Privacy Policy

What we collect

• Searches. The names and ISBNs you type into the free check, and the ORCID iD, name or DOIs you enter in the free journal-article check, are sent to our server to run the search. For the article check our server asks Crossref, a public scholarly-metadata service, for the matching article list; Crossref receives the iD or name but nothing that identifies you. We log each check: the text you typed, the match setting, the time, the number of records found, the country your connection comes from (as reported by Cloudflare), and a visitor code. The visitor code is a one-way hash of your IP address, your browser and the date, made with a secret key, so it changes every day. PayAuthors’ application logs keep the code, not your IP address, and we do not use the code to work out an IP address or to link your checks from one day to the next. We use this log to count how many people use the free check and which searches find records. On the Find an attorney page we log, in the same way (time, country and the daily visitor code, no IP address), that the page was viewed and which of the advertiser's buttons or form you clicked, so we can tell an advertiser how many people saw and used their listing; we never see what you type into an advertiser's form. Free-check results are also cached for up to an hour by name so repeated checks are fast.
• Orders. When you buy a report we store an order record: the name searched, the match setting, the time, the Stripe session and payment identifiers, the amount, the e-mail address you give Stripe, and the frozen result set of the report. Stripe collects your card details and billing information under its own privacy policy; we never see the card number.
• Report access. We log when a report page or file is opened (report ID, time, file type) so that we can help if a link is lost and detect abuse.
• News e-mail updates. If you sign up for e-mail updates on the News page, we store your e-mail address, the frequency and filters you chose (which cases, search words, kind, company or site), whether you asked to be caught up on the earlier news and how far that has got, when you signed up, confirmed, changed or left, when we last e-mailed you, the country your connection comes from and the daily visitor code described above (used only to limit abuse of the sign-up form). If you sign up yourself, updates start at once and we send a welcome e-mail with links to change or stop them. If you enter someone else’s address to invite them, we send them one e-mail asking them to accept and nothing else unless they do; we do not tell them who invited them or keep a record of who did. Every update has a link to change your settings and a one-click unsubscribe. We do not track whether you open the e-mails or click their links.
• Requests. If you use the press or licensing request form, we store what you enter (name, e-mail address, organization, role, topic, deadline and message), the time, your country and the daily visitor code, and e-mail ourselves a copy so we can reply.
• Server logs. PayAuthors’ application logs do not retain your IP address. Our hosting and security provider, Cloudflare, processes ordinary request data (including your IP address, browser user agent, the time and the address requested) to deliver the site and protect it from abuse, and keeps it briefly under its own policies. Cloudflare Web Analytics, a page-view counter that uses no cookies and no fingerprinting, records which pages are viewed, the referring site, the browser type and the country.

What we do not collect

No advertising trackers, no analytics cookies and no accounts. The site sets no cookies of its own, except one that remembers the password on pages still in preview, for visitors who were given it. If you switch between light and dark mode, your browser remembers that choice on your device (local storage, key “pa-theme”); it is never sent to us. If you sign up for e-mail updates on the News page, your browser also remembers that you did (local storage, key “pa-news-sub”), so the page shows that you are signed up instead of the sign-up form; it holds no e-mail address or other information about you and is never sent to us. Both stay on your device until you clear this site’s data in your browser’s settings; clearing them changes only what the page shows, not your subscription. Fonts are served from our own site; no outside font or tracking service is loaded.

Why and on what basis

We process this data to run the search you asked for, to deliver and support the report you bought (performance of a contract), to keep records we are required to keep for tax and accounting (legal obligation), and to send the news e-mails you asked for and confirmed (consent, which you can withdraw at any time by unsubscribing), and to prevent fraud and abuse (legitimate interests).

How long

Order records, including the frozen report and the files of each issued version of it, are kept for seven years to meet accounting obligations and so that we can reissue a report you bought. Free-check search logs are kept for 7 days and then deleted; we keep only daily totals (how many searches and visitors), which contain nothing you typed. Report access logs and the Find an attorney view and click counts are kept for 30 days. Deletion is automatic: a scheduled job runs every day and removes each log entry once it passes its limit, and we are alerted if it fails. The daily summary of searches that we e-mail ourselves is deleted from our mailbox on the same 7-day schedule. Free-check caches expire within an hour. News e-mail sign-ups are kept while you are subscribed; an invitation that is never accepted is deleted after 90 days, and one you unsubscribe from is deleted 30 days after you leave. Our log of which update e-mails were sent is kept for 30 days. Requests are kept for 24 months unless they lead to an order or agreement.

