Privacy Policy — PatentSonar
Version 1.2 · Effective 2026-10-05
Who we are. Rockfort Hub de Inovação Ltda, trading as PatentSonar, CNPJ 40.435.866/0001-40, Av. Tiradentes 209, Centro, São João del Rei, Minas Gerais, 36307-346, Brazil, is the controller of the personal data described here. Privacy contact (also the LGPD contact channel, Art. 41 LGPD; as a small-scale controller we rely on the ANPD exemption from appointing a formal encarregado): privacy@patentsonar.com. We have not appointed an EU or UK representative because our processing of EU/UK data is occasional and low-risk (Art. 27(2) GDPR); we will appoint one if that changes.
What we process, why, and for how long
| Data | Purpose | Legal basis (GDPR / LGPD) | Retention |
|---|---|---|---|
| Business contact details of prospects: name, job title, work email, company, country, and the public source where we found them (company website, press release, conference programme, patent register such as an attorney of record) | Contacting a small number of relevant professionals about the Service (account-based, no purchased lists) | Legitimate interest, Art. 6(1)(f) GDPR and Art. 7, IX LGPD, balanced by relevance to the recipient's role, a one-click opt-out in every message and the per-country rules we apply (no cold email where prior consent is required) | 12 months from last contact, then deleted unless you become a customer |
| Customer and Reader details: name, work email, company, billing contact, tax ID, country | Performing the contract, delivering issues, invoicing and tax records | Contract, Art. 6(1)(b) GDPR / Art. 7, V LGPD; legal obligation for fiscal records, Art. 6(1)(c) / Art. 7, II | Contract term, then 5 years for Brazilian fiscal records and up to 10 years where needed to establish or defend legal claims |
| Email delivery events: delivered, bounced, complained, unsubscribed | Deliverability and honouring opt-outs | Legitimate interest | 24 months; suppression list kept indefinitely so we never contact you again |
| Website sample request: email, company, and a one-way daily hash of your IP address (never the address itself) | Sending the sample you asked for, offering a free trial, at most two short follow-up emails about the sample (work addresses only, each with a one-click opt-out), and preventing abuse of the form | Steps prior to a contract / consent, Art. 6(1)(b) / Art. 7, V LGPD; legitimate interest for the follow-ups, Art. 6(1)(f) GDPR / Art. 7, IX LGPD | 12 months, unless you become a customer |
| Free monthly summary: email, the page you signed up on, the date you confirmed, and a one-way daily hash of your IP address | Sending the monthly summary you asked for, after you confirm your address through the link we email you; nothing else is sent to that address on this basis | Consent, Art. 6(1)(a) GDPR / Art. 7, I LGPD; you can withdraw it with the one-click unsubscribe in every summary | Until you unsubscribe, then 24 months as a record of consent; unconfirmed requests are deleted after 30 days |
| Correspondence with us (email, including messages our systems draft replies to) | Answering you, sales conversations, support | Legitimate interest; contract | 24 months after the last message |
We do not use tracking pixels for individual open tracking, do not profile readers, and do not sell or rent personal data. Our website sets no analytics or advertising cookies; the checkout, operated by Paddle, uses cookies strictly necessary to process payment (see Paddle's privacy notice).
Automated drafting. Our analysts use AI systems to prepare content and to draft replies to correspondence. Correspondence you send us may therefore be processed by our AI provider (Anthropic) under commercial terms that prohibit training on customer data. No decision producing legal or similarly significant effects on you is made solely by automated means.
Recipients and processors. We share personal data only with the service providers below, bound by data-processing terms, and with authorities where the law requires.
| Provider | Role | Location |
|---|---|---|
| Paddle.com Market Ltd / Paddle.com Inc. | Merchant of Record: checkout, payment, receipts, taxes (independent controller for its own purposes) | UK / US |
| Supabase Inc. (on Amazon Web Services) | Database hosting | US (us-east-1) |
| Hostinger International Ltd | Application server hosting | US (Boston, Massachusetts data centre) |
| ActiveCampaign LLC (Postmark) | Newsletter and transactional email delivery, bounce handling | US |
| Cloudflare Inc. | DNS, routing of inbound email to our server, edge security | US (global network) |
| Google LLC (BigQuery) | Patent data processing; no reader or customer personal data | US |
| Anthropic PBC | AI assistance in drafting content and replies | US |
| Telegram | Internal operational alerts to our founder, which may contain a prospect's name and email | EU / UAE |
| Notaas / national NFS-e system | Brazilian tax invoices to Paddle; no subscriber personal data | Brazil |
International transfers. We are established in Brazil; our application server and database are in the United States, so your data is processed in Brazil, the US and, for some providers, the EU. For data of people in the EU/UK, transfers to our processors rely on the EU/UK Standard Contractual Clauses or the EU-US Data Privacy Framework where the processor is certified. For transfers out of Brazil, we use the standard contractual clauses approved by the ANPD (Resolução CD/ANPD 19/2024) or another mechanism under Art. 33 LGPD.
Security. Data is encrypted in transit (TLS) and at rest by our hosting providers, access is limited to what operating the Service requires, credentials are segregated per service, and every automated action is logged. If a personal-data breach is likely to create risk to you, we will notify the competent authority and, where required, you, within the legal deadlines (Art. 48 LGPD; Art. 33–34 GDPR).
Your rights. You may ask for access, correction, deletion, restriction, portability and, at any time, object to legitimate-interest processing including prospecting; in Brazil you also have the rights in Art. 18 LGPD, including information about sharing and the consequences of refusing consent. Write to privacy@patentsonar.com; we answer within 15 days (LGPD) and in any case within one month (GDPR). You may complain to the ANPD (gov.br/anpd) or to your local supervisory authority.
Opt-out. Every marketing message includes a one-click opt-out. Opting out adds your address to a suppression list checked before every send, including sends by our email provider on our behalf.
Children. The Service is for businesses and is not directed at anyone under 18.
Changes. We post changes on this page with a new version number and email customers about material changes at least 30 days before they take effect.
Version 1.0, effective 2026-09-26. Reviewed and adopted at the founder's direction (legal/REVIEWSTATUS.md)._