Privacy Notice

Last updated: August 7, 2026

This Privacy Notice explains how PatentPlusAI Inc. ("PatentPlusAI," "we," "us," or "our") processes personal information when you visit https://patentplus.ai, use the PatentPlus.AI platform, communicate with us, or otherwise interact with our services (collectively, the "Services").

If you have questions or wish to exercise a privacy right, contact us at support@patentplus.ai.

1. Our roles

PatentPlusAI acts in different legal roles depending on the context:

For personal information in customer-provided invention materials, project files, search inputs, and related content, the customer generally determines why the information is processed. The customer acts as controller or business, and PatentPlusAI acts as its processor or service provider.
For account administration, security, billing and commercial records, support communications, and operation of our public website, PatentPlusAI may act as controller or business.

If you use the Services through an employer or other organization, that organization may be primarily responsible for responding to requests concerning information it submitted. We will assist it as required by applicable law and contract.

2. Information we process

The information we process depends on how you interact with the Services.

Account and business information

We may process:

name, business email address, organization, role, and account status;
authentication and account-security information;
business contact, subscription, credit-consumption, billing, and transaction records; and
communications with us, including support requests and onboarding information.

Passwords are handled by Google Firebase Authentication. PatentPlusAI does not store passwords in recoverable form.

Customer-provided content

Customers and their users may submit:

invention descriptions and search criteria;
supporting documents and project files;
patent identifiers and search terms;
project names, reports, comments, and generated outputs; and
other technical or business information submitted for patent research and analysis.

Patent and invention materials commonly contain names of inventors, applicants, attorneys, or other individuals. We process those names as part of the technical material, not to evaluate or profile the individuals.

Usage, device, and security information

We may automatically receive:

Internet Protocol address, browser type, operating system, device and language information;
authentication events and approximate location inferred from network information;
pages, features, searches, and actions used within the Services;
timestamps, request and correlation identifiers, error records, and diagnostic information; and
administrative, access-control, support-access, and security audit events.

We use this information to operate, secure, troubleshoot, measure, and improve the Services.

Sensitive information

The Services are not designed to collect, and we do not request, special categories of personal information such as health or biometric data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, or information concerning a person's sex life or sexual orientation. Users should not submit such information.

Under some United States privacy laws, account-login credentials are classified as sensitive personal information. Our authentication provider processes that information solely to authenticate users, protect accounts, and provide account-management functions. We do not use sensitive personal information to infer characteristics about individuals.

3. How and why we use information

We process personal information as necessary to:

create, authenticate, administer, secure, and deactivate accounts;
provide patent search, prior-art analysis, invention review, freedom-to-operate analysis, reporting, and related Services requested by the customer;
process uploads, generate outputs, and provide exports;
communicate service, account, security, support, and administrative information;
provide customer support and investigate reported problems;
allocate and report subscription-credit usage;
detect, prevent, investigate, and remediate fraud, abuse, security threats, and unauthorized access;
monitor service reliability, troubleshoot errors, and maintain audit records;
comply with law, enforce agreements, establish or defend legal claims, and respond to lawful requests;
manage our business and customer relationships; and
improve service reliability, usability, retrieval quality, and analysis quality using operational telemetry, customer feedback, and internal or appropriately licensed test material.

PatentPlusAI personnel must not use customer content for model training, unrelated product development, marketing, or demonstration. We do not use customer inputs or outputs to train PatentPlusAI models.

Where required, our legal bases include performance of a contract, steps requested before entering a contract, legitimate interests in operating and securing the Services, compliance with legal obligations, and consent for a specific purpose.

4. Artificial intelligence

The Services use artificial intelligence to assist with patent search, document analysis, invention review, and report drafting. Relevant customer inputs may be transmitted to approved model providers only as needed to perform the requested function.

AI processing may be provided through:

Microsoft Azure OpenAI;
Amazon Web Services Bedrock; and
Google Cloud Vertex AI.

Requests are routed through a PatentPlusAI-operated routing service. Our routing service is configured not to retain prompt and response content in message logs.

Our agreements and applicable service terms with the model providers prohibit them from using submitted customer data to train their foundation models. We do not use customer inputs or outputs to train our own models.

AI-assisted outputs are decision support for professional review. The Services do not make decisions about employment, credit, housing, insurance, education, benefits, eligibility, or other legal or similarly significant matters concerning individuals.

5. When we disclose information

We do not sell personal information. We do not disclose personal information for cross-context behavioral advertising, and we do not permit service providers to use customer information for their own independent purposes.

We disclose information only as needed for the purposes described in this Notice, including to:

Hosting, identity, and infrastructure providers

Google Cloud Platform and Firebase provide application hosting, databases, file storage, logging, and identity services.

AI model providers

Microsoft Azure OpenAI, Amazon Web Services Bedrock, and Google Cloud Vertex AI process relevant request content for AI-assisted analysis and drafting.

Patent and literature data providers

IFI Claims and SerpApi receive minimized, customer-derived search terms and published patent identifiers needed to retrieve patent and literature results. They are not sent user-account records, complete invention disclosures, uploaded documents, or generated reports for this purpose.

Transactional email provider

Postmark processes recipient and sender addresses, message subjects, and message bodies necessary to deliver account, support, security, onboarding, and service notifications.

