How we verify claims and handle data

Company records come from public, official endpoints published by the source itself — currently the Y Combinator public company API and, when you open one company, that company's own public YC page.

When you audit or research a website, LeadCite reads at most four public pages of that site, such as the homepage, pricing and customer pages. It identifies itself as LeadCiteBot, obeys robots.txt, never bypasses logins or bot protection, and caches results for six hours so no site is fetched repeatedly.

App Store details come from Apple's official lookup API. Google Play details are limited to the public listing's metadata.

The AI must copy the exact words behind every factual line, along with the page it took them from. LeadCite then looks for those words on that page.

Any number in a claim must appear on one of the pages read. Numbers are the most common thing language models invent, so this check runs on every line, including summaries.

Anything that fails is removed from the draft and listed under “Verify before sending”, with the reason.

Funding, founders, bios, contact links, team sizes and growth triggers are shown only when a source returned them. Missing fields are labelled “Not available”.

Scores use returned fields only. A field the source omitted is excluded from the total, so no company is flattered by data that doesn't exist.

Audit absences are phrased as “couldn't find”, never “you don't have”, because a crawler can miss what a person would see.

Without an account, your pipeline, saved searches and research history stay in your browser's local storage.

With an account, they are stored in your workspace and protected by row-level security: only you can read or change them.

Usage is metered to keep the service fair. Anonymous usage is keyed to a one-way hash of your IP address; raw IP addresses are not stored.

Pages you ask LeadCite to read, and text you paste, are sent to the language model for that single request only.

LeadCite drafts messages; it does not send them or keep contact lists on your behalf. You are the sender.

Identify yourself honestly, give a real reason for contact, honour opt-outs promptly, include a postal address where CAN-SPAM requires one, and have a lawful basis for anyone covered by GDPR, NDPR or similar laws.

Never send a claim you couldn't defend to the person reading it.