Privacy Policy

GroundTruth is a citation verification service operated by Manoff Technologies, Inc. (“GroundTruth,” “we,” “us”). We help legal teams and researchers confirm that the claims in a brief, motion, or paper are actually supported by the sources they cite. This policy explains what information we collect when you use GroundTruth, how we use it, who else processes it on our behalf, and the choices you have.

We collect information you give us directly and a small amount of information that's collected automatically when you use the service.

Information you provide

• Account information. Your email address, name (if you provide one), and authentication metadata, handled by our authentication provider, Clerk. If you sign in with a social provider through Clerk (e.g. Google), we receive only the basic profile fields Clerk passes back to us — we do not connect directly to those providers.
• Content you upload. The documents you submit for verification (typically PDFs of briefs, motions, and papers), the plain text we extract from them, the citations we identify, and the source passages we fetch to verify those citations. Treat these as potentially sensitive — they may contain client-confidential or privileged material, which is why we limit access and enforce the retention windows described below.
• Billing information. Billing contact details and payment metadata, processed by Stripe. Card numbers and security codes are submitted directly to Stripe and are never stored on our servers.
• Communications. Anything you send us by email or through a support channel.
• Link requests. If you ask us on our homepage to email you a link to try GroundTruth on your computer, we use your email address to send that link and may follow up about your request. We keep the address with the homepage version you saw and the site that referred you. We don’t add it to a mailing list.

Information collected automatically

• Log and usage data. Request timestamps, IP address, user-agent string, the URL paths you hit, error traces, and the verification jobs we run on your behalf. We use this to operate, secure, and debug the service.
• Device data. Basic information your browser sends with every request — browser type and version, operating system, and approximate location inferred from IP address.
• Cookies. See the Cookies section below.

We do not currently use a general product-analytics or error-tracking subprocessor (such as PostHog, Sentry, or Google Analytics) inside the signed-in application. On our public marketing website (including this page) we do use a small number of third-party advertising and visitor-identification tools — currently Google Ads, the LinkedIn Insight Tag, and RB2B — described in the Cookies and Subprocessors sections below. Our host, Replit, also provides cookieless, aggregate page analytics for the marketing website (pages viewed, referring site, browser and device type, and country), and we record which version of our homepage you were shown, which sign-up or demo buttons you clicked, how far down the page you scrolled, the referring site or campaign, and whether you were on a phone or computer, so we can compare versions of the page. We keep that record in our own database without cookies or any identifier that persists between visits. We do not knowingly collect sensitive information beyond what may appear inside documents you choose to upload.

• To run the citation extraction and verification workflow you asked for.
• To show you your projects, reports, and history when you sign back in.
• To operate, secure, and debug the service (rate limiting, abuse prevention, error investigation).
• To send you transactional messages related to your account (e.g. sign-in flows, billing receipts).

Where the GDPR or similar laws apply, we process your information on the following bases: performance of our contract with you (to provide the service you signed up for), our legitimate interests in operating and securing the service, your consent where required, and compliance with legal obligations.

Citation extraction and verification are powered by AI models we run on Fireworks AI — the only AI provider that processes your documents. When you upload a document, we first use LlamaParse (by LlamaIndex) to convert your uploaded PDF or Word file into text, then send the relevant text (your brief and the cited source passages we fetch) to Fireworks AI to identify citations and check whether the cited material supports the claims in your filing.

How Fireworks AI handles this text. We use Fireworks AI with zero data retention enabled, so your data is not stored after the response is returned and is never used to train AI. We do not use the contents of your uploads to train any model. This covers the AI (LLM) step specifically: uploaded PDFs additionally pass through our document parser, LlamaParse, which we run with caching disabled so your document is not cached or retained.

To find and retrieve cited source passages, our verification pipeline reaches out to the open web. That includes the public legal database CourtListener, the search and lookup services listed under Subprocessors below (Exa and Legal Data Hunter), and arbitrary author URLs fetched on our behalf by Firecrawl (with ScrapingBee as a fallback). These source-finding and fetching services receive only search terms about the cited authority and public web addresses — not your brief text. Any public URL that appears in or is discovered for one of your citations — not just legal databases — may be fetched as part of verifying that citation.

• We do not train our own models on your documents. GroundTruth does not use the contents of your uploads to train any model we own.
• Fireworks AI (our AI provider). We run it with zero data retention: your data is not stored and is never used to train AI.
• We do not share the contents of your documents with anyone other than the subprocessors listed below, and only for the sole purpose of running the citation extraction and verification workflow you requested.

We do not sell the contents of your documents, and we never share document contents for advertising. We do use third-party advertising and visitor-identification tools (Google Ads, the LinkedIn Insight Tag, and RB2B) on our public marketing website; depending on where you live, use of those tools may be treated as “sharing” or “selling” of certain personal information (such as online identifiers) for cross-context behavioral advertising, which you can opt out of as described in “Your rights” below. Otherwise, we share information only in the following situations:

• With our subprocessors — the vendors listed in the Subprocessors section below, each used only to operate a specific part of the service.
• For legal reasons — in response to a valid subpoena, court order, or other lawful request, and where we believe disclosure is necessary to protect the rights, safety, or property of GroundTruth, our users, or the public.
• In a business transfer — if Manoff Technologies is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you and provide meaningful choices before your information becomes subject to a different privacy policy.
• With your direction or consent — for example, if you choose to share a report with a colleague.

