Privacy Policy

Bread & Law LLC (“Bread & Law,” “we,” “us,” or “our”) operates the website www.breadandlaw.com and a set of products offered under the “Tools for Communicators” umbrella — currently Cited (breadandlaw.com/cited), The Loop (a desktop app, with its pixel-track service at t.breadandlaw.com), and Is It News? (together, the “Services”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. By using the Services you agree to this Privacy Policy.

1. Who we are (data controller)

For information about your use of the Services, Bread & Law LLC is the data controller. Contact us at info@breadandlaw.com or by mail at Bread & Law LLC, c/o Registered Agents Inc., 90 State Street, Suite 700, Office 40, Albany, NY 12207.

One exception — The Loop’s open tracking. When you use The Loop to track your own outreach, the information collected about the recipients of your emails is processed on your behalf and under your instructions. For that data, you are the controller and Bread & Law acts as your processor/service provider. You are responsible for having a lawful basis to send tracked emails and to process your recipients’ information (see Section 6 and our Terms of Service).

2. Information we collect

2.1 Website visits

When you visit breadandlaw.com, our host (Vercel) generates standard technical logs (such as IP address, request time, and browser type) for security and diagnostics, and we use privacy-friendly, aggregate analytics to understand traffic. We do not use advertising cookies or cross-site trackers.

2.2 If you buy a paid product

If you purchase or subscribe to a paid product, we and our payment processor Stripe collect your name, email address, and payment details. We do not store your full card number — card payments are handled directly by Stripe. We retain your email, purchase/subscription status, and any license information to provide and support the Services. (As of the effective date, paid checkout is not yet live; this section governs it once it is.)

2.3 Cited — IP address as a salted hash (abuse prevention)

When you run an assessment on the Cited demo, we need to prevent abuse of the free tool (a cap on assessments per hour and an overall daily limit). To do this we process your IP address in a deliberately privacy-protective way:

• The instant your request arrives, we compute a one-way, salted cryptographic hash (HMAC-SHA256) of your IP address and store only that hash.
• Your raw IP address is never written to disk or database — it exists only momentarily in memory to compute the hash.
• The secret salt makes the hash non-reversible — it cannot be turned back into your IP address, even by us with full access to the database.
• The hash is used solely to count requests from the same source for rate-limiting. It is never used to identify you, profile you, or track you across sites.
• These hashes are automatically deleted within 24 hours.

Cited also stores the URLs you submit for assessment and technical evidence about the websites being assessed (robots rules, response headers, and similar) — information about publishers and web infrastructure, not about you. As proof for an assessment, Cited may record the egress IP address of an AI company’s automated crawler (e.g. an AI platform’s server fetching a page). Those are the IP addresses of third-party automated systems, captured as verifiable evidence — not the IP addresses of Cited’s users.

2.4 The Loop — local-first app + email-open tracking

Your media contacts, their email addresses, your outreach (“pushes”), notes, and response records are stored locally in The Loop on your device. Bread & Law does not receive or store this information.

The Loop lets you place a tracking pixel in emails you send. When a recipient’s email client loads that pixel, our pixel-track service logs, for each open event: a tracking identifier you generated, a timestamp, the IP address of the device that loaded the pixel, and its user-agent string. This data is about the recipients of your emails, and IP addresses can constitute personal data under laws such as the EU/UK GDPR. When you run Sync Opens, opener IP addresses are sent to a geolocation provider (ip-api.com) to derive an approximate city/region (never precise GPS location).

2.5 Is It News?

Is It News? is an open-source news-classification protocol. It does not collect, use, or store IP addresses or other personal data.

3. How we use information

• Provide, operate, and maintain the Services;
• Prevent abuse and enforce rate limits (Cited);
• Process payments and manage any purchases/subscriptions;
• For The Loop, report to you whether and when your tracked emails were opened, and filter automated proxy/prefetch noise;
• Communicate with you about support requests and service changes;
• Secure the Services and comply with legal obligations.

4. Legal bases (EEA/UK users)

Where the GDPR applies, we rely on: legitimate interests (to secure the Services and prevent abuse — including Cited’s salted-hash rate-limiting — and, on your instructions, to provide open-tracking to you as our customer); performance of a contract (to provide any paid product you buy); consent where required; and legal obligations. For The Loop’s tracking of your recipients, the lawful basis is your responsibility as controller.

5. How we share information (sub-processors)

We do not sell your personal information. We share it only with service providers who help us run the Services, under appropriate protections:

To perform an assessment, Cited also sends the URL being assessed (not your personal data) to AI platforms’ fetch APIs. We may disclose information if required by law, to protect our rights or safety, or in connection with a business transfer.

6. Your responsibilities as a user of The Loop’s tracking

You are responsible for using The Loop’s tracking features lawfully, including compliance with email, privacy, and electronic-communications laws in your and your recipients’ jurisdictions (for example, CAN-SPAM, GDPR, and ePrivacy rules). You represent that you have any rights, notices, or consents necessary to send tracked emails and to have their opens logged and processed. If a recipient exercises privacy rights regarding data collected through your tracking, we may direct that request to you as the controller.

7. Data retention

• Cited — IP-rate-limit hashes: automatically deleted within 24 hours.
• Cited — assessment evidence and records: up to 90 days (we keep the most recent record per outlet so shared result links keep resolving); raw layer-4 probe logs 30 days.
• The Loop — email-open logs (recipient IPs): retained for 90 days, then deleted. (The Loop’s public tracker demo rows are deleted after 7 days.)
• Account and billing data: kept while active and as required for legal, tax, and accounting purposes.
• Website/technical logs and analytics: kept for a limited period / in aggregate.

8. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing. California residents have rights under the CCPA/CPRA, including the right to know and to delete, and the right not to be discriminated against for exercising them; we do not sell or “share” personal information as those terms are defined under California law.

To exercise any right, email info@breadandlaw.com. We will verify your request as required by law. Note that Cited’s IP hashes are non-reversible and short-lived, so we generally cannot link them back to an individual to action a request. For data collected through a customer’s use of The Loop, we may need to route your request to that customer (the controller).

9. International transfers

We are based in the United States, and information we process is handled in the U.S. If you access the Services from outside the U.S., you understand your information may be transferred to and processed in the U.S. Where required, we use appropriate safeguards for such transfers.

10. Children

The Services are intended for business use by adults and are not directed to individuals under 18. We do not knowingly collect personal information from children.

11. Security

We use reasonable technical and organizational measures to protect information. By design, The Loop keeps your contact data on your own device, and Cited never stores raw IP addresses — only non-reversible, short-lived salted hashes. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Effective date.” Material changes will be communicated as required by law.

13. Contact us

Bread & Law LLC
Email: info@breadandlaw.com
Mailing address: c/o Registered Agents Inc., 90 State Street, Suite 700, Office 40, Albany, NY 12207