Privacy Policy

Last updated: November 12, 2026

This Privacy Policy describes how CountyLeads LLC, a Utah limited liability company ("CountyLeads," "we," "us," "our"), collects, uses, and shares information when you use our county subscription service and our lead store at countyleads.ai (the "Service"). (The lead store and contact unlocks are not yet available; the sections about them apply once they launch.) It covers two groups of people: the businesses that buy from us, and the individuals who appear in the public records we sell (Section 2).

1. Information We Collect

Account Information

When you sign up, we collect:

• Email address
• Hashed password (we never store passwords in plaintext)
• Subscription plan and county selections
• Trial end date and subscription status
• Clickwrap consent audit metadata: the timestamp, IP address, browser user-agent, and Terms of Service version you accepted at signup. We retain this record for the life of your account plus 7 years so we can demonstrate your acknowledgment of our FCRA disclaimer if ever challenged.

Payment Information

Payment processing is handled by Stripe, Inc. Stripe stores your card details directly; we never see or store your full card number, CVC, or billing address. We retain only:

• Your Stripe customer ID
• Your Stripe subscription ID
• Subscription status and trial expiration

Stripe's privacy practices are described at stripe.com/privacy.

Lead Store Activity

If you use the lead store (see our Store Terms), we also keep:

• Your unlock history: which leads you unlocked, whether shared or exclusive, whether you added contact details, and the credits spent
• Your credit ledger: every grant (purchase, plan, free signup credits, returned credits), spend, expiry and clawback, with dates and the Stripe payment reference
• Your attestations: the exact permissible-use and Do Not Call wording you accepted, with the date, your IP address, your browser user-agent and the Store Terms version
• Your saved searches and their alert settings
• A record that your mailbox verified its email and claimed the free signup credits, so the credits are given once

Email Delivery

Your weekly data deliveries are sent via Resend, Inc.. Resend receives your email address and the file attachment for each delivery. Resend's privacy practices are at resend.com/legal/privacy-policy.

Usage Data

We collect minimal usage data: timestamps of your delivery emails, whether they bounced, and basic dashboard interactions. We use Vercel Web Analytics, which records page views without cookies or cross-site tracking. We also use PostHog for product analytics: page views, clicks, time on page and session recordings, with everything typed into form fields masked and record data and account emails excluded. PostHog sets a first-party cookie or local-storage identifier in your browser, and while you are signed in links your activity to your account ID (not your email). We use it only to improve the service, never for advertising, and we do not sell this data. We do not use Google Analytics, Meta Pixel, or advertising trackers.

2. Public Records Data

The data we sell (probate filings, court records, code violations) comes from public records. We collect it from US county and municipal government portals, combine it with other public records, and sell it to business buyers in weekly county files and, one lead at a time, in our lead store. This section tells you, if you are named in one of those records, what we hold about you and how to have it removed.

What we hold about people named in public records, and where it comes from

• From county court and code-enforcement portals: names and roles of the parties in probate, civil, foreclosure, and criminal cases (for example decedent, petitioner, executor, plaintiff, defendant), case number, case type, filing date, and, where published, charge descriptions, a party's mailing address and a decedent's date of death.
• From county property-tax rolls (appraisal-district and auditor bulk files, for example Harris County TX and Duval County FL): the owner name, the property address, the owner's mailing address, the assessed market value, whether a homestead exemption applies, and the last sale date and price where the roll has them. We match a record to a parcel automatically by name and address, so a match can be wrong.
• From a skip-trace data provider, only when contact unlocks are enabled and a buyer buys them: phone numbers (with line type and a Do Not Call flag) and email addresses for the petitioner, executor or fiduciary named on a record. We never trace the decedent, and we do not collect contact details from the records themselves.

We do not collect or store Social Security numbers, financial-account numbers, dates of birth of living people or the identity of minors. Where a county's portal shows a date of birth, our scrapers do not keep it, and our county sources do not publish the others in the fields we use.

Who sees it. Only business buyers who accept our terms, and who promise not to use it for credit, insurance, employment, tenant screening or any other use covered by the Fair Credit Reporting Act, and not to resell it. See Store Terms and FCRA notice.

Your choices. You can ask us to stop selling your information and to remove it (Section 2A below). We cannot change or seal the underlying court record. For that, contact the court clerk.

