Privacy Policy

Last updated: 21 August 2026

1. Who we are

This website and shop is operated by Cosmo Quantum LLC, a limited liability company formed under the laws of Wyoming, United States ("we", "us", "our").

Registered address: 1021 E Lincolnway, Suite 9528, Cheyenne, WY 82001, United States Contact for privacy matters: [email protected]

This policy explains what personal information we collect when you visit or buy from theciteshop.com, why we collect it, and what rights you have over it.

2. Scope

We sell to customers in a number of countries. Where you are located in the United Kingdom or the European Economic Area, you have rights under the UK GDPR and the EU General Data Protection Regulation respectively. We apply those standards to all customers regardless of where you live, because it is simpler and fairer than operating two different sets of rules.

Our servers are located in Canada. We are established in the United States. Section 8 explains what that means for your information.

3. Information we collect

3.1 Information you give us when you place an order

To process and deliver an order we need:

• your name
• billing address and delivery address
• email address
• telephone number, where a carrier requires one for delivery
• the contents of your order

We do not receive or store your full card number. Card details are entered directly with our payment provider, Stripe or PayPal depending on the method you choose, and we receive only a confirmation of payment along with limited information such as the card type and the last four digits, which we use to identify the transaction and handle refunds.

3.2 Account and licence information

If you create an account, we store your email address, a securely hashed password, your saved addresses and your order history. You can ask us to delete your account at any time.

Our products are licensed to you as an individual and are linked to your Zotero user ID. To issue and validate a licence we store:

• your Zotero user ID
• your licence key, its start and expiry dates, and which product it covers
• a record of activations and licence verifications, including the date, time and IP address of each one

Our products contact us only when you install them or check for updates. They do not verify your licence in the background and do not send us anything while you work. We use the information above solely to confirm that a licence is valid and being used by the person it was issued to, and to identify a key being activated across unrelated accounts. We do not have access to the contents of your Zotero library or to your Zotero password. Zotero is operated independently of us by the Corporation for Digital Scholarship, under its own privacy policy.

3.3 Correspondence

If you contact us by email or through a contact form, we keep your message and our reply so that we have a record of the enquiry and can deal with any follow-up.

3.4 Information collected automatically

Our hosting provider records standard server log data each time the site is accessed:

• IP address
• date and time of the request
• pages and files requested
• referring URL
• browser type, version and operating system

This is used to deliver the site, keep it secure, and diagnose faults or abuse. It is not combined with your customer account or used to build a profile of you.

We do not operate a mailing list and do not send marketing emails. The only emails you receive from us relate to your order, your licence and its renewal.

3.5 Analytics

We use Google Analytics to understand which pages are visited and how the shop is performing. It is provided by Google Ireland Limited and Google LLC, which process the data on our behalf.

Google Analytics sets cookies and records information such as the pages you view, how long you stay, your approximate location, and your device and browser type. It does not log or store your IP address, though your IP is used momentarily to derive approximate location.

Google Analytics only runs if you accept analytics cookies. Nothing is loaded and no cookies are set until you consent, and you can withdraw consent at any time through the provided button on our cookie policy on the site. Declining has no effect on your ability to browse or buy.

We do not enable Google's advertising features, and we do not use analytics data to target advertising or to build profiles of individual visitors.

We also use Microsoft Clarity, provided by Microsoft Corporation, to understand how the shop is used. Clarity records how you interact with a page — scrolling, clicks and mouse movement — and produces both an aggregated view of that behaviour and a replay of the visit. Text you type into form fields is masked in your browser before anything is sent, so we do not see what you enter.

Clarity sets cookies and runs only if you accept analytics cookies. Nothing is loaded and no cookies are set until you consent, and you can withdraw consent at any time. Declining has no effect on your ability to browse or buy.

 

4. Cookies and similar technologies

We use cookies and equivalent browser storage for the following purposes:

• Strictly necessary — keeping you signed in, remembering the contents of your basket, processing payment securely, and recording your cookie choice. The shop cannot function without these, so they are set without asking.
• Functional — remembering choices and recognising a return visit, so pages behave consistently for you.
• Analytics — understanding which pages are visited and how the shop is performing, so we can improve it.

