Last updated: November 9, 2026
About our data. USACIP is actively developed: features, coverage and this policy can change. Company data comes from public records published by sources we do not control — some are queried live, others are copies of published files we refresh on a schedule (section 1). A live source can be rate-limited or temporarily offline — when that happens a section says so instead of showing a guess. We cannot guarantee availability or completeness and accept no liability for interruptions originating with those sources. How we handle your account data, described below, applies in full regardless. See the Terms of Service for the full disclaimer.
USACIP shows information about companies and other organizations — not about private individuals. It comes from public records published by these sources:
Some sources are queried live when you open a page (for example SEC EDGAR, several state registries, CourtListener, the CFPB complaint database and the FDA recall reports). Others — for example the California, Florida, Alaska and Virginia registries, the officer lists Pennsylvania, Connecticut and New York publish on their open-data portals, the owners named on City of Chicago business licenses, the principals of Washington licensed contractors (L&I), Texas TDLR license holders who own a named business, the officers, directors and trustees nonprofits list on their IRS Form 990 returns (name and title only), California contractor licenses, Florida professional licenses (DBPR), SAM.gov, the IRS list, the four federal datasets above, the CPSC recall list and the Department of Labor wage filings — are copies of files the source publishes, kept on our server and refreshed on a schedule that ranges from several times a day to quarterly; a few files are no longer updated by their publisher at all (section 11). Each page shows the date its data was last checked or the date of the source file. We do not buy data from data brokers.
Company records can name people in their business role, and we show those names the way the public record states them: officers, directors and managers where the registry publishes them (for example California, Florida, Alaska, Pennsylvania and Connecticut, and the chairman or chief executive New York lists for a corporation), the people on a California contractor license (officers, qualifying managers, sole owners — from the Contractors State License Board), the company officers a motor carrier names on its USDOT registration (FMCSA, names only), registered agents, executives named in SEC filings, the authorized official of a healthcare organization listed in the NPI file (name and title), parties named in the caption of a court case involving the company, and the companies and people named as parties in an SEC litigation release or administrative proceeding or an FTC case (the agency's own list, as published). A person named in an SEC or FTC action is shown only on the page of a public company whose SEC filings list someone with the same full name as an officer or director — never in search by person, and only to someone who opened the company (a report or a plan's check), with a link to the agency's release and a note that it is a match by name. When a state record is linked to an SEC filer (section 11), the officers from that filer's SEC filings are shown on it. Visitors who are not signed in see officer names shortened (for example "J*** D***"). Search by person: anyone can enter a full first and last name and a state to see the company roles listed under that name by that state's register, the California Contractors State License Board, the Florida Department of Business and Professional Regulation, SEC insider and Form D filings, the CMS NPI file or the FMCSA motor-carrier census — the role, the company, its status and the city on file, never a street address. The officers' own street addresses that some registries publish (Florida, California) are not shown on company pages either, and our servers do not send them to the browser. Everyone sees up to three results; a longer list opens with a $2.99 purchase of that search or a check of a plan. People with the same name can be different people, and the results say so.
Name checks against federal lists (06.11): a company page that is open to you (a $2.99 report or a plan's check) checks the company name against the OFAC sanctions list (SDN), and the company and its current officers against SAM.gov exclusions and the HHS-OIG exclusion list (LEIE); search by person checks the searched name against all three — lists the federal government publishes so that anyone can screen who they deal with. A result is a name match only and is shown as one ("a person with the same name is on …"), with a link to the agency's own record: for SAM.gov and HHS-OIG the name must be in the same state (on a company page, the same city too); for OFAC, used for people only in search by person, the given names and the surname must each be the same. Officers' names are not checked against OFAC: without a US address there, common names would point at the wrong people. From these files we keep only the listed name, city, state, agency, start date and the profession the HHS-OIG list gives — not the dates of birth, street addresses, prison register numbers or other details some of them carry — and we never show the reason for an exclusion. Guests do not see these checks.
From the federal datasets we load organizations only. Records that the source marks as an individual — sole proprietors, self-employed people and independent contractors in the PPP data, and individual practitioners (NPI "entity type 1") — are never loaded, and every PPP, FMCSA and Form 5500 record must also pass an automated name check: a name that looks like a private person's ("JOHN A SMITH", "SMITH, JOHN") is dropped. The check is deliberately cautious, but it is automated — if a record about you as an individual got through, tell us and we will remove it (section 3).
