Skip to content
Draft — not legal advice
This page is a product-oriented draft for operators and counsel to review. It is not a substitute for attorney review and is not binding until CitationFeed publishes a finalized version.
Legal
Privacy Policy
Last updated: July 17, 2026
Who we are
CitationFeed (“we”, “us”) provides B2B software that turns public U.S. federal Enforcement Actions into AI-enriched Leads and Digests for Subscribers (compliance consultants, insurers, and law firms).
Contact for privacy requests: privacy@citationfeed.com.
Scope
This draft describes how we handle personal data of Subscriber owners, Team Members, and website visitors. It does not cover Agency websites or Cited Company employee data that appears only because it was published in public Enforcement Action records.
Data we collect
Account data: name, email, authentication identifiers, firm/Subscriber name, Plan, billing status, and Team Member roster emails.
Usage data: Digest schedules, Filters, in-app navigation needed to operate the service, and basic server logs.
Payment data: processed by Creem as Merchant of Record. We store Creem customer and subscription identifiers, not full card numbers.
Communications: support emails and transactional messages (auth, Digest, invite, billing).
Agency public data
Lead content is derived from publicly available federal Enforcement Actions (for example OSHA, EPA, FDA, SEC, FTC, DOJ). That content may include business names, addresses, and other fields Agencies publish. We do not scrape private consumer profiles for Lead generation.
How we use data
- Provide Plans, Digests, Lead browse, and Regulatory Monitor
- Authenticate users and enforce Seat / Plan entitlements
- Bill Subscribers and manage trials via Creem
- Improve reliability, security, and support
- Comply with law and respond to lawful requests
Legal bases (where applicable)
Where GDPR/UK GDPR applies, we typically rely on contract performance (providing the service), legitimate interests (security, product improvement, B2B outreach limited to Account contacts), and consent where required (for example certain cookies or marketing emails).
Subprocessors
- Supabase — database and authentication
- Creem — payments and subscription billing (Merchant of Record)
- Resend — transactional email
- DeepSeek — AI extraction, Pitch Suggestions, Regulatory Monitor
- Vercel — application hosting and analytics
Retention
Account and billing records are retained while the Subscriber is active and for a reasonable period afterward for disputes, audits, and legal obligations. Lead corpus derived from public Agency sources may be retained as part of the shared product database. Support emails are retained as needed to resolve issues.
Your rights
Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Request via privacy@citationfeed.com. We may need to verify identity and cannot delete Agency-published public records that we lawfully reprocess as part of the product corpus when deletion would break shared Lead integrity for other Subscribers — we will explain limitations case by case.
Security
We use industry-standard controls including TLS in transit, access controls, and service-role separation for administrative database access. No method of transmission or storage is 100% secure.
Children
CitationFeed is a B2B service for professionals. It is not directed to children under 16, and we do not knowingly collect their data.
Changes
We may update this draft. Material changes will be reflected by the “Last updated” date and, where appropriate, notice in-product or by email to Subscriber owners.
Contact
Privacy: privacy@citationfeed.com. Support: support@citationfeed.com. Governing law and venue will be set in finalized Terms.