1. Who we are
4CITE.ai is operated by 4 SHIELD LLC, a Wyoming Benefit LLC. "We," "us," and "our" mean 4 SHIELD LLC. "You" means the individual or organization using 4CITE.ai.
2. What we collect
Information you give us
- Account information. Your email address, used to sign you in and to deliver certificates and receipts.
- Documents you submit. The text you upload or paste for a Scan, Report, or Certify.
- Certifying attendant details. The name and email you enter at Certify (a title is optional). They are embedded in the certificate, and the certificate is emailed to that address when it is issued.
- Payment information. Collected directly by Stripe, Inc. We never see or store your full card number; we receive a customer ID, the card's brand and last four digits, and the transaction record needed for billing.
- Messages you send us. Contact-form submissions and email.
Information collected automatically
- Usage data. Which actions you run, when, and their unit cost, for billing, rate limiting, and capacity planning.
- Device and connection data. IP address, browser user-agent, and approximate region, for security, fraud prevention, and aggregate analytics.
- Certificate lookups. Every lookup of a certificate is logged with the time, the outcome, the IP address and user-agent of the request, and, where applicable, the account or share link used.
- API and MCP logs. For calls made with an API key or through the MCP server, we record the request path, response status, and unit cost. We do not log request bodies in plain form.
3. Where your information lives
We keep what you submit strictly separate from our public reference data. This separation is part of how the product works, not only a privacy choice.
- Private Vault. Your documents and certificates, encrypted in transit and at rest. Visible to you, and to authorized 4 SHIELD personnel only when acting on your behalf for support or security.
- Public Corpus. Documents we collect from public sources such as court records, SEC filings, and congressional and federal-register records. Nothing you submit is ever added to the Public Corpus.
- Certificate registry. Every issued certificate has a permanent record so a third party can confirm it is real. The registry never contains your document's text or the attendant's email. What a lookup shows depends on the certificate's privacy setting:
| Setting | Who can see the details | What they see |
|---|---|---|
| Confidential (default, including every walk-in cert) | You, and anyone you give a share link to | Everyone else sees only that the certificate ID exists and is confidential |
| Shared | Anyone with the certificate ID | The scores, tier, and structural readouts shown on the certificate; document type and domain; a fingerprint (hash) of the document; the issue date and any filing record; the certifying attendant's name; and the line identifying the instrument that issued it |
| Public | Anyone with the certificate ID | The same as Shared |
4. No training on your documents
We do not use your documents to train or fine-tune any model, and we have not authorized any provider in Section 6 to do so. If we ever offer a research contribution program, it will be opt-in, per document, and off by default.
5. How we use information
- To run the Scans, Reports, and certificates you request.
- To bill you and reconcile billing with our payment processor.
- To deliver certificates, receipts, sign-in links, and account notices.
- To prevent abuse, fraud, and unauthorized access.
- To improve the Service through aggregate, non-attributable usage analysis.
- To comply with the law, valid legal process, or to enforce our Terms of Service.
6. Service providers
We use the following providers to operate 4CITE.ai. Each receives only what it needs for the role listed.
| Provider | Role | What it handles |
|---|---|---|
| OpenRouter, Inc. | Routes scoring requests | The text you submit for a Scan, Report, or Certify, passed to the model host below. Every request is pinned to that host; OpenRouter is not permitted to send it anywhere else. |
| Novita AI | Runs the scoring model | The text you submit, processed to compute scores. The model is gemma-4-31b-it, which Google publishes as open weights; Google does not receive your text. |
| Anthropic, OpenAI, Google, and xAI | Audit review only | Only if a certificate is disputed, is subject to legal process, or is selected for a random integrity check of our own scoring: the text of that certificate's document, sent to each provider's API to cross-check the result. Never as part of issuing a certificate. |
| Stripe, Inc. | Payments | Card details, billing address, customer ID, subscription and invoice history. |
| Amazon Web Services | Application hosting and encrypted storage | The API, your encrypted documents (S3), and credentials. Region: us-east-2 (Ohio). |
| Supabase, Inc. | Application database | Account records, usage and access logs, certificate records. |
| Vercel, Inc. | Website hosting and analytics | Page delivery, the contact form, and aggregate page-view analytics. |
| Resend, Inc. | Your email address and the certificates, receipts, and sign-in links we send. | |
| WorkOS, Inc. | Sign-in for MCP connections | The identity and email of users who connect through the MCP server. |
During the beta, scoring runs on these providers' infrastructure rather than on servers we operate. We intend to move scoring into infrastructure we control, and this policy will change when it does. What the scoring providers say about your text, in their own terms: OpenRouter states that it "does not use your Inputs or Outputs for model training" (OpenRouter privacy policy). Novita AI states that it will not use your content to train its models, and that under its Zero Data Retention policy it does not log content for human review or retain it beyond the time it takes to generate and return the result (Novita AI terms). The audit providers process text under their commercial API terms. Public data sources used to build the Public Corpus are not service providers for your information: your documents are never sent to them.
7. Sharing and disclosure
We do not sell your personal information, and we do not share your documents with advertisers. We disclose information only:
- to the providers in Section 6, for the purposes listed;
- when a certificate's privacy setting makes its registry details visible (Section 3);
- to comply with the law, valid legal process, or a government request we reasonably believe is lawful;
- to enforce our Terms, or to protect the rights, property, or safety of 4 SHIELD LLC, our users, or the public, including to detect or prevent fraud, abuse, or security incidents; and
- in a merger, acquisition, financing, or sale of assets, in which case we will give notice and the acquirer will be bound by these commitments, or you will be able to delete your data first.
8. Retention and deletion
- Your documents stay in your Private Vault until you delete them. The Service never deletes them on its own. You can delete individual documents or certificates, or close your account, at any time.
- Certificate registry records are permanent, so a certificate stays verifiable. Deleting a certificate removes the document content; the registry record remains. That is its purpose.
- Closing your account deletes your Vault content within thirty (30) days. Billing records are kept as long as tax and financial record-keeping laws require (typically seven years). Registry records remain.
9. Security
Documents travel over TLS and are stored encrypted at rest in AWS under accounts owned by 4 SHIELD LLC. Production credentials are held in AWS Secrets Manager with restricted access. Database access is limited by row-level security tied to your account. No system is perfectly secure; if we learn of a security incident that materially affects your data, we will notify you and the authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your information, to object to or restrict certain processing, and to opt out of non-essential communications. To exercise any of these, email hello@4cite.ai from the address on your account, or include enough to let us verify your identity. We will respond within thirty (30) days.
11. Cookies, browser storage, and analytics
4CITE.ai uses a small number of strictly necessary cookies and browser-storage values: to keep you signed in, and, if you fill in the Certify form, to remember the attendant name and email you last entered on that device. Our website uses Vercel Web Analytics, which counts page views in aggregate. We use no advertising cookies and no behavioral-tracking pixels.
12. International users
4 SHIELD LLC is based in the United States. Your information is processed in the United States and wherever our providers operate. Where required, we rely on Standard Contractual Clauses or another lawful transfer mechanism.
13. Children
4CITE.ai is not intended for anyone under sixteen (16), and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this policy
We will announce material changes by email to account holders and post them here with a new date. Continuing to use 4CITE.ai after a material change means you accept the revised policy.
15. Contact
Privacy questions and requests to access, delete, or export your data: hello@4cite.ai.
4 SHIELD LLC · Wyoming Benefit LLC · Operator of 4CITE.ai