Privacy policy

When you create an account

• Your company name, your name and your work email.
• Your password, stored only as a scrypt hash with its own random salt. We can't see or recover it.

When you're signed in or use the API

• A session cookie (HttpOnly, valid 30 days) that keeps you signed in. We store only a fingerprint (SHA-256) of it.
• API keys you create: their name, first characters and a fingerprint. The full key is shown to you once and never stored.
• A usage record for each check: your company, the type of check, the state, whether it succeeded, whether it came from the app or the API, and when. It doesn't contain the name you searched.

When you run a search

• To run and speed up searches, we keep a log of the searches sent to each state's records (the name searched, the state, the time and whether it worked) and a cache of recent results. This log isn't linked to your account.

On your device

• The app keeps your recent searches in your browser's local storage, on your device only. Clearing your browser data removes them.
• If you start a search on a public state page before signing in, your browser holds it in session storage until you sign in; the app then runs it and discards it.

When you visit the website

• Google Analytics collects the pages you visit, approximate location, device and browser details, using cookies. It also records when someone signs up or signs in, without personal details. Google's own privacy policy applies to that data.
• Our web server keeps standard access logs (IP address, time, page requested, browser) for security and troubleshooting.

Chrome extension ("Clerkfield for Underwriters"). The extension doesn't read the pages you visit. It only uses text you select and send to it with the right-click menu (or type into its panel). That text, the state you choose and your API key are sent to clerkfield.com to run the search, and handled like any other search under this policy. Your API key, your last-used state and nothing else are stored in your browser's extension storage; removing the extension deletes them. The extension doesn't use analytics, ads or tracking, and doesn't sell or share data with anyone.

MCP server. When an AI assistant calls Clerkfield's MCP tools, the business names, states and owner names it sends are handled like API searches under this policy. Clerkfield doesn't receive the rest of your conversation with the assistant.

Clerkfield shows information from official state records: business registries and UCC filing offices. Those public records can include the names and addresses of people who are officers, members, registered agents, debtors or secured parties. We show them as the state publishes them, with the source and date. Clerkfield reports on businesses; it is not a consumer reporting agency and must not be used for decisions about individuals' credit, employment, insurance or housing (see the terms).

• To run the service: checks and searches, signing you in, API keys.
• To count usage per company, for limits and later for billing.
• To keep the service secure and fix problems.
• To understand how the website is used and improve it.

We don't sell personal information, and we share it only with the service providers below or when the law requires it.

• Amazon Web Services: hosting, in the United States (Ohio).
• Google: Google Analytics for the website.

• Account information and usage records: while your account is open. When you ask us to close it, we delete your account information within 30 days.
• Sessions: until they expire after 30 days or you sign out.
• Web server access logs: 14 days.
• Search log and cached results: they aren't linked to any account, and for now they have no fixed deletion date.

You can ask us to see, correct or delete your account information by writing to hello@clerkfield.com. You can block analytics cookies in your browser's settings. Depending on where you live, you may have more rights under local law, and we'll honor them.

Passwords are hashed with scrypt; session tokens and API keys are stored only as fingerprints; the whole site uses HTTPS. No system is perfectly secure; if you find a problem, tell us at hello@clerkfield.com.

Clerkfield is a business service and isn't meant for anyone under 18.

We'll post changes on this page with a new date, and email account holders about material changes.