Privacy Notice
Last updated: [date of publication]
Who we are
IP Folks runs this prior-art search and patentability service. We decide how your personal data is used, which makes us the “controller” under the EU and UK GDPR and the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023.
IP Folks, [registered address]. Email: Info@ipfolks.com. Privacy questions, requests and complaints: privacy@ipfolks.com.
What we collect and why
We collect only what we need to run your account, produce your reports, take payment and keep the service secure. We do not sell personal data or use it for advertising.
| What | Examples | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Account details | Username, email address, password (stored only as a secure hash), time zone, the name you want printed on reports, email preferences | To create and run your account and send the emails you have chosen | Performing our contract with you |
| Your invention material | Files you upload, text you paste or type, figures, the features extracted from them, your reports | To produce the search and report you asked for | Performing our contract with you |
| Billing and payment details | Name, company, address, country, tax number; amount, date and the payment provider’s reference. We never receive or store your card or bank details | To take payment and issue invoices, and to keep the records tax law requires | Contract; legal obligation |
| Security and activity records | IP address, sign-in times, which reports were opened, downloaded or deleted and by whom | To protect accounts, investigate misuse, and show who accessed a disclosure | Legitimate interest in keeping the service and your material secure |
| Usage records | Which steps of the service you reached and when | To find where the service is confusing or slow | Legitimate interest in improving the service |
| Messages to us | What you write when you contact us | To answer you | Legitimate interest; contract |
Under India’s DPDP Act we rely on your consent, given when you create an account, and on the uses the Act allows without consent (such as meeting legal obligations). You can withdraw consent at any time; we would then close your account, because the service cannot run without this data.
Your invention
We treat your invention as confidential. It is used only to produce your report, and never to train AI models, for marketing, or for anything else.
To produce a report, the text and figures of your disclosure are sent to AI providers that analyse it, search for prior art and draft the report. We use only their paid business services, under terms that forbid them to use your material to improve or train their models. When the AI searches the web, the search queries it writes (based on your invention’s features) go to Google Search. Patent registers are contacted with patent numbers only, never with your invention.
Within IP Folks, access to your invention is limited to the staff who run and support the service and, if you request a human review, the reviewer assigned to your report. Reviewers are bound by confidentiality [true only once every reviewer who is not an employee has signed a confidentiality agreement]. Opening or downloading a report is recorded in a tamper-evident log.
You control how long your material stays with us: you can delete any invention, or all of them, from the “My data” page at any time, and you can set it to be deleted automatically after 24 hours, 7 days, 30 days or 90 days.
Invention disclosures often name inventors and other people. By submitting one, you confirm you are entitled to share their details with us for this purpose.
Companies that process data for us
These companies handle data on our behalf, under contracts that limit them to providing their service to us. The payment companies are the exception: they act under their own privacy policies.
| Company | What they receive | Purpose |
|---|---|---|
| Amazon Web Services | All data we hold, as our host | Hosting and backups |
| Google (Gemini API, paid) | Your invention material; search queries based on it | AI analysis, search and report drafting |
| OpenAI (API, paid) | Your invention material, if its models are used for your report | AI analysis and report drafting |
| Cloudflare | Your IP address and browser signals, on the sign-up, sign-in and password-reset pages | Telling people from automated bots |
| Amazon Web Services (Amazon SES) and Google (Google Workspace) | Your email address and the emails we send you | Delivering account and service emails |
| Razorpay | What you enter to pay, and the payment | Taking payment (own privacy policy) |
| PayPal | What you enter to pay, and the payment | Taking payment (own privacy policy) |
| Google (Analytics and Tag Manager) | If you allow analytics, the pages you visit and how you use them, with Google’s cookies; if not, cookieless page-view notices (see Cookies) | Measuring visits to the site and the Guide |
| jsDelivr | Your internet address, on the Inventor’s Guide | Delivering the Guide’s sign-up, search and comment features |
Transfers outside your country. Our servers are in the United States [confirm the Lightsail region]. The AI providers may process data in the United States, Europe and other countries where they operate. Where the law requires it (for example, for data from the EU or UK), transfers rely on the providers’ data-processing terms, including the European Commission’s Standard Contractual Clauses.
