Privacy policy
Last updated October 29, 2026
CitationLeads is operated by ShutterReach (Mukwonago, Wisconsin). This policy explains what we collect, where it's kept and who processes it.
Your account
- Account record. When you create a free account or subscribe, we create a customer record in Stripe with your email, plus your plan and your alert settings (product categories, states, frequency, minimum penalty). Paid subscriptions are processed by Stripe; we never see your full card number.
- Your portal data. Saved leads, notes, contact log, watchlist, your outreach signature (name, title, company, phone, email and one line about what you offer), your Salesforce Organization ID, and a list of alerts already sent to you are stored in private storage on Vercel, our host.
- Messages. If you contact us, we keep your email and message so we can reply.
Websites you enter
When you enter a website, we fetch a few of its public pages to work out what it sells. Sites that block automated visits are read from the Internet Archive's public copy or through Jina AI's public reader service, which receive the address. We keep the site's address, page title and the matched categories in our usage log; we don't keep the page contents.
Website visitor identification (Pro feature)
If you install our snippet on your website, each page view sends the visitor's IP address, the page path and the referring page to us. We look up which organization owns the network (through ARIN's public registry and reverse DNS) and keep only the organization's name, domain, pages viewed and OSHA history. We never store IP addresses or any information about individual people. We skip home and mobile internet providers. If you use this feature, tell your own site's visitors in your privacy policy that you use business visitor analytics. CitationLeads uses the same snippet on its own pages.
OSHA data
Inspection and citation records come from the U.S. Department of Labor's public enforcement data, which we query through a public research mirror (labordata.bunkum.us). Company names you look up or watch are sent to that mirror as part of the query. The records name employers, not individual workers. If you think a record is wrong, OSHA is the source of truth.
Google Maps
When a signed-in user opens an inspection or a saved lead, we look up the employer's Google Maps listing (phone, website, map link and whether it's still open) through Google Maps Platform. We send Google only the employer's name and address from the OSHA record, never your data. We keep only Google's place ID for that employer; the phone, website and status are fetched fresh each time and not stored. Google's handling of these requests is covered by the Google Privacy Policy.
Cookies and analytics
We set one cookie, cl_pro, when you sign in (free or Pro), to keep you signed in. We use Vercel Web Analytics, which counts page views without cookies or personal profiles. There are no advertising cookies.
Emails
We send sign-in links and, for Pro subscribers, alert emails through Resend. You can change or switch alerts off at any time in your portal.
Who processes your data
We don't sell your data. It's processed only by the providers that run CitationLeads: Vercel (hosting and storage), Stripe (accounts and payments), Resend (email), Google Maps Platform (phone, website and map links on inspection pages and saved leads; we send it only the employer's name and address from the OSHA record, never your data), the Internet Archive and Jina AI (reading sites that block bots), ARIN (network registry lookups) and the OSHA data mirror above. We disclose data when the law requires it.
Your choices
You can ask us to export or delete your data at any time through the contact page. Cancelling your subscription stops alert emails.