Privacy Policy

CitationFeed (“we”, “us”, “our”) provides B2B software that turns public U.S. federal Enforcement Actions into enriched Leads and Digests for Subscribers — typically compliance consultants, insurers, and law firms.

Privacy requests: privacy@citationfeed.com.

This Policy describes how we handle personal data of Subscriber owners, Team Members, and website visitors. It does not govern Agency websites themselves. Business information that Agencies publish in Enforcement Actions (and firmographic or contact facts we attach from public sources) may include personal data about individuals named in those public materials; we process that data to provide the product as described below.

Account data: name, email, authentication identifiers, firm/Subscriber name, Plan, billing status, and Team Member roster emails.

Usage data: Digest schedules, Filters, in-app activity needed to operate the service, and basic server logs (for example IP address, timestamps, and error diagnostics).

Payment data: processed by Creem as Merchant of Record. We store Creem customer and subscription identifiers, not full payment card numbers.

Communications: support emails and transactional messages (authentication, Digest delivery, team invites, billing notices).

Lead and Enrichment content: public Enforcement Action fields and Enrichment we derive (for example facility address, phone, website, size estimates, and key contacts with email or phone when found in public sources). That content is shared across entitled Subscribers as part of the product corpus.

Lead content is derived from publicly available federal Enforcement Actions (for example OSHA, EPA, FDA, SEC, FTC, and DOJ). Enrichment may also use publicly available web sources. We do not purchase consumer credit files or scrape private consumer social profiles to build Leads. Public-source data can be incomplete, outdated, or incorrect.

• Provide Plans, Digests, Lead browse, Enrichment, and Regulatory Monitor
• Authenticate users and enforce Seat and Plan entitlements
• Bill Subscribers and manage trials through Creem
• Operate AI-assisted extraction, Pitch Suggestions, and related features
• Improve reliability, security, and customer support
• Comply with law and respond to lawful requests

Where GDPR or UK GDPR applies, we typically rely on: performance of a contract (providing the service you request); legitimate interests (securing the service, preventing abuse, improving reliability, and operating a B2B product on public enforcement and firmographic sources); and consent where required (for example certain non-essential cookies or optional marketing emails).

We use session cookies and similar technologies required for Supabase Auth and app security. We may use Vercel Analytics for aggregated traffic metrics. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We use trusted processors to operate CitationFeed, including:

• Supabase — database and authentication
• Creem — payments and subscription billing (Merchant of Record)
• Resend — transactional email
• Vercel — application hosting and analytics

Processors may store or process data outside your country. Where we transfer personal data internationally, we rely on appropriate safeguards available under applicable law (for example contractual protections with providers).

Account and billing records are retained while the Subscriber is active and for a reasonable period afterward for disputes, audits, tax, and legal obligations. The shared Lead corpus derived from public Agency and web sources is retained as part of the product database. Support emails are retained as needed to resolve issues and improve the service.

Depending on your location (including the EU/UK and certain U.S. states such as California), you may have rights to access, correct, delete, or export personal data; to object to or restrict certain processing; or to appeal a denied request. Submit requests to privacy@citationfeed.com. We may need to verify your identity.

We may be unable to delete Agency-published public records (or Enrichment needed for shared Lead integrity) in ways that would break the product corpus for other Subscribers. We will explain any limitation case by case. California residents may also contact us to exercise CCPA/CPRA rights; we will not discriminate against you for exercising those rights.

We use industry-standard controls including TLS in transit, access controls, and separation of administrative database credentials. No method of transmission or storage is completely secure.

CitationFeed is a B2B service for professionals age 18 and older. It is not directed to children, and we do not knowingly collect personal data from anyone under 16.

We may update this Policy from time to time. Material changes will be reflected by the “Last updated” date and, where appropriate, notice in-product or by email to Subscriber owners.

Privacy: privacy@citationfeed.com. Support: support@citationfeed.com. Our Terms of Service describe governing law for disputes about the service.