ClaimHit / Privacy policy
Privacy policy
What personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation and applicable data protection laws.
1. Who we are
ClaimHit is operated by ClaimHit LLC, a Wyoming limited liability company with its mailing address at 102 Casey Ct, Royersford, PA 19468, United States ("we", "us", "our"). We are the data controller for personal data processed through claimhit.com and the ClaimHit application.
For privacy questions or to exercise your rights, contact privacy@claimhit.com.
2. What data we collect
Account data
- Full name
- Email address
- Company or organisation name
- Job title or professional role
- Password, stored as a bcrypt hash; we never store your plain-text password
Usage data
- Patent numbers you search for and the results returned
- Search mode selections (products or standards)
- Hit Charts you generate and their results
- Documents you upload for a Hit Chart (deleted within 24 hours; only extracted evidence is kept)
- Proposal requests, run-for-you lists and expert review requests you submit, including your notes and any budget information
- Credit purchases and transaction history
- Team membership and collaboration activity
Contact data from forms
- Name, work email and company given on the run-for-you form, without an account
- Phone number and case details where you provide them
Technical data
- IP address, collected by our hosting provider
- Browser type and version
- Pages visited and time spent, through analytics, only after consent
- Session identifiers stored in your browser
What we do not collect
- Payment card numbers or bank details: payments are processed by Stripe or PayU India directly
- Biometric data
- Sensitive personal data as defined under GDPR Article 9
- Data from children under 18
3. Why we collect it: legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| PurposeProviding the ClaimHit service | Data usedAccount data, usage data | Legal basisContract, Art. 6(1)(b) |
| PurposeHandling proposal, run-for-you and expert review requests | Data usedAccount data, contact data, request details | Legal basisContract, Art. 6(1)(b) |
| PurposeProcessing payments | Data usedEmail, transaction amounts | Legal basisContract, Art. 6(1)(b) |
| PurposeService emails (results, monitoring alerts, credit and balance notices) | Data usedEmail, search results, balances | Legal basisContract, Art. 6(1)(b) |
| PurposeImproving search quality | Data usedAggregated, anonymised search patterns | Legal basisLegitimate interests, Art. 6(1)(f) |
| PurposeAnalytics and usage statistics | Data usedTechnical data | Legal basisConsent, Art. 6(1)(a), after cookie consent |
| PurposeSecurity and fraud prevention | Data usedIP address, session data | Legal basisLegitimate interests, Art. 6(1)(f) |
| PurposeLegal compliance | Data usedAccount data, transaction records | Legal basisLegal obligation, Art. 6(1)(c) |
4. How long we keep your data
| Data type | Retention | Reason |
|---|---|---|
| Data typeAccount data | RetentionUntil account deletion plus 30 days | ReasonService provision |
| Data typeSearch results | RetentionUntil account deletion | ReasonHistory access |
| Data typeUploaded documents | Retention24 hours | ReasonEvidence extraction only |
| Data typeProposal, run-for-you and expert review records | Retention7 years | ReasonLegal obligation (tax, contract records) |
| Data typeTransaction records | Retention7 years | ReasonTax and accounting |
| Data typeAnalytics data | Retention14 months | ReasonAggregated, anonymised |
| Data typeSecurity logs | Retention90 days | ReasonSecurity and fraud prevention |
5. Who we share your data with
We do not sell your personal data. We share data only with the processors necessary to operate the service:
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| ProcessorSupabase Inc. | PurposeDatabase and authentication | LocationUS | SafeguardsStandard Contractual Clauses, DPA signed |
| ProcessorVercel Inc. | PurposeApplication hosting and CDN | LocationUS and global edge | SafeguardsStandard Contractual Clauses, DPA |
| ProcessorInference providers (several, US and EU) | PurposeModel analysis of patent claims and candidate products | LocationUS and EU | SafeguardsAPI inputs not used for training by default; zero retention or short abuse-monitoring retention, then deletion. Names available on request. |
| ProcessorWeb search providers (US) | PurposeRetrieval of public product pages from claim-derived queries | LocationUS | SafeguardsReceive only claim-derived queries, never your account details; zero retention or immediate query-log deletion where offered. Names available on request. |
| ProcessorStripe, Inc. | PurposePayment processing | LocationUS | SafeguardsPCI DSS Level 1, Standard Contractual Clauses |
| ProcessorPayU India Pvt. Ltd. | PurposePayment processing | LocationIndia | SafeguardsPCI DSS compliant |
| ProcessorResend, Inc. | PurposeTransactional email | LocationUS | SafeguardsDPA, SOC 2 Type II |
| ProcessorCrisp IM SARL | PurposeCustomer support chat | LocationFrance (EU) | SafeguardsGDPR compliant processor |
Patent data entered into ClaimHit (patent numbers and the results returned) is sent to inference and search providers for processing. Patent numbers are public information. We do not send your account identity to these providers; searches are anonymous at the API level.
The context and claim language you provide are treated as confidential. They are used only to generate your results. We do not sell this data, and it is not used to train the models that perform the analysis. Where a provider offers it, our agreement provides zero data retention with immediate deletion of query logs. Your results are stored in your account so you can return to them, and you can delete them at any time.
6. Cookies
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| Cookiesb-auth-token | TypeEssential | PurposeAuthentication session | DurationSession |
| Cookieclaimhit-consent | TypeEssential | PurposeStores your cookie choice | Duration12 months |
| Cookie_ga, _ga_* | TypeAnalytics | PurposeUsage statistics | Duration14 months |
| Cookiecrisp-client/* | TypeFunctional | PurposeSupport chat session | DurationSession to 6 months |
Analytics cookies are only set after you give consent. The support chat cookie is set when the chat widget loads, because the chat is how you reach a person. Essential cookies are set automatically because the service cannot work without them.
7. Your rights
If you are in the European Economic Area, the United Kingdom, or another jurisdiction with applicable data protection law, you have the right to access, rectify, erase, port and restrict the processing of your personal data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with your data protection authority.
- Access and portability: email us and we provide a machine-readable export of your account data and search history within 30 days.
- Erasure: delete your account from Account, then Profile, then Delete Account. We delete your data within 30 days, subject to legal retention obligations.
- Consent: withdraw analytics consent at any time from Cookie Settings in the footer or by contacting us.
- Complaints: in the EU, find your authority at edpb.europa.eu.
To exercise any right, email privacy@claimhit.com. We respond within 30 days and may ask you to verify your identity first.
8. International transfers
ClaimHit is operated from the United States and uses infrastructure providers based primarily in the United States. If you are in the EU or UK, your personal data is transferred to a country that may not provide the same level of protection as your home country. We rely on Standard Contractual Clauses for transfers to our hosting, database, email and payment processors, on adequacy decisions where available, and on API zero-retention policies for inference providers where data is processed but not retained.
9. Security
We apply appropriate technical and organisational measures: encryption in transit and at rest, bcrypt password hashing, row-level security on every user data table, production access limited to authorised personnel, and regular security reviews. Full details are on the security page.
10. Children
ClaimHit is a professional tool intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
11. Changes to this policy
We update this policy as our practices change or as the law requires. When we make material changes, we notify registered users by email and update the date at the top of this page.
12. Contact
- privacy@claimhit.com
- Company
- ClaimHit LLC
- Address
- 102 Casey Ct, Royersford, PA 19468, United States
We aim to respond to all privacy enquiries within 5 business days and all formal data subject requests within 30 days.