← Back to Citadel

Privacy Policy

Last updated: April 2026

1. Introduction

Eveleone LTD ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use Citadel ("the Service").

Citadel is designed differently: Your business documents and data are stored on your dedicated server. We do not have access to your files, documents, or content except as described in this policy.

2. Data Controller

Data Controller: Eveleone LTD

3. What Data We Collect

We collect the following types of information:

3.1. Account Information

3.2. Billing Information

3.3. Usage Data

3.4. Communication Data

3.5. What We DO NOT Collect

Important: We do NOT access, collect, or process:

All content data remains on your dedicated server under your control.

4. How We Use Your Data

We use the collected data for the following purposes:

4.1. Service Provision

4.2. Security and Fraud Prevention

4.3. Legal Compliance

4.4. Improvement

5. Legal Basis for Processing

Under GDPR, we rely on the following legal bases:

6. Data Storage and Location

Your data is stored and processed as follows:

6.1. Account and Billing Data

6.2. Your Content Data

7. Data Retention

We retain your data as follows:

Upon account termination, account data is deleted within 30 days, except billing records which are retained for legal compliance.

8. Your Rights

Under GDPR, you have the following rights:

8.1. Right of Access

You can request a copy of all data we hold about you. Contact privacy@citadel.eu.

8.2. Right to Rectification

You can correct inaccurate or incomplete data. Login to your account or contact us.

8.3. Right to Erasure ("Right to be Forgotten")

You can request deletion of your account data, subject to legal retention requirements (e.g., tax records). Your content data can be deleted at any time from your server.

8.4. Right to Portability

You can export your account data in a structured, machine-readable format.

8.5. Right to Object

You can object to processing based on legitimate interest (e.g., marketing emails).

8.6. Right to Restrict Processing

In certain circumstances, you can request we limit how we use your data.

8.7. Right to Lodge a Complaint

You have the right to complain to a data protection authority:

9. Cookies and Tracking

Citadel uses minimal cookies:

We do NOT use:

10. Third-Party Services

We use the following trusted third parties:

10.1. Hetzner Online GmbH (Germany)

10.2. Stripe Inc. (USA)

10.3. Let's Encrypt (USA)

Important: No third party has access to your content data on your server.

11. Data Transfers Outside EU

We minimize data transfers outside the EU:

12. Security Measures

We implement appropriate security measures including:

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

13. Children's Privacy

Citadel is intended for business use and is not directed to children under 16. We do not knowingly collect data from children under 16. If we become aware of such collection, we will delete it immediately.

14. International Users

If you are located outside the European Union, your information may be transferred to and processed in the EU in accordance with this Privacy Policy.

We comply with the EU-US Data Privacy Framework for applicable data transfers.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be:

Your continued use of the Service after changes constitutes acceptance.

16. Contact

For privacy-related questions, requests, or complaints:

We will respond to all inquiries within 30 days.

17. Data Processing Agreement

For business customers requiring a Data Processing Agreement (DPA), please refer to our DPA or contact privacy@citadel.eu.