Privacy Policy

Inkblot Studio Ltd (Инкблот Студио ЕООД), UIC 208715250, VAT BG208715250, with registered office at 19 Maragidik Street, Floor 2, Office 1, 8000 Burgas, Bulgaria, is the data controller for personal data processed through Citron services unless stated otherwise in a separate agreement.

Privacy enquiries: legal@inkblotstudio.eu.

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our websites, create an account, or use Citron products.

It applies to account holders, administrators, and end users whose data is submitted through the Services.

Account and identity data, such as name, email address, organisation, authentication credentials, and security settings.

Usage and technical data, including device information, log data, IP address, browser type, and interactions with the Services, collected to operate, secure, and improve the platform.

Customer Data that you or your organisation chooses to store in Citron. We process this data on your instructions to provide the Services.

Communications you send to us, including support requests and demo enquiries.

To provide, authenticate, and maintain the Services, including account creation, sign-in, multi-factor authentication, and session management.

To secure the platform, detect abuse, troubleshoot issues, and comply with legal obligations.

To communicate with you about your account, service updates, and important security notices.

To analyse aggregated usage and improve product performance and user experience.

We do not sell your personal data. We do not use your business Customer Data to train shared AI models.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Services); legitimate interests (security, product improvement, and proportionate analytics); consent where required (for example, certain marketing cookies); and legal obligation where applicable.

We use trusted infrastructure and service providers who process data on our behalf under contractual safeguards, such as hosting, email delivery, analytics, and payment processing providers.

We may disclose information where required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale subject to appropriate protections.

If personal data is transferred outside the European Economic Area, we implement appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms recognised under applicable law.

We retain personal data only for as long as necessary for the purposes described in this policy, including to provide the Services, meet legal obligations, resolve disputes, and enforce agreements.

Retention periods may vary depending on data type and your account status.

We apply technical and organisational measures designed to protect personal data, including encryption in transit, access controls, and tenant isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have rights to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent where processing is consent-based.

You may lodge a complaint with the Commission for Personal Data Protection of Bulgaria or your local supervisory authority.

To exercise your rights, contact legal@inkblotstudio.eu. We will respond within the timeframes required by applicable law.

We use essential cookies and similar technologies required for authentication and security. Additional information is available in our Cookie Policy.

We may update this Privacy Policy from time to time. Material changes will be communicated through the Services or by other appropriate means.