

8. Transfers to the USA

Two of the providers named here are based in the USA: Cloudflare (hosting) and Lemon Squeezy (sales and key verification). Our mailbox is run by Google Ireland Limited in the EU; Google may transfer e-mail to the USA, relying on the EU-U.S. Data Privacy Framework and the standard contractual clauses. The USA does not have a level of data protection equivalent to the EU's in every respect; US authorities may access data under certain conditions. We therefore transmit only what each purpose requires: connection data to deliver the website, purchase data for the purchase, key and instance identifier to verify the pass. Cloudflare is certified under the EU-U.S. Data Privacy Framework and additionally agrees to the EU Commission's standard contractual clauses; Lemon Squeezy, by its own account, bases the transfer on those standard contractual clauses. Your documents never leave your computer.

9. No automated decision-making

We make no automated individual decisions and do no profiling.

10. Changes

If anything about the website or the plugin changes that affects the processing of your data, we update this policy. The version published here applies.

Last updated: October 2026