Privacy Policy

1. Who we are. Patentiq is an online brand protection platform operated by PATENTIQ TECNOLOGIA LTDA., CNPJ 69.296.813/0001-77, headquartered at Rua Imaculada Conceição, 1430, Prado Velho, Curitiba/PR, Brazil, ZIP 80215-182 ("Patentiq"). This policy explains which personal data we process, why, for how long, and what your rights are, under Brazilian Law No. 13,709/2018 (LGPD).

2. Who it applies to. Visitors to Patentiq's public pages, including the institutional website patentiq.com.br; people who fill out a form on the website (contact, free diagnosis or talk about takedown); users of our customers' accounts; and people whose public data appears in brand monitoring results (for example, holders of domains or profiles that imitate a brand).

3. Data we process and purposes.

Data	Purpose	Legal basis (LGPD)
User's name, email, role and customer	Create and maintain the account, send invitations and notices	Performance of contract (art. 7, V)
Password (stored only in hashed form) and second factor	Authentication and account security	Performance of contract and legitimate interest (art. 7, V and IX)
Access records: date, time, IP address	Security and compliance with the Brazilian Internet Civil Framework	Legal obligation (art. 7, II; Law No. 12,965/2014, art. 15)
Date and time the user last opened each channel's screens (Domains, Found images and Social media), per brand	Show on the Dashboard what is new since the last visit and open the last brand visited	Performance of contract (art. 7, V)
Log of actions in the system	Traceability and proof of the actions taken	Legitimate interest and regular exercise of rights (art. 7, IX and VI)
Customer billing data (company name, CNPJ or CPF, address)	Invoicing	Performance of contract and legal obligation
Demo account data (users, brands and results, including those from before the demo and those imported from the previous platform, when an existing customer is placed in a demo)	Allow the customer to evaluate the service before signing a contract	Preliminary procedures to a contract, at the customer's request (art. 7, V)
Takedown authorization acceptance: user, date, time, IP address, accepted text and its SHA-256 code	Prove the authorization given to Patentiq to notify third parties on the customer's behalf	Performance of contract and regular exercise of rights (art. 7, V and VI)
Customer's power of attorney and the brand's INPI registrations (may contain the signer's name and ID)	Prove brand ownership and Patentiq's powers to platforms and providers	Performance of contract and regular exercise of rights (art. 7, V and VI)
Contacts and responses from registrars, providers and platforms, and checks on the target after the request	Handle the takedown case and verify whether the content went offline	Performance of contract and regular exercise of rights (art. 7, V and VI)
Public third-party data found during monitoring: site or profile address, profile name, images and screenshots, domain registration data. On social networks (Instagram, Facebook, TikTok, YouTube, X and public Telegram channels), as each network is activated, we read only public profiles, pages and channels, without logging in: address, display name, verified badge, follower range, description, domains of the links in the description and the profile photo, which is sealed. On X, also the public posts that mention the brand and the profile of whoever posted them. On Telegram, never groups or private chats, and we do not keep the content of channel messages.	Detect brand misuse, keep evidence and request removal	Legitimate interest and regular exercise of rights (art. 7, IX and VI)
Findings reported by the customer: page, site or profile address, the user who reported it, the date and the note written by that user (it may contain a person's name)	Include in monitoring, in the evidence and in the removal request a misuse the customer found	Legitimate interest and regular exercise of rights (art. 7, IX and VI)
Public marketplace listings (Mercado Livre and Shopee): title, name and ID of the selling store (it may be an individual), price, address and photo of the listing	Monitor misuse of the customer's brand	Legitimate interest and regular exercise of rights (art. 7, IX and VI)
Website forms (contact, free diagnosis and talk about takedown): name, email, company, brand, website and, in the takedown form, the case link; optional message; the language in which the form was sent	Respond to the request, prepare the diagnosis and send the proposal	Preliminary procedures related to a contract, at the request of the data subject (art. 7, V)
The same website form data	Follow up on the sales contact	Legitimate interest (art. 7, IX), with the right to object at any time
Name and email of people who checked the box to receive news on the website form	Send Patentiq news and content	Consent (art. 7, I), which may be withdrawn at any time
Encrypted summary (hash) of the IP address of people who submit a website form	Limit mass submissions by bots (anti-spam)	Legitimate interest (art. 7, IX)

4. Minimization in monitoring. From domain registration data, we do not store CPF numbers or the names of individuals; the CNPJ is stored only in scrambled form, for comparison. When a case may require identifying the holder for removal or legal action, the registry response is stored sealed (encrypted) and is only opened when a case is opened, by an authorized person, with a recorded purpose. In the note of a reported finding, we ask the user not to write personal data beyond what is needed to identify the misuse. When the reported link carries the identifier of a click on an ad (such as gclid, gbraid, wbraid, fbclid or ttclid), that identifier is stored only inside the sealed evidence; it does not appear on screens, in lists or in the activity log. In marketplace listings, we keep only the store name and ID of the seller, and the listings are read without logging in or using any marketplace account.