We never read or store: the PPP demographic fields (race, ethnicity, gender, veteran status); phone, fax or cell numbers and e-mail addresses from the FMCSA, Form 5500 or NPI files; Form 5500 signer names; NPI license numbers. We do not collect Social Security numbers, dates of birth, credit or consumer-report data, and we do not compile profiles of private individuals.
Under the California Consumer Privacy Act (Cal. Civ. Code §1798.140(v)(2)) and similar state laws, information lawfully made available from government records is excluded from "personal information". The names we show come from such records (CourtListener republishes federal court records; GLEIF records describe legal entities, not people), so we do not consider ourselves a "data broker" under California, Vermont, Texas, Oregon or comparable laws.
Court and property records name people too — a tenant in an eviction, a consumer in a debt claim, a homeowner. We do not keep them: from these files we store only the businesses that are parties or owners. A case title shows the people in it as “an individual”, and property owned by people, family trusts or estates is left out. No person's street address is kept.
Federal court cases on a search by person (November 2026): when a search by person is open to you, we ask CourtListener for federal civil cases and bankruptcies in which a party has that name, in the federal courts of the state you chose. They are shown as a name match only — never criminal cases, and nothing filed more than ten years ago — and the answer is kept for one day so the same search is not sent again. The name you searched is sent to CourtListener for this (section 5).
Anyone — a company, its officer or agent, or a person named in a record — can ask us to review a record — including a court case or a property record shown on a company page. Email us (address at the bottom of this page) with the link to the company page and what you believe is wrong or should be removed. We reply within 30 days and tell you what we did.
We remove a record or a name where the law requires it, where the record is about a private individual rather than an organization (section 2), or where we show it wrongly. If the error is in the source itself — a state registry or a federal dataset — the lasting fix is a correction with that source, because our copy follows the source at its next refresh; we will tell you which source the record came from and where it can be corrected.
Home addresses of protected people: if you are a judge, prosecutor, law-enforcement officer or another person whose home address or phone number is protected by law (for example New Jersey's Daniel's Law or the federal Daniel Anderl Judicial Security and Privacy Act), email us the page link and the address or number to remove. We remove it within 72 hours and confirm by email. This matters most where a company's registered or principal address is a home.
If you create an account we store:
Search history (every visitor, signed in or not): the text of each company search you run on the site — a company name or an EIN — and the time (searches by person are not kept in your search history), together with only an anonymised network prefix of your address (for example 203.0.113.0/24 — never the full IP address). If you are signed in it is also linked to your account. It is used to spot abuse, and it is kept up to 90 days.
Search statistics: to improve search quality we keep a separate log with no link to you — no account, no IP address or network prefix, no browser details, no email. For each search it holds the kind of search (company name, EIN, business-name check or search by person), the search text in normalised form (lowercase, up to 100 characters), the number of results, which sources answered, the state detected, whether the visitor was signed in, whether the request looked automated, and the time. The text itself is not kept — only counted — when it is an EIN, when it looks like a person's name, or when it is junk or an attack string; for a business-name check or a search by person we keep only the state, the number of results and the outcome, never the name. It is deleted after 90 days.
Our web server keeps standard access logs (which include your full IP address) so we can investigate errors and abuse. They rotate automatically after a short time — typically days. Rate limiting keeps request counters by address for about a minute.
Company pages are counted anonymously (a page-view counter with no link to you) to show which companies are searched most. We use one third-party service on our pages: the Google tag (gtag.js), which runs Google Analytics and Google Ads measurement (section 6). Everything else — fonts and other scripts — comes from our own server.
When a section of a page is answered by a source we query live, the company name or number is sent from our servers to that source (for example a state registry, SEC EDGAR or CourtListener); the source does not learn who you are. For an open search by person, the searched name (and the state) is sent to CourtListener in the same way (section 2). Searches answered from our own copies of published files go nowhere else. An Employer Identification Number (EIN) search is looked up in the IRS list of tax-exempt organizations, the Florida corporate records and the Form 5500 filings we keep on our own server, and — sent from our servers — in the Texas Comptroller's franchise-tax file and SEC EDGAR full-text search. The IRS does not publish EINs for most private companies, so an EIN search only finds organizations whose public records include it.