How long we keep things
Your invention material stays only as long as you choose; everything else is kept for a set period and then deleted.
| What | How long |
|---|---|
| Your invention material and reports | Until you delete them, or your automatic-deletion setting removes them |
| Account details | While your account is open; deleted when the account is closed, except the username, which is kept so nobody else can take it and see records filed under it |
| Payment and invoice records | 8 years from the end of the financial year of the payment, as Indian accounting and tax law requires |
| Security and activity records | [3 years] |
| Usage records | [2 years] |
| Backups | Up to 7 days. Something you delete is removed at once from the live service, and disappears from backups as they expire |
When you delete an invention we keep a record that a report existed and what it cost, identified by a reference number rather than its title. That record contains nothing about your invention.
Cookies
We use the cookies the site needs to work, and analytics cookies only if you allow them. You choose in the banner shown on your first visit, and can change your choice at any time from Cookie settings at the foot of every page. One choice covers both the tool and the Inventor’s Guide.
| Name | Kind | What it does | How long |
|---|---|---|---|
| pt_session | Strictly necessary | Keeps you signed in | Up to 12 hours |
| ipf_consent | Strictly necessary | Remembers your cookie choice, for the tool and the Guide | 6 months |
| Session storage in your browser (not a cookie) | Strictly necessary | Holds a disclosure you typed before signing in, until you have signed in | Until you sign in or close the tab |
| Cloudflare’s bot check | Strictly necessary | Tells people from automated bots, on the sign-up, sign-in and password-reset pages | Set by Cloudflare |
| _ga and _ga_ followed by an ID (Google Analytics) | Analytics | Count visits and show how visitors find and use the site | Up to 2 years |
Analytics. We measure visits with Google Analytics, loaded through Google Tag Manager, on the tool and the Guide. It is not loaded on your reports or receipts, or on pages whose address carries a one-time code, such as password-reset and email-confirmation links. Analytics does not receive the text of your disclosures or reports.
If you do not allow analytics. Google sets and reads no analytics cookies. Google’s tags still send Google a short notice of each page view, without cookies: the time, your browser type, the page address and that you did not consent. Google uses these to estimate the visits it cannot count. Your internet address reaches Google with each such notice, as it does with any request your browser makes.
Changing your mind. Open Cookie settings at the foot of any page. If you withdraw permission for analytics, we delete Google’s analytics cookies from your browser.
Other services on the Guide. The Inventor’s Guide loads Ghost’s sign-up, search and comment features from jsDelivr, a content-delivery network. jsDelivr receives your internet address when it serves them. This is not a cookie, so the banner does not cover it.
Advertising. We use no advertising cookies. If we add advertising, or embedded services such as videos, we will add them to the banner and to this notice first, and ask you again.
Security, children and changes
Security. Passwords are stored as salted hashes, never in readable form. Connections are encrypted, access to customer material is limited by role and recorded, and data is backed up nightly. No system is perfectly secure; if a breach affects your data, we will tell you promptly, as the law requires.
Children. The service is for adults and businesses. We do not knowingly accept accounts from anyone under 18.
Changes. If we change this notice in a way that matters, we will email account holders before the change takes effect. The date at the top shows the current version.
Your rights
Wherever you live, you can ask us for a copy of your data, correct it, delete it, or stop us using it; much of this you can do yourself in your account.
| You can | How |
|---|---|
| See your inventions and reports, and what is held about each | The “My data” page |
| Delete an invention, or all of them | The “My data” page, at any time |
| Correct your email, report name, billing details or password | Your account settings |
| Stop reminder emails | Your email preferences |
| Get a copy of your data, close your account, object to or restrict a use, or ask anything else | Email privacy@ipfolks.com from the address on your account |
We answer within one month. To protect you, we act only on requests from the email address registered on the account, or from you while signed in. Some records must be kept even after a request to delete, such as invoices required by tax law; we will tell you what we kept and why.
If you are in India, you may also nominate someone to exercise these rights on your behalf if you die or become unable to.
Complaints. Please contact us first; we will try to put things right. If you are not satisfied, you can complain to the data-protection authority where you live: in India, the Data Protection Board of India; in the UK, the Information Commissioner’s Office; in the EU, the authority in your country.