Institutional website and forms. The patentiq.com.br website does not use tracking cookies. Visits are measured in aggregate, without cookies and without identifying the visitor (by the hosting supplier). The forms use an anti-bot check from the network and security supplier, which analyzes technical signals from the browser only to detect bots, without tracking cookies. From each form, we keep only the fields filled in, the website page the submission came from, the language of the form and whether the person agreed to receive news; the IP address is not stored, only an encrypted summary of it, for up to 24 hours. Checking the news box is optional and does not change the response to the request. In the website's quick domain check, the name you type is used only to query the public DNS of our network and security supplier and is not stored; your IP address is not read.

Roles. For account, access, billing and website data, including the institutional website and its forms, Patentiq is the controller. For third-party data found during monitoring, Patentiq is the processor: it processes that data on behalf of the customer who hires the service, who is the controller, according to the contract's instructions (LGPD, art. 39). Data subject requests about that data may be sent to Patentiq, which forwards them to the responsible customer and helps with the response.

5. Sharing. We do not sell personal data. We share it only with:

• suppliers that operate the platform, under contract and only for the service (list below);
• the customer that owns the account, who sees its own users' data and the monitoring results for its brands;
• platforms, registrars and providers, when the customer requests content removal, only with the necessary evidence;
• authorities, when there is a legal obligation or a court order.

When the customer requests a takedown, we share with the registrar, provider, platform or body responsible for the reported content the data needed for the notice: the company name and CNPJ of the customer and, when the brand belongs to another company, of the brand owner, brand details, the reported address or profile and the collected evidence, which may contain data about whoever registered or operates the content. We also keep the abuse contacts of these third parties, which are public business data. The legal basis is the performance of the contract with the customer and the regular exercise of rights (LGPD, art. 7, V and VI). Case evidence is kept for 5 years after the case is closed.

Some registrars, providers and platforms forward the notice to the reported party (for example, the brand owner's company name, the notifier's email and the nature of the report), and some publish the notices they receive in Lumen (lumendatabase.org), a public transparency database maintained by the Berkman Klein Center at Harvard University. As the notifier, Patentiq uses its own name and the email takedown@patentiq.com.br, not the personal data of the customer's users; the company name and CNPJ of the customer (or of the brand owner) appear in the notice. When the channel requires a power of attorney or an owner's document, these documents, which may contain the name and position of the signer, are sent by Patentiq only to the channel, never directly to the reported party; any later forwarding follows each channel's policy. On the case page, the customer sees, for each channel, whether the notice may be forwarded to the reported party or published in Lumen; when this is not known, the notice is shown anyway.

Category	Use	Where data is kept
Cloud database and hosting	Store the platform's data, sign-in and files; publish the application and the institutional website; measure website visits in aggregate, without cookies	Brazil (São Paulo), with a global delivery network
Email delivery	Invitations, notices, alerts and the notice to the team about a contact received through the website	United States
Collection of public data on the internet	Search for public profiles, channels, listings and images on social media, search engines and marketplaces; they receive the search terms and the brand images	United States and European Union
Screen capture	Capture of the monitored pages, as evidence	United States
Artificial intelligence	Analysis of the images and pages found	United States
Timestamping	Trusted date of the evidence; they receive only the integrity code, without personal data	European Union and United States
Network and security	DNS lookups for the monitored domains and for the website's quick domain check, and anti-bot check on the website forms, without tracking cookies	Global network
Domain registration	Lookup of public registration data (such as Registro.br and the registrars)	Brazil and abroad

The named list of suppliers (sub-processors), with the role and country of each one, is provided to customers as an annex to the contract and to any data subject who requests it from the Data Protection Officer (section 12), within 15 days. It is updated whenever a supplier is added or removed.

6. International transfer. Some of the suppliers above process data in the United States and the European Union, for the purpose described in the table, for as long as the contract with each supplier lasts. These transfers rely on contracts with data protection clauses and on the other safeguards of LGPD art. 33 and ANPD Resolution CD/ANPD No. 19/2024. Your rights (section 8) also apply to this data. Upon request to the Data Protection Officer, we provide the full text of the clauses used, subject to commercial and industrial secrecy.