Google Analytics and Google Ads tag. Our pages load Google's tag, which sets Google cookies and sends Google the pages you view, your IP address, browser and device details, how you arrived and, if you came from one of our ads, the ad click identifier. We use Google Analytics to understand how the site is used (visits, pages, traffic sources) and Google Ads to measure which ads lead to sign-ups, search-alert requests and purchases; Google may also use this data to show you our ads on other sites (remarketing). Google processes this data under its own privacy policy (policies.google.com/privacy).
What we keep out of it. The page address we give Google has its query string removed, so what you type — a company name, an EIN, a business name you check — is not part of it (we keep only advertising-campaign tags such as utm_source or gclid, and on the business-name check the two-letter state). The events we report carry only a label and an outcome — for example "sign-up", "EIN lookup: found" or "name check in TX: no match" — never the text you searched, your name, email or payment details.
Do Not Sell or Share. Letting Google use this data for advertising on other sites may count as "sharing" for cross-context behavioral advertising under California law, and as targeted advertising under other state laws. You can opt out in either of two ways, and we then do not load the Google tag at all — no Google cookies, nothing sent to Google: turn on Global Privacy Control (GPC) in your browser or extension, which we honor automatically as a valid opt-out; or use the button below (it applies to this browser). You can also use Google's ad settings (adssettings.google.com) or block third-party cookies.
Visitors in the EEA, the UK and Switzerland. We do not show a consent banner, so for visitors Google locates in these countries the tag runs in Google's "consent denied" mode: it sets no cookies, ad click identifiers are redacted and nothing is used for ad personalisation; Google receives only cookieless measurement pings.
Our own site sets no cookies. Your sign-in session is a pair of tokens kept in your browser's local storage for this site only; they are removed when you sign out. The access token lasts 15 minutes and is renewed automatically while you use the site; the refresh token lasts 30 days. If you turn off the Google tag with the button above, that choice is also kept in local storage.
Billing emails (transactional). If you buy a $2.99 report we email a receipt with a link to it (and, when the purchase opened your account, a link to choose a password). If you buy a paid plan we email you about it: a confirmation with the plan name, amount and renewal terms when you subscribe, a receipt for each automatic monthly renewal, a notice if a renewal payment fails, and a confirmation when you cancel renewal. Creem, which sells the plan to you (section 8), also emails its own receipts and payment notices to the address you give at checkout. These are part of providing the service you paid for (legal basis: performance of our contract with you), so they are sent whether or not you opted in to marketing and cannot be switched off while you have a paid plan.
Security emails (transactional). If you ask to reset your password we email a one-time link that expires after 30 minutes, and whenever your password is changed we email a notice so you can react if it wasn't you. These are sent to every account and include only the approximate network (not your full IP address) the request came from.
Marketing emails (consent only). We send product news and offers only if you opted in — the checkbox at signup is unchecked by default and is never assumed from accepting the Terms — or later switched it on in Account → Billing (legal basis: your consent). You can withdraw consent at any time: use the one-click unsubscribe link at the bottom of any marketing email, turn it off in Account → Billing, or email us. Withdrawing does not affect billing emails. We may also stop sending marketing email to an account on our own initiative.
Search alerts (no account needed). If a search finds nothing, you can leave your email address and ask to be told when it starts finding results. We store the address, the search text, the time and an anonymised network prefix (never the full IP address), re-run that search once a day, and send one email when it returns results. The address is then deleted from the request. If the search still finds nothing after 90 days, the whole request is deleted without any email. We use the address for nothing else — no marketing, no account — and nothing is sent when you submit the form (legal basis: your request). To cancel earlier, email us and we will delete it.
Watchlist alerts. Emails about changes to companies on your watchlist — a status change, a new case in the courts we cover, a new lien or tax warrant — are a separate opt-in, off by default, and can be switched on or off in Account → Billing.
All emails are delivered through Resend, which processes your address only to deliver them. Sign-in does not use email.
