Privacy policy

What we collect

• Account: your email address, and the date you joined.
• How you use it: your watchlist, notification preferences and timezone, and a record of the alerts we sent you.
• Mobile number, only if you turn on text alerts — with a record of the exact consent wording, the time and your IP address, which carrier rules require, and of any STOP or HELP replies.
• Billing, once billing is enabled for your account: subscription status, quantity and our payment processor's customer and subscription ids. We never see or store your card number; Stripe handles it.
• Chat: if you use the chat assistant, the text of your conversation and the assistant's answers, linked to your account if you are signed in or to a random browser key if you are not.
• Feedback and support: what you send through the feedback form (message, rating, the page you came from, your browser type, and your email if you give it) and any email you send us.
• Security and technical data: sign-ins, role and billing changes, exports and deletion requests with an IP address; and server logs, which are structured, redact credentials, and are rotated. Our rate limits look at your IP address in memory and do not store it.

How we use it

To run the service (sign you in, watch records, send the alerts you chose), to bill you, to answer you, to keep the service secure and prevent abuse (including the uses prohibited by our terms), to fix and improve it — we read chat conversations and feedback for that — and to meet legal obligations. We do not use your data to train AI models, and our providers are contractually barred from doing so.

Who we share it with

Only service providers that process data on our behalf, under contract, for the purposes above:

• Hetzner — hosting of the app and database (servers in Germany).
• Cloudflare — network delivery and security; all traffic to the site passes through it.
• Backblaze B2 — daily database backups, in a private bucket.
• Resend — email delivery (sign-in links, alerts, billing and service notices).
• Stripe — payments, once billing is enabled.
• Microsoft (Azure OpenAI) — generates chat answers; receives the text of your chat conversation only.
• Apple iMessage and mobile carriers — deliver text alerts; receive your number and the alert text only.
• New Relic — server health monitoring; it does not receive your account data.

We also disclose information when the law requires it (for example a valid subpoena), to protect the rights, safety or property of anyone, or to a successor if the business is sold or merged, who must honour this policy.

Mobile numbers: we do not share or sell mobile numbers or text-message opt-in data with any third party or affiliate for marketing or promotional purposes. The providers above receive a number only to deliver a message you asked for.

Retention

• Account data, watchlist, preferences and chat conversations: while your account exists. When you ask us to delete your account we delete your personal data within 30 days.
• SMS consent and opt-out records: kept for at least four years after you stop texts, because they are our proof of consent under telemarketing laws.
• Billing and tax records: as long as tax and accounting law requires (generally seven years), dissociated from your identity where possible.
• Feedback: until it has been dealt with, and at most two years.
• Backups roll over and expire on a fixed schedule.

Your rights

You can ask us to tell you what we hold about you, give you a copy in a machine-readable form, correct it, or delete it. Email [email protected] from your account email (or use the links on your account page). We answer within 30 days, and may need to confirm it is you. We will not treat you differently for exercising a right. Some US states give residents additional rights over personal information, including a right to appeal a refusal — we honour those where they apply; to appeal, reply to our answer with “Appeal” in the subject. An authorised agent may make a request for you with your written permission.

Cookies and tracking

We set strictly necessary cookies only: your sign-in session and the security tokens that protect it. There is no advertising, no analytics cookie, no cross-site tracking, and therefore no cookie banner. We honour Global Privacy Control signals, though since we neither sell nor share data for advertising there is nothing for them to switch off.

Security

Data is encrypted in transit, backups are kept in a private, access-controlled bucket, access is limited to the people who run the service, and secrets are kept outside the code. No system is perfectly secure; if a breach affects your personal information we will notify you as the law requires.

Children

The service is for adults and is not directed to children. We do not knowingly collect information from anyone under 18; if you believe a child has given us information, email us and we will delete it.

Where data is processed

We are based in the United States. Our servers are in Germany, and some providers process data in the United States and elsewhere. By using the service you understand your information will be transferred to and processed in those countries.

Florida Bar membership information is public record, and the Bar publishes these profiles itself. We republish a subset of it and add a dated history of changes. We collected it from The Florida Bar's public member directory; we did not get it from you.

What we publish

Name, bar number, membership status and eligibility, admission date, county and judicial circuit, city, firm name and position, board certifications, practice areas, Bar sections, languages, law school, federal court admissions, and discipline history as published by the Bar. Business phone is shown on the page but excluded from our sitemaps and rate-limited.

Photos

Where the Bar's own public profile shows a headshot, we mirror it: our server fetches the exact image the Bar's page points to and caches a copy, rather than linking your browser directly to the Bar's image server. We do not scrape, source, or accept photos from anywhere else — not social media, not a firm website, not a submission form. If a later check finds the Bar no longer shows a photo for you, our cached copy stops being served the next time anyone requests your page; we do not keep publishing a photo the Bar has taken down. The large majority of profiles have no photo at all and show initials instead.

“Around the web”

When someone views a profile, we may ask an AI search provider (Perplexity) to find public web pages about that attorney's professional practice — using only the name, bar number, firm, city and similar public-record details — and show a short summary with links to the sources it cites. Results are cached for up to 90 days. If a result is about someone else or is wrong, use corrections and we will remove it and stop looking you up.

What we never publish, deliberately

• Email addresses — never, in any form. The Bar actively obfuscates member email on its own pages; reproducing it would defeat a protective control.
• Cell phone numbers — never. Bar profiles carry a “no text messages” flag on these; they are personal numbers.
• Full street addresses are not public here. They are visible only to signed-in users, because many Florida solo practitioners use a home address as their Bar address, and publishing tens of thousands of home addresses in a searchable, AI-crawlable corpus is a real safety problem.

Some of these fields are stored so we can detect that they changed and privately tell a subscriber who watches you. Detecting a change and publishing a value are different acts, and we only do the first. We never use the information to contact you for marketing.

Corrections and suppression

Use corrections and removals. We correct errors quickly, will suppress optional contact fields, a mirrored photo or “Around the web” results on request, and will honour a noindex request where there is a documented safety concern — for example a judge, a domestic-violence survivor, or a participant in an address confidentiality programme. We will not delist a public licensure status. The rights in section A (access, correction, deletion where the law provides it) also apply to you.

AI search engines

We allow AI answer engines and search engines to read our public pages so people can find accurate, sourced records. We do not train or fine-tune any AI model on Bar content ourselves; our chat assistant reads our own database at the moment you ask. Our terms prohibit anyone from harvesting the service to train a model.

We do not sell or share personal information as the California Consumer Privacy Act defines those terms, and we do not disclose personal information to third parties for their own direct-marketing purposes. California residents may use the rights in section A; email [email protected].

We will post any change here and update the date above. If a change materially affects how we use information we already hold, we will email account holders before it takes effect.

Felican.AI Inc.
500 S Australian Ave, West Palm Beach, FL 33401
[email protected]