Privacy policy

Effective 2026-09-05. The controller is Nebula Innovations LLC, Nevada, United States, operating IPtorch. Questions and requests: support@iptorch.com.

What we collect

Without an account. A search you run as a visitor is recorded under a reserved anonymous account: the query, the report it produced, when it ran and what it cost, so the free service can be measured. It is not linked to you. Server logs hold your IP address, browser and the pages requested for up to 90 days, for security and capacity, and are then deleted.

With an account. Your name, email address and a password hash; the searches you run, the documents you upload and the reports produced from them; the ledger of credit granted, charged and paid; and, if you add a card, the identifiers Stripe gives us (a customer id, a payment method id, the card brand and last four digits). We never see or store the card number.

Uploads. A document you upload is stored so the search can read it and so the report can quote it. It is not published, not shared with other users and not used to train models.

Who processes it for us

Google Cloud (hosting, and Vertex AI language models that read documents and write report text), Anthropic (language models, for some reading and review steps), Voyage AI (text embeddings for search), Stripe (payments), Resend (transactional email), and, only when you switch on outside sources for a run, the patent databases queried (SerpApi for Google Patents, the European Patent Office's OPS service, the USPTO's open data services, PQAI). Each processes the data needed for its task under its own terms. We do not sell personal information.

What we use it for

To run your searches and build your reports; to bill you for paid work and to show you what it cost; to send you the emails you asked for (a finished search, a password reset, an invitation) and, rarely, notices about the service; to keep the service secure and to measure and improve it in aggregate.

How long we keep it

Account data, searches and reports: while the account exists. Deleting your account deletes them. Ledger and payment records: seven years, as tax law requires, held without your searches. Server logs: 90 days. Anonymous visitor searches: their reports are kept as part of the search cache and hold no personal data.

Your rights

You can read, correct or export what we hold about you from your account, or by asking us. You can ask us to delete your account and its contents; we will confirm and do it within thirty days, keeping only what tax law requires. If you are in the EU, the EEA, the United Kingdom or Switzerland you also have the rights the GDPR and the UK GDPR give you, including the right to object to processing based on our legitimate interests and to complain to your supervisory authority. Where processing is based on consent you can withdraw it at any time.

Cookies

One session cookie keeps you signed in and protects forms against cross-site requests. There is no advertising, no tracking pixel and no analytics cookie. Stripe sets its own cookies on the payment form under its own policy.

Security

Data is transmitted over TLS and stored on access-controlled servers in the United States. Passwords are stored as salted hashes. No system is perfectly secure; if we learn of a breach affecting your data we will tell you.

Children

The service is for professional use and is not directed at children under 16.

Changes

We may update this policy; the effective date at the top changes when we do, and we will email account holders about a material change.