Subscribers are contractually prohibited from using delivered data to stalk, harass, dox, or target any individual, and from reselling or republishing the data as a people-search, background-check, or list product. See Sections 4A, 4B, and 5A of our Terms of Service for the full permitted-use, anti-harassment, and anti-resale rules and the consequences of violation.

2A. Removal Requests — Daniel's Law and Similar Protections

Anyone named in a record we sell can ask us to remove their information, whether or not a law requires it. Requests may be sent by the person or by an authorized agent. Use the steps below. People covered by Daniel's Law and similar statutes have a legal right to removal; everyone else we treat case by case and accommodate reasonable requests.

If you are a judge, prosecutor, law enforcement officer, correctional officer, public defender, child protective investigator, or an immediate family member of any of the foregoing, and your information may appear in a CountyLeads delivery, you may request removal under New Jersey's Daniel's Law (N.J.S.A. 56:8-166.1) or any analogous federal or state statute.

To submit a removal request:

1. Email removal@countyleads.ai with the subject "Protected Individual Removal Request"
2. Include your full name as it may appear in court records, any known case numbers or county where records may exist, and your professional role (you do not need to prove protected status before we act; we may ask reasonable follow-up questions afterwards)
3. State whether the request covers you personally, an immediate family member (include their name), or both

We acknowledge receipt within 2 business days. We stop disclosing the information within 10 business days after we receive the request, and we may afterwards ask reasonable follow-up questions. When we act, we: (a) suppress the record from all future deliveries and remove it from the lead store, (b) delete any phone numbers and emails we cached for you, (c) notify existing subscribers and every store buyer who received that record that they must destroy their copy per Section 4 of our Terms of Service and Section 9 of our Store Terms, and (d) keep a suppression record so the record is not ingested again on later scraper runs. That record holds a keyed hash of your name and address, and also the name and address as you gave them, the source of the request, the reason if one was given, and the dates we received and completed it. Only our administrators can see it; it is not shown to subscribers or buyers. We keep it until an administrator deletes it; we have no automatic expiry.

If you are not covered by Daniel's Law but still want your information removed from future deliveries, email the same address — we evaluate these requests case-by-case and will accommodate reasonable requests even when not legally required.

2B. AI-Assisted Data Processing

For certain counties that publish records only as scanned PDFs (e.g., Hamilton County OH), we use Anthropic Claude Vision to extract structured fields (names, dates, case numbers, addresses) from those PDFs. The PDFs themselves are public records and contain only information the issuing court has already published. We send only the minimum necessary image data to Anthropic's API and retain no model training rights; Anthropic does not use API content to train its models per its commercial terms. Anthropic's privacy practices are at anthropic.com/legal/privacy.

3. How We Use Your Information

• To provide the Service (deliver your subscribed county data)
• To process payments and manage subscriptions
• To send transactional emails (delivery notifications, billing receipts, account alerts)
• To respond to support requests
• To detect and prevent fraud, abuse, and security threats
• To prove clickwrap consent in the event of an FCRA, privacy, or consumer-protection claim

4. How We Share Information — Subprocessors

We do NOT sell your account information (your email, payment, usage and attestation records). We share it only with the sub-processors necessary to deliver the Service. The public-record data we license to buyers is described in Section 2; it is the product, not your account data.

• Stripe, Inc. — payment processing (USA)
• Resend, Inc. — transactional email delivery (USA)
• Supabase, Inc. — database and file storage hosting (USA)
• Vercel, Inc. — application hosting (USA)
• PostHog, Inc. — product analytics: page views, clicks, time on page and session recordings with form inputs masked. It never receives record data (USA)
• Cloudflare, Inc. — DNS and email routing for our domain, and the Turnstile bot check on signup (USA)
• Trigger.dev, Inc. — scheduled background job runtime for scrapers (USA)
• Anthropic, PBC — Claude Vision API for PDF data extraction on vision-dependent counties only (USA)
• REsimpli, or any other CRM you connect — your delivered records are sent to it at your direction, using the API key you give us. We store that key encrypted and delete it when you disconnect (USA)
• 2Captcha — solves bot-check challenges on some county portals; it receives the challenge image only, never record data
• BatchData — skip-trace (phone and email lookup). Used only when contact unlocks are enabled: we send the name and mailing address of the petitioner, executor or fiduciary on a record, and receive phone numbers and emails back (USA)

We may also disclose information when required by law, subpoena, or court order, or to protect our rights, property, or safety.