Professional advisers and legal recipients

We may disclose information to legal, accounting, insurance, security, and other professional advisers under confidentiality obligations, and to governmental or legal authorities where required by law or necessary to protect rights, safety, and security.

Business transactions

Information may be disclosed under appropriate confidentiality safeguards in connection with a financing, merger, acquisition, reorganization, sale of assets, or similar business transaction. We will provide notice where required by law or contract.

We require service providers to process information under written terms appropriate to their role, including confidentiality, security, and data-protection obligations.

6. International processing and data location

Data location depends on the customer deployment and the service provider involved.

For customers hosted in our European deployment:

primary application services, Firestore records, uploaded files, and generated outputs are hosted in Google Cloud's European regions;
Firebase Realtime Database is hosted in Belgium;
AI inference is configured to use European locations offered by Microsoft Azure, Amazon Web Services, and Google Cloud;
Firebase Authentication processes authentication information in the United States;
Postmark processes transactional email information in the United States;
authorized PatentPlusAI support and engineering personnel located in the United States may remotely access customer information when necessary to operate or support the Services; and
minimized search terms and patent identifiers may be processed by patent and literature data providers in their applicable service locations.

Accordingly, European hosting does not mean that every item of personal information is processed exclusively in the European Union. Where applicable law requires safeguards for an international transfer, we use contractual and organizational measures appropriate to the transfer, which may include data-processing terms, the European Commission's Standard Contractual Clauses, the United Kingdom addendum, transfer assessments, access controls, data minimization, encryption, and audit logging.

Customers may contact us for current information about providers, locations, and transfer safeguards.

7. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Notice, the applicable customer agreement, security and audit requirements, and legal obligations.

Our principal retention practices are:

customer project data, uploads, and generated outputs are retained during the customer relationship and any agreed export or wind-down period;
operational application and platform logs are generally retained for 30 days;
administrative and data-access audit records may be retained for up to 400 days in a retention-locked store;
scheduled Firestore backups are retained for 30 days, and Firestore point-in-time recovery provides a rolling seven-day recovery window;
deleted objects in active Cloud Storage buckets may remain recoverable through provider soft-deletion for seven days;
authentication information is retained by Firebase Authentication until the associated user is deleted; Google states that removal from its live and backup systems may take up to 180 days after deletion is initiated; and
legal, financial, contract, fraud-prevention, and dispute records may be retained longer where required or permitted by law.

When a customer agreement ends, customer data is deleted from active production systems on request or after the agreed export and wind-down period. Information in backups, soft-deletion systems, and retention-locked audit logs cannot always be selectively removed and remains protected until the applicable retention period expires. It is not used for unrelated purposes during that period.

Service-provider deletion occurs under the provider's applicable retention and deletion terms. Customers may request written confirmation of completion where provided by the applicable agreement.

8. Security

We use technical and organizational measures designed to protect personal information, including:

encryption in transit and at rest;
individual accounts, role-based authorization, and multi-factor authentication for privileged access;
server-side tenant and project authorization;
managed secret storage and scoped service identities;
audit logging and retention controls;
vulnerability scanning, static analysis, dependency monitoring, and security-focused testing;
confidentiality and access-management requirements for personnel.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we investigate and respond to suspected security incidents and notify affected parties as required by law and applicable agreement.

9. Cookies and similar technologies

The authenticated PatentPlusAI application uses technologies necessary for authentication, security, session management, and operation of the Services. We do not use the authenticated application for third-party behavioral advertising.

Our public website may use:

essential technologies required for security and basic operation;
functionality technologies that remember user choices; and
limited analytics technologies, where enabled and permitted, to understand website use and performance.

Where required, non-essential technologies are controlled through the website's consent settings. We do not sell personal information or use website personal information for cross-context behavioral advertising. If the website's cookie configuration changes materially, we will update this Notice and the consent interface.

Browser "Do Not Track" signals do not have a uniform legal or technical standard. Where applicable law requires recognition of a legally valid opt-out preference signal, we will process it as required.

10. Privacy rights

Depending on your location and subject to applicable exceptions, you may have rights to:

know whether we process your personal information;
request access to and a copy of personal information;
correct inaccurate personal information;
request deletion;
request restriction of or object to processing;
receive certain information in a portable format;
withdraw consent where processing relies on consent;
opt out of sale, targeted advertising, or certain profiling where applicable; and
appeal a decision concerning a privacy request where applicable law provides that right.

The Services do not make solely automated decisions that produce legal or similarly significant effects concerning individuals.

To exercise a right, email support@patentplus.ai. We may need to verify your identity and authority. If your organization controls the relevant information, we may coordinate the request with that organization. We will respond within the period required by applicable law.

You may also have the right to complain to your local data-protection authority, state attorney general, or other privacy regulator.

11. Children

The Services are intended for business and professional users and are not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided information to us, contact support@patentplus.ai.

12. Changes to this Notice

We may update this Notice to reflect changes to the Services, providers, law, or our practices. The "Last updated" date identifies the current version. Where required, we will provide additional notice of a material change.

13. Contact us

For questions, privacy requests, or concerns:

PatentPlusAI Inc.
43c Bridge Street
Kent, Connecticut 06757
United States
support@patentplus.ai

PatentPlusAI's privacy contact is Jake Winter, Chief Technology Officer. Massyl Mallem, Chief Executive Officer, is the alternate contact for privacy and data-protection matters.