When you first visit, we ask which of these you accept. Only strictly necessary cookies are set without asking. Functional and analytics cookies are set only if you choose to allow them, and declining has no effect on your ability to browse or buy.

You can change your choice at any time, using the cookie settings button on our Cookie Policy page or the cookie icon that remains available on the site once you have made a choice. You can also delete or block cookies through your browser settings, though blocking strictly necessary cookies will prevent checkout from working.

Our Cookie Policy lists every cookie we use, what it does and how long it lasts.

5. Why we process your information, and on what legal basis

Purpose	Legal basis (UK/EU GDPR)
Processing and delivering your order	Performance of a contract, Art. 6(1)(b)
Taking payment and preventing fraud	Contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f)
Managing your account	Contract, Art. 6(1)(b)
Issuing and validating licences	Contract, Art. 6(1)(b)
Detecting licence sharing and misuse	Legitimate interests, Art. 6(1)(f)
Responding to enquiries	Legitimate interests, Art. 6(1)(f)
Keeping accounting and tax records	Legal obligation, Art. 6(1)(c)
Site security and server logs	Legitimate interests, Art. 6(1)(f)
Analytics	Consent, Art. 6(1)(a)

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of anything done beforehand.

6. Who we share your information with

We share personal information only where it is needed to run the shop, and only with providers who are bound to process it on our instructions:

• Payment processing: Stripe and PayPal, depending on the method you choose at checkout
• Hosting: Hawk Host Inc., with servers located in Canada
• Delivery: the carrier handling your order, which receives your name, delivery address and, where required, your telephone number
• Analytics: Google Ireland Limited and Google LLC, and Microsoft Corporation, where you have accepted analytics cookies

We may also disclose information where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

7. How long we keep it

• Order, licence and transaction records: 7 years from the end of the relevant financial year, to meet tax and accounting obligations.
• Account information: until you ask us to close the account. Completed orders may be retained separately under the period above.
• Licence records (including Zotero user ID): for the life of the licence and for 12 months afterwards, so that renewals and support enquiries can be handled.
• Licence verification logs: 90 days.
• Correspondence: 24 months after the enquiry is resolved.
• Server logs: 90 days.
• Google Analytics data: 14 months from your last visit.
• Microsoft Clarity data, including session recordings: 13 months from collection.

8. International transfers

Because we are established in the United States and our servers are in Canada, information about customers in the UK or EEA is processed outside their home country.

Canada benefits from an adequacy decision issued by the European Commission covering organisations subject to PIPEDA, and the United Kingdom recognises Canada on the same basis. No additional safeguard is therefore required for the hosting arrangement.

For processing carried out by us in the United States, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum for customers in the United Kingdom. Where you have accepted analytics cookies, data is also processed in the United States by Google and by Microsoft; Google LLC and Microsoft Corporation are both certified under the EU-US Data Privacy Framework and its UK extension. A copy of the relevant safeguards is available on request.

9. Your rights

You have the right to:

• request a copy of the personal information we hold about you
• have inaccurate information corrected
• request erasure of your information, subject to records we are legally required to keep
• request that we restrict processing
• object to processing carried out on the basis of legitimate interests
• receive your information in a portable, machine-readable format
• withdraw your consent to analytics cookies at any time

To exercise any of these, write to [email protected]. We will respond within one month.

You may also complain to a supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). In the EEA it is the authority in the country where you live or work.

10. If you are in California

Under the California Consumer Privacy Act you may request disclosure of the categories of personal information we have collected, request its deletion, and opt out of any sale or sharing of it. We do not sell personal information and do not share it for cross-context behavioural advertising. You will not receive different pricing or service for exercising these rights.

11. Children

The shop is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us with information, please contact us and we will delete it.

12. Security

Traffic between your browser and our servers is encrypted using TLS. Payment details are handled entirely by our payment provider and do not pass through our systems in a readable form. Passwords are stored hashed. We maintain appropriate technical and organisational measures to protect against loss, misuse and unauthorised access, though no method of transmission over the internet is entirely secure.

13. Changes to this policy

We update this policy when the shop or the law changes. The version published on this page is the one that applies, and the date of the most recent change appears at the top.

14. Contact

For any question about this policy or about how we handle your information, write to [email protected], or to the postal address in section 1.