Privacy Policy

Draft. This page is pending legal review and may change.

The short version

• Capturing an idea does not publish it. We do not read your invention disclosures for analytics, we do not train models on them, and we do not sell them or anything derived from them.
• When you run a prior-art check, the text of your idea is processed by third-party service providers, as described under “Who else sees it”.
• We collect the minimum needed to run the service and prove your timestamps.
• No advertising trackers. No data brokers. No third-party pixels on authenticated pages.
• You can export or delete your data whenever you want, with one exception explained below.

What we collect

You give us

• Account details: name, email, password hash, and for paid plans, billing details held by our payment processor rather than by us.
• Vault content: the disclosures, attachments and notes you enter.
• Contact form messages — your name, email, organization, what describes you, and your message, stored so we can reply.
• Network activity: connection requests, messages and claim submissions you choose to send.

We generate

• Timestamp proofs: the hash, the sealed time, and the verification record.
• Watch results: matches between your records and public sources.
• Operational logs: IP address, browser, and timestamps of significant actions, for security and debugging.

We do not collect

Location beyond coarse country from IP, contacts, advertising identifiers, or behavioural profiles for marketing.

Why we are allowed to (legal bases)

• Contract: running your account, storing your Vault, issuing proofs, processing claims.
• Legitimate interests: securing the service, preventing abuse, and basic aggregate usage counts. We have weighed these against your rights and documented the assessment; ask and we will share it.
• Legal obligation: tax records, and responding to lawful orders.
• Consent: product emails you opted into, withdrawable in one click.

Who else sees it

Vault content goes to a third party when you share a record, and when you run a prior-art check: the text of your idea is sent to a third-party AI service to analyse it and extract search terms, and search terms derived from it are sent to patent search services. The categories of processor we use are:

• AI language-model services, for prior-art analysis;
• patent search services, which receive search terms;
• cloud hosting and storage;
• payment processing;
• transactional email delivery;
• error monitoring, configured to scrub message bodies.

Each is contractually bound to process only on our instructions. We do not sell personal data, and we do not share it for behavioural advertising, in any jurisdiction, regardless of what local law would permit.

If we are compelled to disclose data by a lawful order, we will tell you unless we are legally prohibited from doing so, and we will push back on orders that look overbroad.

How long we keep it

• Account data: while your account is open, then 90 days.
• Vault content: until you delete it, then purged from backups within 35 days.
• Timestamp proofs: indefinitely. This is the exception: a proof you can revoke is not evidence. Deleting the underlying content leaves the hash and time, which reveal nothing about what the content said.
• Operational logs: 12 months.
• Billing records: 7 years, because tax law says so.

Security

Encryption in transit (TLS 1.3) and at rest (AES-256). Access to production data is role-scoped, logged, and reviewed quarterly. Staff cannot read Vault content in the course of ordinary support work; the rare cases where access is necessary require your explicit approval and are recorded.

If a breach affects your data, we will tell you and the relevant regulator within 72 hours of becoming aware, with what we know at the time rather than waiting for a complete picture.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or hand it to another provider in a portable format. You can also complain to your data protection authority (in the UK, the ICO).

Use the contact form. We respond within 30 days, free of charge, and we will not ask why.

International transfers

Data is processed in the UK and EEA. Where a processor operates elsewhere, transfers rely on adequacy decisions or Standard Contractual Clauses with a transfer risk assessment on file.

Cookies

Session cookies to keep you logged in, and local storage for your theme, density and language choices. That is the whole list: no analytics cookies, no advertising cookies, and therefore no consent banner to dismiss.

Children

The service is not for anyone under 18. If we learn we hold a child's data, we delete it.

Changes

Material changes are posted here and emailed to account holders 30 days before they take effect.

Contact

Contact for anything in this policy or anything else.