7. How long we keep data.

Data	Period
User account	While the account exists; afterwards, for the legal retention period
Last visit to each channel's screens	Only the most recent one (no history), while the user is active; deleted when the user is deactivated
Access records	Minimum of 6 months (Brazilian Internet Civil Framework, art. 15) and maximum of 12 months
Evidence and monitoring results (including findings reported by the customer and their note)	12 months after the content goes offline or the customer ends the contract; 5 years after the end of a removal case or legal action
Billing data	5 years, under tax law
Takedown cases: accepted authorization, power of attorney, contacts, responses and target checks	5 years after the case is closed
Archived powers of attorney and INPI registrations	5 years after being archived
Demo account (trial period without a contract): users, brands, monitoring results, evidence and takedown requests	60 days after the end of the demo, including any extension, if it does not become a contract; then deleted. Exception: data of takedown requests already in progress follows the retention period of takedown cases. Only the company name, the CNPJ and the company address, the action log and the cost records are kept, for 5 years and for the regular exercise of rights (art. 7, VI), without data about individuals. The contact email and phone number in the company record are also deleted or anonymized. When an existing customer is placed in a demo, the rule applies to all of the account's data, including data from before the demo and data imported from the previous platform.
Marketplace listings	5 years when marked as counterfeit, brand misuse, copied official photo or irregular before ANVISA; 1 year when marked as legitimate, unauthorized reseller (genuine product) or suspicious price; 90 days when marked as noise or not yet marked. The period counts from the last time the listing was seen or marked. If the listing is part of a removal case or legal action, it is kept for 5 years after the end of the case.
Website form contacts without consent to receive news	12 months after submission, if there is no business relationship; then deleted
Website form contacts who agreed to receive news	Until the person asks to opt out
Encrypted summary (hash) of the IP of people who submit a website form	Up to 24 hours
Action log	For the same period as the evidence it refers to

To ask for your website contact to be deleted or to stop receiving news, write to the Data Protection Officer (item 12) at clayton@patentiq.com.br. Deletion is carried out within 15 days and is permanent.

8. Your rights. You may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; information about whom we share it with; review of automated decisions; and objection to processing based on legitimate interest. We will respond within 15 days. Requests about data kept as evidence may be limited when keeping it is necessary for the regular exercise of rights.

9. Automated decisions. Patentiq calculates risk scores using rules and may use artificial intelligence to suggest classifications. Suggestions are confirmed by people before any removal request.

10. Security. We adopt the measures described in our Information Security Policy. On the website forms, the sender's IP address is kept only as an encrypted summary (hash), for up to 24 hours, for the anti-spam submission limit.

11. Children and adolescents. The platform is intended for companies and professionals. We do not knowingly collect data from people under 18.

12. Contact. Data Protection Officer (DPO): Clayton de Souza Silva, clayton@patentiq.com.br. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.

13. Changes. This policy may change as the platform evolves. The version and date are at the top; the version history is at the end of this page.

Version history

Version	Effective from	Change
1.0	10/14/2026	First published version.
1.1	10/14/2026	Thumbnails of found images are now served by the platform itself; a supplier is removed from the list and from the Cookie Policy.
1.2	10/15/2026	The Dashboard now stores the date of the user's last visit to each channel's screens, to show what is new.
1.3	10/15/2026	Takedown service: authorization acceptance, power of attorney, INPI registrations, contacts with third parties and target monitoring; sharing with registrars, providers and platforms; 5-year retention after the case is closed.
1.4	10/15/2026	Takedown: when the brand belongs to another company, the notice also includes the brand owner's company name and CNPJ, provided by the customer.
1.5	10/15/2026	Demo account: data is kept for 60 days after the end of the demo and, if it does not become a contract, is deleted.
1.6	10/16/2026	Demo account: 60-day period after the end of the demo, exception for takedowns in progress and what is kept after deletion.
1.7	10/16/2026	Findings reported by the customer: address, who reported it and the note, kept for the same period as the monitoring results.
1.8	10/16/2026	Public marketplace listings (Mercado Livre and Shopee): data read, purpose, legal basis, public data collection supplier and retention periods; purpose of the last visit to the screens: open the last brand visited.
1.9	10/18/2026	Findings reported by the customer: also the address of a specific page (link), with a sealed capture of the page. The ad click identifier (such as the gclid) stays only inside the sealed capture.
1.10	10/19/2026	Takedown: channels that forward the notice to the reported party or publish it in Lumen; Patentiq notifies with its own name and email; power of attorney and owner's documents sent only to the channel.
1.11	10/20/2026	Demo account: existing customer placed in a demo; deletion also covers earlier data, including data imported from the previous platform. The "Triage" screen is now called "Domains" in the item 3 list.
1.12	10/21/2026	Institutional website patentiq.com.br and its forms (contact, free diagnosis and talk about takedown): data, purposes and legal bases, retention (12 months without consent; until opt-out with consent), how to request deletion, suppliers (aggregate visit measurement, anti-bot check and email delivery) and the encrypted summary of the IP kept for up to 24 hours.
1.13	10/22/2026	Social media monitoring extended to Facebook, TikTok, YouTube, X and public Telegram channels, as each network is activated: public data only, without logging in; on Telegram, never groups or private chats, without keeping the content of channel messages; two new suppliers for searching public profiles and channels.
1.14	10/24/2026	Suppliers are now listed by category; the named list is provided to customers in the contract and to data subjects upon request. The international transfer section details purpose, countries, duration and safeguards.
1.15	10/26/2026	Website's quick domain check: the name typed is used only to query the public DNS of the network and security supplier and is not stored; the IP address is not read.
1.16	10/26/2026	Website forms: we also keep the language in which the form was sent (Portuguese, English or Spanish), to reply in the same language.