We do not sell personal data for money and do not share account information with the data sources above. Our service providers are: the hosting provider that runs our server; Google, which receives the technical data described in section 6 through its analytics and advertising tag (you can opt out there); Resend, which delivers our emails (billing emails, the one-time search alert if you asked for it, and marketing or watchlist emails only if you opted in); and Creem (creem.io), our online reseller and Merchant of Record for paid plans. When you subscribe, Creem receives your email address and the plan you chose, and collects your card or other payment details (and your billing country, for sales tax) directly on its own checkout page — we never see or store them. Creem processes that data as an independent controller under its own terms and privacy policy (creem.io/privacy) and keeps its own payment records, as tax law requires of a seller; requests about those records can be sent to Creem directly or to us, and we will pass them on. Payments made earlier through lava.top (operated by LAVALANE LTD, Cyprus), our previous payment agent, were processed by it in the same way. We keep a record of each payment (amount, date, plan, the provider's transaction id). Data is processed on that server; if you are in the EEA or UK, this means your data is transferred outside your country. We disclose information when the law requires it.
You can permanently delete your account at any time, without contacting us, under Account → Billing → Your data. To receive a copy of the data we hold about you, email us at the address below and we will send it within 30 days. Deleting removes your profile, plan, watchlist, saved searches and alerts, stops any renewing subscription so you are not charged again, detaches your search history from you and erases the network prefix stored with it, and masks your email in our internal audit log and payment records.
You can also ask us — by email — for access, correction, restriction or deletion, or object to processing, and we will answer within 30 days. You can opt out of the sharing described in section 6 with Global Privacy Control or the button there, and withdraw consent to marketing emails at any time (section 7). An authorized agent may make a request for you with your written permission. If you are in the EEA or UK you may complain to your local data-protection authority; residents of California and other U.S. states with privacy laws have the rights those laws give them, and we do not discriminate against anyone who uses them. Requests about a company record are handled as described in section 3.
We show source data as published and do not independently verify it. Registries can lag real-world changes or contain the filer's own errors. Each company page shows the date it was last checked against its source; stored profiles are re-checked after 7 days, sanctions and court data are cached up to 24 hours, and SAM.gov data up to 7 days. Some registries do not publish a live feed at all and are loaded as periodic snapshots — Florida issues a quarterly file, and Virginia's published extract dates from December 2024 and has not been updated by the state since; pages built from a snapshot say so and should be treated as historical rather than current. Records from the federal datasets (PPP loans, Form 5500, FMCSA, NPI) are loaded from periodic files, show the date of the file they come from, and are not business registrations: they do not say whether a company is still active unless the source itself does — the PPP data, for example, covers loans approved in 2020–21. If a source cannot be reached, the page says "temporarily unavailable" — it never turns a failed lookup into "not found" or "no match".
Matching by name. Several sources name a company but give no registration number — EPA facilities, recalls, CFPB complaints, Department of Labor records, and the SEC and FTC enforcement lists — so they are matched to a company page by its name (and, where the source has it, its state). A state registration is linked to an SEC filer only when exactly one filer has that exact name and the state of formation or the address matches. These are inferences from public records: each section says so, and a different company or person with the same name can occasionally be shown. These sources are refreshed weekly.
Court and property records name businesses, not registration numbers, so they are matched by the business name (without its legal form) within the state the company is tied to: Harris County, Texas and New York City for now. A different business with the same name can occasionally be shown; open the record and check the parties before relying on it.
Exclusion-list results (SAM.gov, HHS-OIG, OFAC people) are name matches: a person or business with the same name may be someone else. Confirm with the agency before relying on one, and never use one to decide on employment, housing, credit or insurance (see the Terms).
Sanctions results come from automated matching of the company name against the OFAC list. A match is a lead to check, and the absence of one is not a compliance clearance — confirm at ofac.treasury.gov before relying on it. "Possibly related companies" are an inference from shared registered agents, officers or addresses, not a confirmed ownership or affiliation.
Connections to usacip.com are encrypted (TLS, auto-renewing certificate); plain-HTTP requests are redirected. Passwords are hashed with Argon2id and never logged. Sign-in is rate-limited, and an account locks temporarily after repeated failed attempts. Access to account data is limited to an internal admin tool behind a separate secret, and every change made there is written to an audit log. The database is backed up daily. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
The service is for business use and is not directed to anyone under 18. We do not knowingly collect data from children.
If we change this policy we update the date above; for material changes we will also email users who opted in to emails and users with a paid plan.
For privacy questions, access, correction or deletion requests: abramov.avraam.y@gmail.com. You can also delete your account yourself, at any time, in Account → Billing → Your data.