Privacy Policy

Effective September 11, 2026

BizLeadFeed ("we", "us") operates a lead-intelligence service built on official Secretary of State business filings. This policy explains what personal information we collect, why, and what we deliberately do not collect.

1. Who we are

BizLeadFeed.
Contact: [email protected]

2. Information we collect

  • Accounts. When you request a magic-link we store the email address you submit. After you click the link we create (or reuse) an account record: email, plan (free, alerts, pro, or feed), an optional Stripe customer id, and timestamps. We do not use passwords. That email is the only login; access to the site requires access to the inbox.
  • Magic-link tokens and sessions. Login tokens are stored only as a SHA-256 hash, expire in 15 minutes, and are single-use. After a successful redeem we set an HTTP-only session cookie (blf_session). The cookie value is random; we store only its SHA-256 hash. Sessions slide to 30 days on activity.
  • Billing identifiers. If you subscribe, Stripe creates a Customer and Subscription. We store Stripe's customer id, subscription id, price id, status, and period dates so we can open the billing portal and apply your plan. We never see or store card numbers, CVC, or bank details — Stripe collects those on its hosted Checkout and portal pages.
  • Saved alerts. On a paid plan we store the filters you save (name, keywords, geography, entity type, and related cuts), an optional notify-email, attachment formats, and when we last delivered a digest. We also store a count of companies included on delivered alerts in the current UTC month so we can enforce the plan's lead cap.
  • Waitlist signups. If you ask to be notified when another state is live, we store the email you submit, optional industry / state / plan notes, and a timestamp. The waitlist is not a Florida purchase path.
  • Operational logs. Our host processes standard web request data — IP address, user agent, timestamps — for security, abuse prevention, and reliable operation.

3. What we do not collect

  • No third-party analytics or advertising scripts.
  • No cross-site tracking pixels.
  • No passwords, and no payment-card data on our servers.
  • We do not append consumer-data enrichment such as personal cell numbers bought from aggregators. Phones or emails that appear on a filing or an official bulk list (NPPES, DBPR, FMCSA) are public-record or official-list facts and are labeled as such.

4. Cookies

The only first-party cookie we set is blf_session, and only after you redeem a magic link. It is HTTP-only, SameSite=lax, and marked Secure in production. We use it solely to keep you signed in. Clearing it signs you out. Stripe may set its own cookies on Checkout and the billing portal; those are governed by Stripe's privacy policy.

5. Public records we display

The business filings shown on the service come from official state feeds — currently the Florida Division of Corporations. Those filings are public records. We present them as published and derive a small number of convenience fields (for example, an approximate county from ZIP); derived fields are always labeled as inferred rather than as state facts.

6. How we use information

  • To operate, secure, and improve the service.
  • To send the magic-link that signs you in, and (on paid plans) alert digests you asked for.
  • To create and maintain a Stripe Customer, take payment, open the billing portal, and apply refunds and cancellations to your plan.
  • To enforce saved-alert and monthly lead caps on your plan.
  • To notify waitlist members when a requested state is available.

Plan is owned by Stripe webhooks. A refund sets your plan to free on the next request; the session cookie is not destroyed — you stay signed in, on the free view (14-day-old files, no saved-alert delivery). When we offer a refund is in the Terms: no refund of elapsed time; the $1 Starter tier is the evaluation path; a yearly plan cancelled early refunds unused full months pro-rata at the monthly rate. Other requests are considered at our discretion.

7. Sharing and processors

We do not sell or rent personal information. We share only:

  • Stripe — payment processing, customer and subscription records, invoices, refunds, and the billing portal. See stripe.com/privacy.
  • Resend — transactional email (magic links and alert digests). We send the recipient address and message content; we do not log API keys.
  • Our hosting provider — solely as needed to serve the site.
  • Authorities, where legally compelled.

8. Retention

  • Accounts and sessions: kept while the account exists; unused sessions expire; you can ask us to delete the account.
  • Magic-link tokens: hashed; unused rows are dropped after they expire.
  • Stripe identifiers and subscription rows: kept as long as needed to bill, refund, and show history in the portal; Stripe keeps the payment record under its own policy.
  • Saved alerts and monthly lead-usage rows: kept until you delete the alert or we delete the account.
  • Waitlist entries: kept until you ask us to remove them.
  • Operational logs: kept according to our hosting configuration.

9. Your choices

  • Sign out from the site to drop the current session cookie.
  • Paid users manage card, plan, interval, and cancel-at-period-end in the billing portal.
  • Email [email protected] to delete your account, remove a waitlist entry, delete saved alerts, or request access to or correction of what we hold about you. We will act on reasonable requests promptly.

10. Children

The service is directed at businesses and professionals. It is not intended for anyone under 18, and we do not knowingly collect information from them.

11. Changes to this policy

We post updates on this page with a new effective date. Material changes will be announced on the site.

Questions? [email protected]. See also our Terms of Service.