1. What we collect
This policy explains what data we collect about you, how we use it, and what rights you have. We wrote it in plain English because privacy policies shouldn't require a law degree.
We collect only what we need to run the service and bill you accurately:
- Email address — account creation, billing notifications, service updates. Retained while your account is active.
- Name — account identification. Retained while your account is active.
- API usage logs — billing, rate limiting, abuse prevention, service improvement. Retained 90 days.
- AI prompts & responses (audit log) — a reviewable record of your own AI queries (Pro plans and above). You choose: 90 days (default), 30, 15, or off.
- Failed & refused AI queries — debugging and abuse prevention (all plans, including free). Retained 90 days.
- Payment information — billing, processed by Stripe; we never see or store card numbers. Managed by Stripe.
API usage logs include which endpoints you called, timestamps, response codes, and request latency. They do not include the content of API responses or the queries you send to standard data endpoints.
AI features are the exception. When you use the natural-language ask, AI summaries, or alert narratives (whether through the API or by emailing our AI address), the text you submit and the AI response we generate are stored as an audit trail so you can review your own AI usage. This applies on Pro plans and above. You control how long it is kept (see Section 4), including turning it off.
When an AI query fails or is refused (an out-of-scope or malformed request), we retain the query text and the error or refusal reason — but not any successful results — for 90 days across all plans, including free, to debug failures and prevent abuse.
2. Data about you vs. data in the API
Two kinds of data live here. We treat them differently.
Customer data (about you). The account data listed in Section 1 — email, name, company, usage logs, billing — is your personal information. We do not sell it, rent it, share it with advertisers, or include it in any data-broker feed. We do not run tracking pixels on our landing site or in the API.
API payload data (about organizations and some individuals). The API primarily serves records about organizations. Some federal records we aggregate identify individuals in their official or regulated capacities — for example, corporate officers and directors named in SEC filings, signatories on Form D private-placement notices, individuals listed on the OFAC Specially Designated Nationals list, healthcare professionals subject to HHS-OIG exclusion orders, and lobbyists registered under the federal Lobbying Disclosure Act. These individuals appear in the public record by operation of federal law. We treat this data as personal data under the GDPR and CCPA and apply the rights described in Section 6 to it, subject to the limitations explained there.
We don't do any of the following:
- No advertising partners. No tracking pixels, no ad networks, no cross-context behavioral advertising.
- No selling customer data. Charging for API access to federal public records is our business model (see Section 7 for how this interacts with CCPA "sale" definitions); we do not separately sell customer account data.
- No API cookies. The API uses bearer keys in request headers; no cookies are set on api.publictrace.dev.
3. How we use your data
We use the data we collect for these purposes and nothing else:
- Account management: creating your account, authenticating your API requests, communicating about your account.
- Billing: calculating your usage, processing payments, sending invoices.
- Service improvement: understanding which endpoints are most used, identifying performance bottlenecks, planning capacity.
- AI features: processing the prompts you submit to our AI endpoints (including sending them to a third-party model provider to generate a response) and storing your prompts and the responses in your AI audit log.
- Abuse prevention: detecting and preventing unauthorized access, rate limit violations, and terms of service violations.
- Legal compliance: responding to valid legal requests when required by law.
4. Data retention
We keep your data only as long as we need it:
- Account data (email, name): retained while your account is active. Deleted within 30 days of an account-deletion request.
- API usage logs: retained for 90 days, then automatically purged. Aggregated, anonymized statistics may be retained longer.
- AI call audit log (Pro plans and above): the text of your AI prompts and the responses we return. Retained for a window you set in your account: 90 days by default, reducible to 30 or 15 days, or switched off entirely. Older entries are purged automatically when they pass the window you chose.
- Failed / refused AI queries: the query text and the error/refusal reason are retained 90 days, then purged, across all plans. This is separate from, and not controlled by, your AI audit-log retention setting — it serves debugging and abuse prevention (see Section 3).
- Billing records: retained for 7 years as required by tax law.
You can request deletion of your account and associated data at any time by emailing [email protected]. We will process your request within 30 days.
5. Third parties
We share data with a small number of service providers that are essential to running PublicTrace:
- Stripe — payment processing. Stripe handles all credit card data under their own privacy policy. We never see your full card number.
- Cloud infrastructure — the Service is hosted on infrastructure located in the United States. We use additional US-based cloud providers for encrypted backups and occasional AI inference, and an edge/CDN security provider in front of the Service. A named list of our subprocessors is available to enterprise customers under our Data Processing Addendum.
- AI model provider — when you use an AI feature, the prompt you submit is sent to a third-party large-language-model provider to generate the response. Only the prompt text is sent; we do not attach your account identity to it.
