Privacy Policy

Effective date: 13 August 2026 · Last updated: 4 September 2026

This policy explains what personal data Naman Kedia ("Geppetto Works", "we", "us") handles, why, and what you can do about it. It is written to be read, not to be survived.

The short version. You can use the Citation Verifier without an account. If you paste text, we do not store it. If you upload a document, we store it encrypted for one year so we have a record of what we checked, and you can delete it at any time. We send the citations we find — not your document — to public case-law services to look them up. We do not sell personal data, we do not advertise, and we do not use your documents to train AI models.

1. Who we are

Controller: Naman Kedia, a sole proprietorship, A-20 Geetanjali Enclave, New Delhi 110017, India.

Contact for all privacy questions and requests: namankedia@geppetto.work

We have not appointed a Data Protection Officer, as we are not required to. The contact above reaches the person responsible for data protection.

2. What we collect, why, and for how long — itemised

This section lists each item of personal data separately, as required. "Legal basis" is our justification under the GDPR.

2.1 Citation Verifier — pasted text

2.2 Citation Verifier — uploaded documents

Any personal data inside the document — client names, party names, and anything else your document contains — is covered by the row for the document itself. We do not index it, search it, analyse it, or extract anything from it other than citations.

2.3 Citation Verifier — checking your citations

We do not send the body of your document to any third party. Only the citation being checked leaves our servers. See section 4 for who receives it.

2.4 Feedback you choose to send

This is only collected when you click to report a problem and submit it. Do not put confidential or client information in the note.

2.5 Usage counts

2.6 Technical data

Server logs never contain your document text or citation content.

2.7 Accounts and paid services

Applies only where a Service requires an account.

We never see or store your full card number. Payments are handled by our payment provider (section 4).

2.8 Public dashboard and Daily Call

Votes are anonymous. We do not link them to a name, email or account. Buying Credits does require payment details, which are handled by our payment provider (section 4.3) — but a Credit purchase is not linked to how you vote.

3. Where the data comes from

Almost all of it comes directly from you. Technical data (IP address, logs) is generated automatically when you use the Services. We do not buy personal data, and we do not build profiles from outside sources.

4. Who we share it with

We do not sell personal data. We do not share it for advertising. We share only as follows.

4.1 Public case-law services — receive citations only

When we check a citation, we send that citation to the relevant service:

We send the citation only. We never send your document, its text, or its filename.

4.2 Service providers

We use a small number of providers to run the Services. Each is bound by contract to process data only on our instructions. Our current list, with what each one handles, is published in our Sub-processor list and kept up to date.

Categories: cloud hosting and storage · transactional email · payment processing · error and uptime monitoring.

4.3 Payment provider

Paid Services are sold through a payment provider acting as merchant of record. It collects and processes your payment details directly under its own privacy policy and is an independent controller of that data. We receive only the fact of payment, your subscription status, and limited billing metadata.

4.4 Legal disclosure

We may disclose personal data where required by law or in response to a valid and binding legal order, or where necessary to establish, exercise or defend legal claims, or to protect the rights, safety or property of any person.

Where we are legally compelled to disclose the contents of a document you uploaded, we will tell you first if we are lawfully permitted to do so, so that you can seek protection from a court.

4.5 Business transfer

If the business is sold, merged or reorganised, personal data may transfer as part of it. Any acquirer remains bound by this policy or gives you notice of a replacement.

5. International transfers

We operate from India. Our providers operate in various countries, including within the European Economic Area and the United States.

If you are in the European Economic Area or the United Kingdom, your personal data will be transferred outside it, including to India. India is not the subject of an adequacy decision by the European Commission. We rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) as the safeguard for those transfers, together with the technical measures described in section 7 — in particular, that uploaded documents are encrypted at rest.

You may request a copy of the relevant clauses by writing to namankedia@geppetto.work.

6. How long we keep things

Retention is stated item by item in section 2. In summary:

• Pasted text — not stored at all.
• Uploaded documents — one year, or until you delete them, whichever comes first. Deletion runs automatically on a schedule; it is not dependent on anyone remembering.
• Account data — while your account is active. After you close it, we delete or anonymise it within a reasonable period, except where we must keep records for tax, accounting or legal-claims purposes.
• Backups — deleted content may persist in encrypted backups for a short period after deletion before being overwritten in the ordinary cycle.

We do not keep personal data indefinitely "just in case". Where a purpose has ended, the data goes.

7. Security

We describe our security measures factually in our Security document. In summary: uploaded documents are encrypted at rest using AES-256-GCM; the encryption key is held separately from the stored documents; access to production systems is restricted; and document contents are excluded from logs and error reports by design.

These are descriptions of measures we take. They are not a guarantee. No system, ours included, can be made immune to compromise. Section 16 of the Terms of Service sets out the position.

If a breach occurs that is likely to result in a high risk to you, we will notify you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live, you may have the right to:

• Access — get a copy of the personal data we hold about you
• Rectification — have inaccurate data corrected or incomplete data completed
• Erasure — have your data deleted
• Restriction — have us limit how we use your data
• Object — object to processing based on legitimate interests, including at any time
• Portability — receive certain data in a machine-readable format, or have it sent to another provider
• Withdraw consent — where we rely on consent, withdraw it at any time, without affecting processing already carried out

How to exercise them: write to namankedia@geppetto.work. We will respond within one month. If a request is complex we may extend that by up to two further months and will tell you why.

A practical note for uploaded documents. The Citation Verifier does not require an account. We therefore usually have no way to connect a stored document to you, which means we cannot reliably identify "your" documents on request. The document identifier shown to you after an upload is the only reliable way to identify it — keep it if you may want to delete the document later. You can delete any document immediately using that identifier, without contacting us and without proving who you are. Where we genuinely cannot identify an individual from the data we hold, some rights may not apply.

Complaints. If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain to a data protection authority, including the one in the country where you live or work.

9. Children

The Services are professional tools intended for adults and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not carry out profiling.

Citation verdicts are produced automatically, but they are statements about a citation, not decisions about a person. They carry no consequence for you other than the information itself, and you remain responsible for verifying every citation yourself.

11. Is providing data mandatory?

No item of personal data is required by law. But some is necessary in practice: without text or a document we cannot check citations, and without an email address we cannot provide an account-based service. If you choose not to provide it, we cannot provide the corresponding Service. Uploading a document is always optional — pasting text works without any storage at all.

12. Cookies

See our Cookie Policy.

13. Changes to this policy

We may update this policy. The current version, with its effective date, is always published on our website. Where a change materially affects how we handle your personal data, we will give notice in the Services or by email before it takes effect.

14. Contact

Naman Kedia A-20 Geetanjali Enclave, New Delhi 110017, India namankedia@geppetto.work