5. Data Retention and Export

We retain your account information for as long as your subscription is active and for up to 12 months after cancellation, after which we delete it (except anonymized financial records required for tax compliance, which are retained for 7 years, and clickwrap consent audit records as described in Section 1).

County subscription files. Delivered Excel files are stored in our object storage for 90 days, then permanently deleted.

Lead store. We keep:

• Unlock records and the credit ledger for as long as your account exists. We use them for refunds, chargebacks and to prove which buyer received which lead if a removal or a dispute arises. When your account is deleted they are deleted with it. Payment records held by our payment processor follow the payment-record retention described above.
• Attestations for as long as your account exists, to prove what you agreed to. They are deleted with the account.
• Saved searches until you delete them or your account is deleted (up to 12 months after cancellation, like other account data).
• Cached contact details (phones and emails traced for a person on a record) for 180 days after the trace, then they are deleted and a new buyer triggers a fresh trace. A trace that found nobody is remembered for 30 days. When a person is suppressed, their cached contact details are deleted at once. A buyer's own copies are covered by the Store Terms: the buyer must delete them on notice.
• Public-record and property data for as long as we keep the underlying record. A lead stops being offered in the Store when it is sold exclusively, when all of its shared slots are sold, when its county stops being eligible, or when the person is suppressed; being taken off sale does not delete it. It stays stored, and buyers who already unlocked it can still see it, except that a suppressed person's lead is hidden from every buyer and each buyer who unlocked it is told to destroy their copy (Section 2A and the Store Terms). We do not yet delete delisted leads on a schedule.

Data export on cancellation. You may request a machine-readable export (JSON or CSV) of your account data — profile, subscription history, delivery log, and the last 90 days of delivered files — at any time before or within 30 days after cancellation by emailing privacy@countyleads.ai. We provide the export within 10 business days at no charge.

6. Your Rights — State Privacy Laws

CountyLeads is a small business. Most state privacy laws (the California CCPA/CPRA and the Virginia, Colorado, Connecticut, Texas, and Utah acts) do not currently apply to us, and many exclude information from government records. We nonetheless honor the following requests from anyone, wherever they live:

• Know what personal information we collect and how we use it
• Access a copy of the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Export your account data in a portable format (see Section 5)
• Opt out of the sale of your account information (we do not sell it). If you are named in a public record we deliver, you may ask us to stop selling and delivering it (Section 2A).
• Opt out of targeted advertising (we do not engage in targeted advertising)
• Opt out of profiling that produces legal or similarly significant effects
• Non-discrimination for exercising any of these rights

Global Privacy Control (GPC). We honor the GPC browser signal as a do-not-sell request for California and Colorado residents. We do not sell your account information or share it for targeted advertising, and we will not override the signal.

How to exercise your rights. Email privacy@countyleads.ai from the email address on your account. We will verify your identity (usually by confirming you control the account email) and respond within 45 days (CCPA/CPRA) or 45-60 days (other states). If we need more time, we will notify you in writing with the reason.

Appeals. If we deny your request, you have the right to appeal by replying to our denial email with the subject "Privacy Request Appeal." We will respond to the appeal within 60 days. If your appeal is denied, you may contact your state attorney general.

7. Security

We use industry-standard security practices including HTTPS for all traffic, bcrypt-hashed passwords, encrypted database storage, server-side authentication for admin endpoints, and HMAC-signed inter-service requests. No system is perfectly secure; we encourage you to use a strong unique password and enable any available account-protection features.

8. Children

CountyLeads is intended for business use by adults aged 18 and over. We do not knowingly collect information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via email at least 14 days in advance.

10. Contact

CountyLeads LLC, a Utah limited liability company, 561 N 400 W, Orem, UT 84057, phone +1 360-560-0117. Questions about this Privacy Policy or your data?

• General privacy inquiries and state-law rights requests: privacy@countyleads.ai
• Daniel's Law and protected-individual removal requests: removal@countyleads.ai
• General account and billing support: support@countyleads.ai