That is the complete list. We have no advertising partners, no analytics vendors, and no data brokers in our supply chain.
6. Your rights
Rights regarding your customer account data (email, name, company, usage logs, billing — everything in Section 1): you may access, correct, export, and delete it at any time by emailing [email protected]. We respond within 30 days (45 days for CCPA requests, extendable to 90 where permitted).
Rights regarding personal data inside the API that identifies you as the subject of a government record (e.g. you're named as a director in an SEC filing, signatory on a Form D notice, excluded provider on the HHS-OIG list, registered lobbyist on LDA, or party in a federal civil/appellate/bankruptcy filing via the FJC IDB): because these records are public by operation of federal law and retention serves a public interest (GDPR Art. 17(3)(b)/(d); CCPA §1798.145(a)(4)), we cannot delete the underlying entry. On verified request we can:
- De-link your personal identifier from our canonical entity record, so our API no longer surfaces it in resolved entity results;
- Correct factual errors in our normalization or entity resolution;
- Suppress your record from AI-generated summaries;
- Explain the source filing the record originated from.
The source government filing will remain accessible at its original agency (e.g. SEC EDGAR, PACER). We cannot remove it from there.
To exercise any of these rights, email [email protected]. We will not discriminate against you for exercising your privacy rights.
7. GDPR and CCPA
At this time, PublicTrace does not offer the Service to customers located in the European Economic Area, the United Kingdom, or Switzerland. Signup from those regions is blocked at our account creation step. When we open EEA/UK availability we will appoint an EU representative under GDPR Art. 27 and publish updated transfer terms.
GDPR — lawful basis for processing customer data. Contract performance (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) covering usage analytics, abuse prevention, and service improvement. A Data Processing Addendum (DPA) is available to enterprise customers.
GDPR — lawful basis for API-payload personal data. Where records we aggregate include personal data of EU/UK data subjects, we rely on Art. 6(1)(f) (legitimate interests) — specifically the interests of our customers (financial institutions, compliance teams, journalists, researchers) in transparency, anti-financial-crime screening, due diligence, and accountability for public-office and regulated activity. We have documented a legitimate-interest assessment available to supervisory authorities on request. For records covering criminal convictions or offenses (Art. 10 GDPR) — primarily DOJ enforcement actions and federal court dockets — we restrict access to customers who self-certify a compatible lawful purpose.
CCPA/CPRA categories and disclosures. California residents have rights to know, delete, correct, limit use of sensitive personal information, opt out of sale/sharing, and non-discrimination. The customer data described in Section 1 falls under CCPA §1798.140(v) categories "identifiers" and "commercial information." API-payload personal data described in Section 2 falls under "identifiers" and "professional or employment-related information."
"Sale" and "sharing" under CCPA §1798.140(ad)/(ah). We do not engage in cross-context behavioral advertising ("sharing"). Providing paid API access to federal public records that identify individuals may be considered a "sale" under §1798.140(ad). California residents may opt out at [email protected] or via a Global Privacy Control header (honored automatically). A "Do Not Sell or Share My Personal Information" link appears in our footer.
Sensitive personal information. We do not collect CCPA "sensitive personal information" (SSN, driver's license, precise geolocation, genetic data, etc.) from customers, and we do not process any such data for purposes outside those described in this policy.
9. Security
We take reasonable measures to protect your data, including:
- Encryption in transit (TLS 1.2+) for all connections
- AES-256 encryption at rest
- API keys are salted-hashed (SHA-256) before storage; we cannot read your key after issuance
- Access to production systems is restricted, logged, and subject to mandatory MFA
If we discover a breach affecting your personal data, we will notify you without undue delay and, where required by GDPR Art. 33–34 or applicable US state breach-notification statutes, within the statutory deadline (generally 72 hours for the relevant supervisory authority). See our Security page for vulnerability-disclosure details.
9a. International transfers
Our infrastructure is hosted in the United States. While EEA/UK customer signup is blocked (see Section 7), any incidental data transfers for customers outside the EEA/UK occur under our providers' own recognized compliance frameworks (including the EU-US Data Privacy Framework where applicable). We will update this section when EEA/UK availability opens.
10. Changes to this policy
If we make material changes to this policy, we will notify you via email at least 30 days before the changes take effect. The "Last updated" date at the top of this page always reflects the most recent revision.
11. Contact
For privacy-related questions, concerns, or data requests:
Email: [email protected]
Postal: PublicTrace, 5227 N 7th St STE 50418, Phoenix, AZ 85014, USA
12. Children
PublicTrace is a business-to-business service and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe we have, contact [email protected] and we will delete it.