Privacy Policy

Privacy in the Patentbutler app

uptoIP GmbH is the controller responsible for personal data processed to provide Patentbutler. The company and privacy contact details above also apply to app-related requests. The website-specific information follows this app section.

Accounts and signing in

We use your account identifier, email address, authentication and session information, and any name or profile information supplied during sign-in to create and secure your account. If you choose Apple or Google sign-in, we receive the identity information that provider supplies, including an email address or Apple relay address where applicable. These providers also process your sign-in under their own privacy information.

Supabase provides our account authentication and stores account and product records. Account information is needed to sign in, recover access, associate your saved research with you, and verify ownership for account requests.

Searches, translation and saved research

When you submit a search or translation request, we process the text you enter, the selected options and the resulting response to provide the requested feature. Requests pass through our Hetzner gateway to our own search and translation APIs, which run on our infrastructure in Austria. We do not use your submitted research content to train models.

Your Supabase search history stores the query sent to the search service, references to the patent results and associated search information so you can revisit previous searches. Queries and result references are retained for the life of your account, until account deletion. We also store the saved collections and patent references you create. Please submit only information you are authorized to use and avoid including unnecessary personal information about other people.

Stored search history is distinct from operational logging. Submitted research text is excluded from app and gateway logs, analytics and crash-reporting events. Error logging by our APIs is described below. Hosting providers still process information needed to deliver their services; internal search infrastructure does not mean that all app information is processed only by our employees.

API error logging

If a request to one of our APIs fails, the service can write an error record to Splunk that includes the request query. This logging occurs in the event of an API error and helps us investigate failed requests. These error records do not include your Patentbutler account details. The query itself may nevertheless contain personal or confidential information; the absence of account details does not make its content anonymous.

Subscriptions and usage allowances

We process your plan, subscription status and expiry, purchase references and usage counters to provide the access and allowances associated with your account. The store through which you purchase handles payment details. We do not receive your full payment-card details through the app’s store purchase flow.

RevenueCat, Inc. helps us verify purchases, restore eligible purchases and manage subscription access. We identify your RevenueCat customer using your Patentbutler account identifier, which we can link to your account; it is not anonymous data. RevenueCat processes store transaction and subscription records and technical app/device information needed for these services. The app initializes RevenueCat when you open subscription features. We do not send your email address, name or submitted research content as RevenueCat customer attributes. Optional SDK diagnostics and automatic device-identifier collection are disabled. See its privacy information and Data Processing Addendum.

RevenueCat also processes subscription and purchase statistics and events from the subscription purchase screen (paywall), including impressions and interactions with available subscription options. These records can include your account identifier, offering and paywall identifiers, event times, platform and locale information, and purchase outcomes. We use them to understand subscription uptake and compare offers and purchase-screen performance. Offers may be assigned through RevenueCat subscription-price experiments; the applicable price is displayed before purchase. These analytics remain active even though PostHog is disabled. They do not include your search or translation text.

Device storage and technical information

The app stores authentication-session information on your device so you can remain signed in, and stores your theme, search-language and result-count preferences. User research drafts and search results can be held in memory while you use the app; raw search text is not saved in a persistent local research cache. This does not prevent you from explicitly exporting or sharing research through a feature you select.

Copies you export or share can remain outside your account, on your device or with a recipient you select. Account deletion does not remove those copies. If you contact support, we process the information you choose to send using the correspondence procedures described below.

A randomly generated installation identifier is stored in the device’s secure storage. We use it with free-allowance counters to prevent repeated account creation from resetting an installation’s free allowance. It is retained when you sign out or delete an account. On iOS, secure storage can also survive uninstalling and reinstalling the app. Device preferences are likewise not removed by account deletion.

Your device’s time-zone setting helps us calculate allowance periods. When you connect, our infrastructure and service providers receive connection information such as IP addresses. Operational records can include account or request identifiers, timestamps, feature names, status codes, durations and counts to operate the service, enforce allowances, investigate faults and protect against misuse.

General product analytics through PostHog are disabled in the current release setup. RevenueCat subscription and paywall analytics are described above and remain active. Sentry crash reporting is not configured in the current production environment. We do not enable session replay or automatic screenshots.

Hosting, recipients and international processing

Our primary Supabase database is in Frankfurt, Germany. Our Hetzner gateway is in Nuremberg, Germany. Our search and translation APIs run on our own infrastructure in Austria. Staff who operate the service or handle support can access the information needed for their work. Supabase and Hetzner process hosted information on our behalf; RevenueCat supports subscription processing and the subscription/paywall analytics described above; Apple or Google processes the sign-in or store services you choose. IONOS handles support email as described below.

We use Splunk for the API error logging described above. Staff responsible for operating our APIs use these records to investigate failed requests.

These primary hosting locations do not establish that every provider operation occurs in the European Economic Area. RevenueCat describes US hosting. Supabase’s Data Processing Addendum and RevenueCat’s Data Processing Addendum form part of their standard customer agreements and incorporate EU standard contractual clauses for relevant transfers. Provider subprocessors may also participate in delivering these services. Contact us for information about the safeguards relevant to your data. These agreements do not mean that all processing takes place in the EEA.

