Privacy Policy
Privacy Policy updated on 7 September, 2026
Who we are
PatentAssist.ai is operated by Incubo Labs Private Limited, Lakhshmi Nagar, Delhi 110092, India. We are the data controller for the personal data described in this policy.
- General contact: [email protected]
- Privacy requests: [email protected]
For the invention content our customers upload — including personal data about their clients, inventors and applicants — we act as a processor on the customer’s behalf. Customers who need one can request our Data Processing Agreement, which covers that relationship and our sub-processors.
What we collect
Account data. Name, email address, profile image, phone number, company name and size, referral source, professional qualification, patent agent number, and your role on the platform.
Billing data. Business name and address, payment method details held by our payment provider, our customer identifier with that provider, and invoice history. We never see or store full card numbers.
Invention content and uploads. Invention disclosure answers, uploaded documents and drawings, generated claims, specifications and abstracts, copilot chat, and the intermediate payloads our AI pipeline produces. This content routinely includes personal data about inventors and applicants that you provide.
Support and feedback. Anything you write to us in a support request, plus product feedback and satisfaction scores.
Website usage. Pages viewed and actions taken on patentassist.ai, plus standard server and edge log data. Analytics are only collected if you accept analytics cookies.
Search site usage. On search.patentassist.ai we store a persistent user_token identifier in your browser, a salted hash of your IP address, the length of your query, and the filters you applied. The identifier and IP hash enforce the weekly free-search allowance, show an upgrade or purchase prompt after it is reached, and detect abuse. We store query length, not query text, in our own analytics. Query text is sent to the AI models that answer your search.
Contact and demo forms. Your name, email address and message.
Public patent data. We index published patent records from patent offices. These records contain the names — and sometimes addresses and email addresses — of inventors, applicants and patent agents, published by the offices themselves. We process this data on a legitimate-interest basis to make prior art searchable and attributable. If you appear in this data and want it corrected or removed, write to [email protected].
Why we use it, and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the drafting and search service | Account data, invention content and uploads | Contract (Art. 6(1)(b)) |
| Billing, invoicing and tax records | Billing data | Contract; legal obligation (Art. 6(1)(b), (c)) |
| Customer support | Account data, support messages, related invention content | Contract; legitimate interest |
| Security, abuse prevention, bot protection, and enforcing the weekly free-search allowance | IP address and salted IP hash, user_token, session data, and a keyed one-way identifier retained after deletion only when a free trial was used |
Legitimate interest (Art. 6(1)(f)) |
| Product analytics | Website and search usage | Consent (Art. 6(1)(a)) — analytics cookies only load if you accept them |
| Marketing emails to our users about the product | Name, email | Legitimate interest (Art. 6(1)(f)). Every marketing email carries a one-click unsubscribe, and we stop as soon as you use it |
| Making the public patent corpus searchable | Published patent-office records | Legitimate interest (Art. 6(1)(f)) |
| Improving our own models | Publicly published or granted patent documents only | Legitimate interest (Art. 6(1)(f)) |
We do not sell personal data, and we do not use your invention content for advertising or profiling.
AI processing
Drafting and search are powered by large language models. What you should know:
- Models run on Azure OpenAI deployments in EU regions (Sweden Central and Italy North) under Microsoft’s enterprise terms.
- Your content is not used to train any model — not ours, not the provider’s.
- AI output is a draft. A human — you — reviews and edits everything before it is filed. We do not make automated decisions that produce legal effects for you.
Recipients and sub-processors
We share personal data with the infrastructure and service providers we need to run the product — hosting, storage, AI models, payments, email, error monitoring and analytics. Each one is bound by a data processing agreement and may only act on our instructions.
The current list, with what each provider does and where it runs, is at /sub-processors. Customers with a signed DPA get 30 days’ notice before we add a new sub-processor.
We also disclose data where the law requires it, or to enforce our Terms of Service.
International transfers
We are based in India and our core application database and file storage are hosted there. Other processing happens in the EU, and a few providers are in the US:
| Where | What runs there |
|---|---|
| India (Azure Central India, AWS ap-south-1) | Application database, file storage, patent index |
| EU (Azure Sweden Central and Italy North, PostHog EU, Langfuse EU) | AI models, analytics, AI tracing |
| Global edge (Cloudflare) | Site delivery, bot protection, AI gateway |
| US (Sentry, Dodo Payments) | Error monitoring, payments |
Transfers out of the EEA rely on the European Commission’s Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the safeguards that apply to a specific transfer.
How long we keep it
| Data | Retention |
|---|---|
| Your account, local billing history, and invention content | As long as your account is open |
| Expired sessions and verification tokens | Deleted at expiry |
| AI job payloads and step logs | 30 days after the job completes, then the payload is erased and only metadata remains |
| In-app notifications | 90 days |
| Support requests and product feedback | 24 months |
| Unverified accounts | 30 days |
| Inactive accounts (no login) | 24 months, with a warning email at 23 months |
| Invoice and payment records held by Dodo Payments as merchant of record | As required by its applicable tax and financial laws |
| Free-trial abuse-prevention identifier | 3 years after account deletion, only if the free trial was used |
| Search event analytics | 180 days |
| Marketing send and bounce logs | 90 days |
| Error monitoring (Sentry) | 90 days |
| AI tracing (Langfuse) | 30 days |
| Product analytics (PostHog) | 12 months |
When you delete your account we delete your account data, local billing history, invention content and uploads, and remove you from our mailing lists. Dodo Payments, our merchant of record, may retain its own invoice and payment records where its legal or tax obligations require this. If you used a free trial, we also keep for three years a keyed, one-way identifier derived from your normalized email address solely to prevent repeated trial abuse. It cannot be used to recover your email address.
Your rights
If the GDPR applies to you, you have the right to:
- access the personal data we hold about you, and get a copy;
- rectify data that is wrong or incomplete;
- erase your data (“right to be forgotten”);
- restrict how we process it;
- portability — receive your data in a structured, machine-readable format;
- object to processing based on legitimate interest, including our marketing emails, at any time;
- not be subject to a decision based solely on automated processing that has legal effects (we do not make such decisions);
- withdraw consent at any time, without affecting processing done before you withdrew it. For analytics cookies, use the “Cookie settings” link in the footer;
- complain to a data protection supervisory authority in the EU or EEA country where you live, work, or where you think the problem happened.
How to exercise them. Delete or export your data yourself in the app under Settings → Security, or write to [email protected]. We reply within one month; if a request is complex we may extend that by two months and will tell you why within the first month. We may ask you to confirm your identity before acting.
If you are in India, the Digital Personal Data Protection Act, 2023 gives you comparable rights: access to a summary of your data and who we shared it with, correction and erasure, the ability to nominate someone to act for you if you die or become incapacitated, and a grievance route. Use the same address, [email protected], and you can escalate to the Data Protection Board of India if we do not resolve it.
Cookies
We use cookies that are strictly necessary to run the site, and analytics cookies only if you accept them. Every cookie and browser storage key we set — with its purpose and lifetime — is listed in our Cookie Policy. You can change your choice any time via Cookie settings in the footer.
Children
PatentAssist.ai is a professional tool for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.
Changes to this policy
When we change this policy we update the date at the top. If the change materially affects your rights, we will tell you by email or in the app before it takes effect. Questions about anything here: [email protected].