Privacy policy

1. Who this covers

This policy covers visitors to archecura.com and users of the Archecura application at app.archecura.com. For customer organizations, Perizer LLC is a processor of the records you put in the register and a controller of your account data. The data processing agreement governs the processor relationship.

2. What we collect

• Account data: name, email address, password hash or Google sign-in identifier, organization name, role, notification preferences.
• Register data you enter: entities, brands, marks, serial numbers, notes, documents you upload, specimen URLs, licenses, and acknowledgements. This is your data; see section 6.
• Public USPTO data: the TSDR status page for each serial number you import, stored raw and parsed. It is public record and contains the owner name and correspondence details the USPTO publishes.
• Billing data: plan, invoices, and the last four digits and brand of a payment card. Full card details are held by Stripe, never by us.
• Technical data: IP address, user agent, timestamps, and the pages or API routes requested, in server logs and the audit log. Application logs never carry a serial number next to an organization identifier.

The marketing site sets no analytics or advertising cookies. The application sets session cookies only.

3. Why we use it

• To run the service: sync records from the USPTO, compute the docket, send reminders you have configured, and store your documents.
• To bill you through Stripe and to send transactional email through SendGrid.
• To keep the service secure: session management, rate limiting, lockout, the audit log, and abuse investigation.
• To answer support requests you send us.

We do not sell personal data, and we do not use your register data to train models or for advertising.

4. Who we share it with

Only the subprocessors needed to run the service, listed with their role and region on the subprocessors page: Cloudflare (document storage), Stripe (billing), SendGrid (email), Google (optional sign-in), and ComputeSphere (hosting). We disclose data when the law requires it and will tell you unless we are prohibited from doing so.

5. Where it is processed

The application and database run in the United States. Documents are stored in Cloudflare R2. If you are outside the United States, your data is transferred there to provide the service; the DPA includes the standard contractual clauses where they apply.

6. Your data is yours

Everything you put in the register belongs to your organization. Owners can export the whole organization as a zip at any time (once every 24 hours). Deleting an organization keeps it recoverable for 14 days, then purges it, except invoices, which are kept for seven years as required by tax law.

7. How long we keep it

• Account and register data: for as long as the organization exists, plus the 14-day recovery window.
• Deleted documents: 30 days in soft-delete, then purged from storage, unless under legal hold.
• Backups: nightly database backups kept for 35 days.
• Server and audit logs: 90 days for server logs; the audit log for the life of the organization.
• Invoices: seven years.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to it. Account holders can do most of this from Settings. For anything else, write to [email protected]. We answer within 30 days. You can also complain to your local data protection authority.

9. Security

TLS in transit, encryption at rest, private storage with short-lived links, an append-only audit log, and nightly backups. What we do and do not yet do is on the security page.

10. Children

Archecura is for businesses and their advisors. We do not knowingly collect data from anyone under 18.

11. Changes

We will post changes here with a new date, and email account owners about material changes at least 14 days before they take effect.

12. Contact