Purposes and legal bases

For users to whom the GDPR applies, we rely on Article 6(1)(b) for processing necessary to provide the service you request: accounts, searches, translation, saved research, purchase verification, purchase restoration and subscription access. Subscription and paywall analytics are separate purposes, rather than processing necessary to deliver subscription access. We rely on Article 6(1)(f) for proportionate security, fault investigation and protection against misuse of allowances, subject to your interests and rights. Article 6(1)(c) applies where a legal obligation requires us to process or retain information. Consent is used where applicable law requires it; merely reading this notice does not constitute consent.

Protecting your information

We use encrypted network connections and account-based access controls for hosted account and research records. Trusted backend services enforce access and usage allowances. Account-deletion requests require ownership verification, and staff access is limited to the information needed to operate the service or handle your request.

Account deletion

In the app, open Account, select Delete account, review the notice, verify your identity and confirm the deletion request. You can also request deletion without reinstalling the app by emailing support@patentbutler.app. Contact us from your account email where possible. If you cannot access it, ask for account-recovery assistance. Never send passwords, authentication tokens or confidential research content.

Deletion removes your account and linked sign-in identities, profile, search history including stored queries and result references, saved collections and their items, and account-linked quota and entitlement records. The app clears its authentication session and user-scoped workspace state. The deletion process includes removal of the associated RevenueCat customer and revocation of Apple sign-in authorization where applicable. Store or provider records retained for their own legal obligations are governed by the provider’s retention procedures.

The installation identifier and consumed free-allowance counters are retained separately from the deleted account to prevent allowance resets while the installation’s one-time free allowance is enforced. Contact us to request erasure or a review of whether retaining that information remains necessary in your circumstances. Limited operational records, deletion-retry records, provider records or backups may also remain as described below. Removing an account reference from a record does not necessarily make that record anonymous.

We aim to complete verified email deletion requests within one to three business days, Monday to Friday excluding Austrian public holidays. We will explain additional verification or expected delays and confirm completion through the verified contact channel. This service target does not replace statutory response duties for privacy-rights requests.

Account deletion does not cancel a store subscription or remove the store’s purchase history. Manage your subscription in the store through which you purchased it to prevent future renewals. You may request account deletion immediately even if a subscription is still active.

Retention and backups

A minimal deletion-operation record supports safe retries and confirmation of an account-deletion operation. It contains identifiers, status and timing information, without passwords, provider credentials or research text. Its retry window expires 24 hours after the operation record is created, and scheduled cleanup removes expired records. Backup copies can remain beyond this active-record window.

Account and saved-research records are kept while your account remains active, subject to your rights and the deletion procedure above. Supabase currently takes daily physical database backups; our Pro plan provides approximately seven days of accessible restore points, and point-in-time recovery is disabled. This recovery window is not a promise that every provider or independently retained backup copy is erased within seven days.

Processing copies on our search and translation infrastructure are used to execute and deliver the request, or recover from a failure in that request. Our retention criterion for those copies is completion of the request and any necessary recovery or fault investigation. Saved research follows the account-history retention described above.

API error records in Splunk can retain a request query beyond completion of the request. Our retention criterion for these records is the period needed to investigate and resolve the failure, subject to any specific legal obligation or claim requiring further retention. They are separate from your Supabase search history; deleting that history or your account does not automatically erase these error records. You can request erasure or a review of continued retention using the contact details above. Please do not send the query itself when making that request.

Account deletion does not automatically remove every operational record. Retention depends on whether the record is still needed to complete or investigate an operation, enforce an allowance, resolve a security incident, or meet a specific legal obligation or claim. Our target for routine gateway audit metadata is 30 days; this is not an automatic expiry guarantee for all operational or provider records. You can request erasure or a review of continued retention through the contact details above.

Backup copies can outlast deletion from active systems. Their retention is determined by when the relevant backup set is replaced, rotated or expires under the system or provider’s recovery schedule. Backups are retained for recovery rather than routine use of your deleted account. When restoring a backup, our policy is to reapply completed deletion requests before returning restored account data to normal service. This criterion also applies to backups of our Austrian infrastructure; we do not promise a universal seven-day backup-erasure deadline.

Store transaction records and provider records may remain where needed for purchase history, fraud prevention, accounting or a specific legal obligation. The retention period depends on the applicable store or provider requirement. Such retention does not restore your deleted Patentbutler account or permit unrelated reuse of submitted research.

Your rights and contact

The rights and contact procedures below also apply to personal data processed for the app. Contact us for access, correction, deletion, restriction, objection or portability where the applicable conditions are met. We may request proportionate information to verify ownership. You can ask for information about the recipients and safeguards relevant to your data. Access, correction and deletion requests are not limited to the in-app account-deletion button.

Changes to this notice

We keep this notice up to date as the service and our processing arrangements change. The date at the top identifies the latest update. We will give additional notice and obtain consent where applicable law requires it before introducing a change that needs your consent.