Skip to content
patentino

Draft – subject to legal review. This text is a draft and has not yet been finally reviewed by a lawyer.

Privacy policy

This is a convenience translation. Only the German version (Datenschutzerklärung) is legally binding.

We process personal data only to the extent necessary to operate patentino. All processing takes place exclusively within the European Union. We do not use tracking, analytics tools or advertising cookies.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Lukas Gabriel
Allerstraße 43
12049 Berlin
Germany
Email: hallo@patentino-ai.de

No data protection officer has been appointed, as the statutory requirements for this are not met. If you have any questions about data protection, please contact us at the email address above.

2. Hosting and data processing

patentino is operated on Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (“AWS”). Servers, database and stored documents are located in the AWS region Frankfurt am Main (eu-central-1). AI processing (Amazon Bedrock, section 8) also takes place via AWS in EU regions only. We send emails via Google Workspace (section 5).

AWS processes the data as our processor, on our behalf and in accordance with our instructions. We have concluded a data processing agreement with AWS under Art. 28 GDPR (AWS Data Processing Addendum). Apart from AWS, we use one further processor, only for sending emails (Google, see section 5).

The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR) and – where you use patentino as a customer – the performance of the contract (Art. 6(1)(b) GDPR).

3. Visiting the website, server logs

When you visit our website, the server processes technically necessary data transmitted by your browser: IP address, date and time of access, requested address, HTTP status code, amount of data transferred, referrer URL and browser and operating system details (user agent).

We process this data to deliver the website, to ensure its stability and security and to detect misuse (e.g. attacks). The legal basis is Art. 6(1)(f) GDPR. Server logs are deleted after 14 days at the latest, unless they are needed for longer to investigate a specific security incident.

Fonts are served from our own server. No third-party content (e.g. Google Fonts, CDNs, social media plug-ins) is embedded.

4. Cookies and local storage

The public pages of patentino set no cookies. Only when you sign in to the application do we set a technically necessary session cookie (patentino_session) that keeps you signed in during your session. It is restricted to our domain, cannot be read by scripts (HttpOnly) and expires after 14 days at the latest or is deleted when you sign out.

The application also stores settings (e.g. selected filters or views) in your browser's local storage. This data remains on your device and is not transmitted to us.

The legal basis is section 25(2) no. 2 TDDDG (strictly necessary storage) and Art. 6(1)(b) GDPR. We do not use tracking, analytics or marketing cookies, nor any third-party cookies.

5. Early-access sign-up (double opt-in)

When you sign up for early access using the form on our website, we process the details you provide:

The purpose is to inform you about early access to patentino and to contact you about activating your access. The legal basis is your consent (Art. 6(1)(a) GDPR). You only receive news by email if you sign up for it separately (section 5a).

Double opt-in: after submitting the form you receive an email with a confirmation link. Your sign-up only becomes active once you open this link. This ensures that nobody can sign up using someone else's email address. We store the time of sign-up and of confirmation as proof of your consent (Art. 7(1) GDPR). Sign-ups that are not confirmed within 30 days are deleted automatically.

Sending emails: we send our emails as hallo@patentino-ai.de via the SMTP relay service of Google Workspace. The provider is Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland, acting as processor under Google’s data processing terms (Cloud Data Processing Addendum). Google receives the recipient address and the content of the respective email as far as this is necessary for delivery; we store your details in our own database at AWS in Frankfurt. We cannot rule out processing by Google outside the EU, for example in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the European Commission’s standard contractual clauses apply in addition. If sending via Google is disrupted, we send via Amazon Simple Email Service (Amazon SES) in the AWS region Frankfurt instead (see section 2).

Withdrawal and unsubscribing: you can withdraw your consent at any time with effect for the future – via the unsubscribe link contained in every email, or by email to datenschutz@patentino-ai.de. When you open the unsubscribe link, we delete your details immediately. Withdrawal does not affect the lawfulness of processing carried out before it.

If no contract is concluded, we delete confirmed sign-ups after twelve months at the latest. If a contract is concluded, section 6 applies.

Please do not include any client or case data in your message.

5a. News by email (newsletter)

On our home page and in the “Free trial” form you can choose to sign up for news about patentino, for example about new features and the launch. We write rarely. We process:

We do not store your name or your IP address for the news.

The purpose is to send you news about patentino. The legal basis is your consent (Art. 6(1)(a) GDPR). Signing up is voluntary and not a requirement for a trial.

Double opt-in: you only receive news after opening the confirmation link in our email. If you sign up in the “Free trial” form, the same link confirms both your trial request and the news. We store the wording and the times as proof of your consent (Art. 7(1) GDPR). Unconfirmed sign-ups are deleted automatically after 30 days.

Storage and sending: we keep the list ourselves, in our database at AWS in Frankfurt (section 2); we do not use an external newsletter service. We do not track opens or clicks. The emails are sent via Google Workspace as described in section 5.

Withdrawal: you can withdraw your consent at any time with effect for the future – with one click via the unsubscribe link in every email, or by email to datenschutz@patentino-ai.de. We then delete your address from the list immediately; the security log only keeps an entry without your email address. Withdrawal does not affect the lawfulness of processing carried out before it.

Retention: until you withdraw your consent. Backups still contain the address for up to 30 days afterwards.

6. User account and sign-in

To use the application, we create a user account for you. In doing so we process your username, where applicable your name and email address, your password (only as a cryptographic hash, never in plain text), your role (e.g. administrator) and your quota and usage data (e.g. number of searches).