Sharing

Stripe (payments), Cloudflare (hosting and storage), Proton (our mailbox) and Resend (which delivers the e-mails we send) process data on our behalf. We do not sell or share your data with anyone else.

How we protect your information

We collect little, and we protect what we keep:

• Payments. You pay on Stripe’s secure checkout page. Your card number goes only to Stripe; it never reaches our servers, and we never see or store it.
• Encrypted connections. The site works only over HTTPS (TLS 1.2 or later), and browsers are told never to connect to it without encryption.
• Encrypted storage. Order records, report files and e-mail sign-ups are stored with Cloudflare, which encrypts them at rest (AES-256).
• No accounts or passwords. There are no customer accounts, so there are no customer passwords to steal.
• Private report links. Each report link carries a long code signed with a secret key, so links cannot be guessed. Anyone who has your link can open your report, so share it only with people you choose.
• Limited access. Only PayAuthors has access to stored records, and that access requires private credentials. The providers listed under Sharing handle data only to provide their services to us.
• Less to protect. Our own logs do not keep your IP address, and we keep records only as long as described under How long.
• If something goes wrong. If a security breach affects your personal information, we will tell you as the law requires.

Legal requests

We disclose personal information in response to a subpoena, court order or other legal process only when the law requires it. Unless the law or a court order forbids it, we tell the affected customer first, so they can object. Reports a law firm orders under an engagement with us are handled under that engagement.

Research products are built from public records only. The reports, defendant lists and other research we sell are compiled from published library catalogs and U.S. Copyright Office records. They never include visitors’ searches, purchasers’ identities, report contents bought by others, inquiries or e-mail subscriptions; that data is used only to run the service as described here.

Your rights

You can ask what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it (we will keep what accounting law requires). Write to support@payauthors.com. If you are in the EU/UK you also have the right to complain to your data protection authority; if you are in California, Texas or another U.S. state with a privacy law, you have the rights that law gives you, and we will answer within the time it sets (45 days under most of these laws). If we turn down a request, you can appeal by replying with “Appeal” in the subject line; we will answer the appeal within 60 days, and if you disagree you can contact your state attorney general. We will not treat you differently for using these rights.

Global Privacy Control and “do not sell or share”

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and we do not knowingly collect data from children under 13. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of any sale or sharing, without asking you to do anything else. Our GPC support is also published at /.well-known/gpc.json.

Accessibility

We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA. The site uses a typeface designed for low-vision readers, works at 320 pixels wide and at 200% zoom, and is tested with automated accessibility checks. If anything is hard to use, or you need a report in another format, write to support@payauthors.com and we will help.

The data in the reports

The reports themselves consist of published bibliographic and public registration metadata about books: titles, author names as recorded by third parties, publishers, ISBNs, file names and U.S. Copyright Office registration data (which is a public record). If you are an author and believe a record about you is wrong, we can annotate it but cannot change the underlying public sources.

Changes to this policy

When we change this policy, we post the new version on this page with a new effective date, keep each earlier version at its own dated address, and add a short note below saying what changed. If a change is material (for example, collecting a new kind of personal information, using what we hold for a new purpose, sharing it with someone new or keeping it longer), we also put a notice at the top of this page and on the home page for at least 30 days, starting before the change takes effect, and the change applies only to information collected after it takes effect unless you agree otherwise.

• October 31, 2026. Added that the News page remembers in your browser that you signed up (key “pa-news-sub”), and how to clear it; explained that old logs are deleted automatically every day; shortened how long we keep free-check search logs (12 months to 7 days), report access logs, Find an attorney counts and the news e-mail send log (12 months to 30 days); added this section. No change to what we collect or how we use it. Earlier version (October 10, 2026).