We rely on a small number of vendors to operate GroundTruth. Each is bound by their own contractual and legal obligations to protect the data we share. The list below names every subprocessor that touches customer data, what data they receive, and what they do with it.

The signed-in application runs on strictly necessary cookies only. On our public marketing website (including this page), we also use a small number of advertising and marketing technologies — Google Ads, the LinkedIn Insight Tag, and RB2B — that may set cookies or use similar identifiers to measure campaigns, build remarketing audiences, and identify business visitors.

Your choices. How these advertising and marketing technologies behave depends on where you are, which we estimate from your device’s time zone:

• In the United States, they load when you visit. You can opt out at any time with the “Your privacy choices” link at the bottom of every page of our marketing website. If your browser sends a Global Privacy Control signal, we treat it as an opt-out and they don’t load.
• Everywhere else, they don’t load when you first arrive. We show a cookie consent banner, and none of Google Ads, the LinkedIn Insight Tag, or RB2B loads or sets any cookie until you click “Accept.” If you click “Reject,” they never load.

We remember your choice on this browser (in local storage) so you aren’t asked again on every page. You can change it at any time with “Your privacy choices” at the bottom of the page. Strictly necessary and functional cookies are not affected by this choice.

• Authentication cookies set by Clerk to keep you signed in across pages and to protect your session.
• Functional cookies and local storage used by the app to remember UI preferences (such as which panels you've collapsed in a report).
• Homepage version — we test different designs of our homepage. A random version identifier is kept in your browser’s local storage so you see the same version each time you return. It contains no personal information and is not shared with advertisers.
• Advertising and marketing technologies — Google Ads, the LinkedIn Insight Tag, and RB2B, used only on our public marketing website to measure ad campaigns, build remarketing audiences, and identify business visitors. These are not loaded inside the signed-in application.

Because the authentication and functional cookies are required to operate the service, blocking them in your browser may prevent you from signing in or using parts of GroundTruth. The advertising and marketing technologies are optional — you can turn them off at any time with “Your privacy choices,” your browser’s privacy controls (including Global Privacy Control), or ad-industry opt-out tools, all without affecting the app.

Uploaded documents and extracted text are deleted from our database within 30 days of project deletion.

Account data is retained while your account is active so you can access your projects and history. If you close your account, we purge your account data and any remaining project content within 30 days of closure, except where we are required to retain limited records to comply with legal obligations (for example, billing records).

Backups follow standard rolling cycles and any data already deleted from the live service is overwritten as those backups age out.

We protect your information with industry-standard safeguards: encrypted transport (TLS) for all traffic, encryption at rest for stored documents and database records, scoped access controls for production systems, and authentication handled by a specialized provider (Clerk). No system is perfectly secure, but we work to limit the data we collect and to fail closed when something goes wrong. That said, we make no firm guarantee that the Service is secure or that your information will remain private or confidential, and you use GroundTruth on that understanding.

Third-party processing. For AI processing we rely on Fireworks AI, which we run with zero data retention, so it does not store your data and never uses it to train AI. Because your content is handled by the third-party providers disclosed in the Subprocessors section, whose data-handling practices we do not control, you remain responsible for deciding what to upload. Consult your firm's information-security and ethics policies before uploading client-confidential, privileged, sealed, or otherwise regulated content.

Depending on where you live, you may have the right to access, export, correct, or delete the personal information we hold about you, and to object to or restrict certain processing. You can:

• Delete an individual project from inside the app at any time.
• Close your account, which triggers the purge described above.
• Email us at isaac@groundtruth.law to request access to, export of, or deletion of your data.

We will respond to verified requests within the timeframe required by applicable law.

If you are a resident of California, Colorado, Connecticut, Utah, Virginia, or another US state with a comprehensive privacy law, you may have additional rights:

• The right to know what categories of personal information we have collected about you, the sources, the business or commercial purpose, and the categories of third parties with whom we share it.
• The right to access a copy of the personal information we hold about you.
• The right to correct inaccurate personal information.
• The right to delete personal information we have collected from you, subject to certain legal exceptions.
• The right to opt out of sale or sharing for cross-context behavioral advertising. Because we use Google Ads, the LinkedIn Insight Tag, and RB2B on our public marketing website, some jurisdictions may treat this as a sale or sharing of personal information. You can opt out with the “Your privacy choices” link at the bottom of every page of our marketing website. We also treat a Global Privacy Control signal from your browser as a valid opt-out. You may also opt out using ad-industry opt-out tools, or by contacting us at the address below, and we will honor your request.
• The right to non-discrimination for exercising any of these rights.

The categories of personal information we collect are described in “What we collect” above. To exercise any of these rights, email isaac@groundtruth.law. You may use an authorized agent to submit a request on your behalf; we will ask the agent to provide proof of authorization and may ask you to verify your identity directly. If we deny your request, you have the right to appeal that decision — reply to our denial email and we will review.

Most web browsers and some mobile devices include a Do Not Track (“DNT”) feature or setting you can activate to signal that you do not want data about your online activities to be collected. No common standard for responding to DNT signals has been adopted, so we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard is adopted, we will update this policy to describe how we respond.

GroundTruth is built for legal professionals and researchers and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

GroundTruth is operated from the United States, and our subprocessors may process data in the United States and other countries. Where required, we rely on appropriate transfer mechanisms (such as the Standard Contractual Clauses) to protect personal information that moves across borders.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or in-product notice before the changes take effect.

Questions about this policy or about how we handle your information? Email isaac@groundtruth.law.