To protect accounts, we log security-relevant events such as successful and failed sign-ins, password changes and changes to user accounts, each with time, username and IP address.

Once our terms are in force, we also store with your account which version of the terms you accepted, when and how (when accepting the invitation or after signing in), so that we can prove the conclusion of the contract.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for the security log, our legitimate interest in the security of the application (Art. 6(1)(f) GDPR).

Trial accounts: during a free trial we send you emails about your trial: a welcome email with first steps, and notices when most of your credits are used, when the trial is about to end or has ended, and before the trial account is deleted. These emails are part of providing the trial (Art. 6(1)(b) GDPR). In addition, based on our legitimate interest in a good introduction and in feedback (Art. 6(1)(f) GDPR), we send at most one email with tips (on the second or third day, only if you have used patentino little by then) and one request for feedback seven days after the end of the trial. These two emails contain an unsubscribe link; after unsubscribing you no longer receive them. The emails are sent via Google Workspace as described in section 5.

If a trial does not become a regular account, we delete the trial account automatically 90 days after the end of the trial, including saved searches, saved items and API keys; the account's key is destroyed as well (crypto-shredding, section 12). We inform you by email seven days beforehand. Security log entries relating to a deleted trial account are kept without username and IP address.

6a. Help & contact in the application

Via “Hilfe & Kontakt” (help & contact) in the application you can send us a message. We process the category you chose, subject and message, an optional screenshot you upload and, automatically, your account (username, name, email address), your firm, whether you use a trial account, your browser (user agent) and the page of the application on which you wrote the message – without any search content.

The purpose is to handle and answer your request. The legal basis is Art. 6(1)(b) GDPR insofar as the request concerns your use of patentino, otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

We store the message in our database at AWS in Frankfurt, encrypted with your account's key (section 12), and send it to support@patentino-ai.de; you receive a confirmation of receipt. Emails are sent via Google Workspace as described in section 5. We delete completed requests 12 months after they were closed, and also together with your account. We keep the copy in our mailbox for as long as it is needed to handle your request. Please do not include client or case data.

7. Research, search history, saved items and chat

When you run a search or use the chat assistant, we process your input (in particular your description of the facts or your questions), the filters selected and the results. Your research is stored in your search history, linked to your user account, so that you can reopen it later, export it or – if you wish – share it with other users. Items you store in your saved items list are also linked to your account. Chats with the assistant (questions, answers, cited decisions) are stored in your chat history, linked to your account; you can rename, archive and delete them and share them read-only within your firm.

Private mode and settings: In private mode (the “Private” switch in the application) searches and chats are not stored; we then only record the credits used (type and time of use, without contents). Exports, saving decisions and assigning them to a matter remain possible and store only what you explicitly choose there. Under “Privacy & history” you can switch storage off permanently and choose a shorter deletion period (30, 90 or 365 days). Your firm can switch storage off for all members or set a maximum period; the strictest setting always applies.

Saved research, chats and notes are additionally encrypted at application level (see section 12). Administrators – including us as the operator – see no search content, only usage figures. Sharing is only possible within your own firm.

Saved research and chats are deleted automatically after a set period (default: 180 days, for chats counted from the last message; the period can be adjusted per firm and shortened by you). You can also delete entries in your search history, chat history and saved items yourself at any time. The legal basis is Art. 6(1)(b) GDPR.

8. AI processing via Amazon Bedrock

For patentino's AI features we use Amazon Bedrock, a service of Amazon Web Services EMEA SARL (address in section 2). We use:

This involves processing the text of your query or chat message and excerpts from court decisions – but not your name, email address or other account data. Processing takes place exclusively in AWS regions within the EU (EU inference profiles). Under the AWS service terms, inputs and outputs are neither used to train models nor shared with the model providers or stored by them beyond the processing.

The legal basis is Art. 6(1)(b) GDPR (provision of the contractually agreed research function) and Art. 6(1)(f) GDPR.

9. Notes for professional secrecy holders

An anonymised description of the facts is sufficient for good research. Please do not enter names of clients, parties or other personal data unless they are necessary for the research. On request, we conclude a data processing agreement under Art. 28 GDPR and a confidentiality undertaking under section 43e BRAO or section 39c PAO with our customers (German Federal Lawyers' Act / Patent Attorneys' Act).

Recipients

Recipients of personal data are AWS (see sections 2, 5 and 8) and – for sending emails – Google (see section 5), each acting as processor. A transfer to third countries outside the EU/EEA is only possible when emails are sent via Google (section 5). Data is only passed on to other third parties where we are legally obliged to do so.

10. Retention periods

11. Your rights

You have the following rights with regard to your personal data:

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation.

To exercise your rights, simply send an email to datenschutz@patentino-ai.de.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

12. Data security

Data transmitted between your browser and patentino is encrypted using TLS 1.2 or higher (HTTPS). Database, backups and documents are stored encrypted. Saved research, chats and notes are additionally encrypted at application level with AES-256-GCM, using a separate key for each user, managed via AWS Key Management Service (KMS) in Frankfurt. We store passwords only as hashes.

Access to content follows the need-to-know principle: roles and permissions (firm administrator, user) limit who can see what; sign-ins and administrative actions are logged. We provide customers with an overview of our technical and organisational measures (TOMs) on request.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI features serve solely for research in court decisions.

Changes

We will update this privacy policy if our processing or the legal situation changes. The version published here applies.

Last updated: October 2026