Privacy Policy

We collect the information we need to run Obsidyan. What we collect depends on how you use it.

1.1 Information You Provide Directly

• Account Information: Name, email address, password (stored only as a salted hash), and profile details such as company and job title.
• Invention Disclosures: Technical descriptions, interview answers, drawings, and other materials about your inventions.
• Patent Application Data: Claims, specifications, prior art references, office actions, and filing information.
• Voice Input: If you dictate an answer, the audio is sent for transcription and not stored. The transcript becomes part of your answer.
• Communications: Messages, feedback, and support requests you send us.
• Newsletter Signups: The email address you enter to subscribe on our blog, and when you subscribed, confirmed, and unsubscribed. To limit abuse, we also keep a keyed hash of the IP address you signed up from, not the address itself.

1.2 Information Collected Automatically

• Log Data: IP address, browser type, access times, error logs, and referring URLs, recorded by our hosting provider.
• Activity Records: Actions in your account, such as credit use, data exports, and security events.

1.3 Information from Third Parties

• Sign-In Providers: If you sign in with Google or Microsoft through 1Profile, we receive your basic profile information, such as your name and email address.
• Purchases: Our checkout provider, Cred, tells us what you bought and your credit balance. We do not receive or store your full card details.
• Patent Data: Public patent and prior art information from patent offices and public databases.

We use the information we collect for the following purposes:

2.1 Providing and Operating the Services

• Creating and managing your account
• Processing and managing patent applications and invention disclosures
• Providing AI-powered drafting assistance and suggestions
• Conducting prior art searches and analysis
• Generating patent drawings and figures
• Managing filing deadlines and portfolio tracking
• Processing credit purchases

2.2 Improving and Developing Services

• Reviewing logs and support requests to improve the experience
• Identifying and fixing bugs and technical issues
• Developing new features and functionalities

2.3 Communications

• Sending service-related notifications and updates
• Responding to your inquiries and support requests
• Sending deadline reminders and filing alerts
• Sending marketing communications, if you opt in
• Sending our newsletter, if you subscribe and confirm your email address. Every newsletter includes a link to unsubscribe.
• Sending product updates and announcements

2.4 Security and Compliance

• Protecting against fraud, abuse, and security threats
• Enforcing our Terms of Service and other policies
• Complying with legal obligations and regulatory requirements
• Responding to legal requests and court orders

2.5 Personalization

• Customizing your experience based on preferences
• Tailoring AI outputs to your specific needs and context

We process your personal information based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Services you requested and fulfill our contractual obligations.
• Legitimate Interests: Processing for our legitimate business interests, such as improving the Services, preventing fraud, and ensuring security, balanced against your privacy rights.
• Consent: Processing based on your explicit consent, which you can withdraw at any time.
• Legal Obligations: Processing necessary to comply with applicable laws, regulations, and legal processes.

We are committed to protecting your information and only share it in limited circumstances:

4.1 Service Providers

We share information with these providers so they can run parts of Obsidyan for us:

These providers may use your information only to provide their services to us. Cred, 1Profile, and AngelSend are also AW3 Technology products.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Subpoenas, court orders, or legal processes
• Requests from law enforcement or government agencies
• To protect our rights, property, or safety
• To investigate potential violations of our Terms

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

4.4 With Your Consent

We may share your information with third parties when you explicitly consent to or request such sharing.

4.5 What We Do NOT Share

We keep your information for as long as you have an account, and afterward only as long as needed to meet legal obligations, resolve disputes, and enforce our agreements.

5.1 Retention Periods

5.2 Deletion

To delete your account, go to Data Privacy in Settings. We email you a link to confirm, and your account, applications, and files are deleted when you open it. You can also ask us by emailing obsidyan@aw3.tech. Copies of deleted data may remain in provider backups for a limited period before they are permanently removed. Cred keeps your credit balance and purchase records under its own terms; to have them removed, email us.

We protect your information with the following measures. Our Security page has more detail.

• Isolation: Row-level security in the database keeps each customer's data separate.
• Encryption: Data is encrypted in transit with TLS and at rest by our infrastructure providers.
• Private Files: Uploaded files are stored privately and checked against your account on each request.
• Account Protection: Salted password hashes, optional two-factor authentication, and hashed API keys that are read-only by default.

No system is completely secure, and we do not currently hold a SOC 2 report or ISO 27001 certificate. You can help by using a strong, unique password, turning on two-factor authentication, and telling us about any suspicious activity.

Depending on your location, you may have the following rights regarding your personal information:

7.1 Access and Portability

You have the right to a copy of the personal information we hold about you in a machine-readable format. You can export your data from Settings at any time, or ask us for a copy.

7.2 Correction

You can update your profile in your account settings, or contact us to correct anything else.

7.3 Deletion

You can request deletion of your personal information, subject to certain exceptions (such as legal retention requirements or ongoing service needs).

7.4 Restriction of Processing

You can request that we restrict processing of your personal information in certain circumstances.

7.5 Objection

You can object to processing of your personal information based on legitimate interests.

7.6 Withdraw Consent

Where processing is based on consent, you can withdraw your consent at any time without affecting the lawfulness of prior processing.

7.7 Exercising Your Rights

To exercise any of these rights, please contact us at obsidyan@aw3.tech. We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

We use only the cookies and browser storage needed to run Obsidyan. We count page views with Vercel Web Analytics, which doesn't use cookies. We do not use analytics or advertising cookies, and we do not track you across other websites.

Because these are essential, there is nothing to switch off. You can review them at any time from Cookie settings in the site footer, and you can clear them in your browser, which will sign you out.

Our pages load fonts from Google Fonts, so Google receives your IP address when you visit. Google does not set cookies for this. Signed-out visitors also load our support chat from AngelSend, which receives your IP address, and its network may set a short-lived security cookie. We do not respond to Do Not Track signals because we do not track you.

Your information is processed in the United States and in other countries where our service providers operate. These countries may have different data protection laws from yours.

Where European, UK, or Swiss law applies, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses offered by our providers.

The Services are not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe we may have collected information from a child under 18, please contact us at obsidyan@aw3.tech.

Obsidyan may link to or connect with third-party websites and services. This Privacy Policy does not apply to them, so please review their policies before giving them your information.

When you connect a third-party service or AI agent with an API key, it can access the data that key allows. New keys are read-only by default, and you can revoke a key at any time.

12.1 How We Use AI

AI features process the content you submit to produce results such as interview questions, drafts, drawings, and prior art analysis. To do this, we send that content through the Vercel AI Gateway, which only routes it to model providers with zero data retention agreements. Dictated answers are transcribed the same way. Results are saved to your account so you can keep working on them.

12.2 What We Do Not Do

• We do not use your invention or application content to train AI models
• We do not share your application content with other customers
• We do not sell or license your data

12.3 Model Providers

Providers reached through the AI Gateway process your content to produce a result and do not retain it or train on it under their agreements with Vercel. Only submit content you are comfortable having processed this way. If you do not want content processed by AI, do not use the AI features for it. The support chat on our public pages runs on AngelSend rather than the AI Gateway, so the zero data retention above does not cover it. Please do not put invention details in that chat.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

13.1 Right to Know

You have the right to request information about the categories and specific pieces of personal information we have collected, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.

13.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

13.3 Right to Opt-Out of Sale

We do not sell personal information as defined by the CCPA. Therefore, we do not offer an opt-out of sale.

13.4 Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

13.5 Authorized Agents

You may designate an authorized agent to make requests on your behalf. We will require verification of your identity and the agent's authorization.

13.6 Categories of Information Collected

In the past 12 months, we have collected the following categories of personal information:

• Identifiers (name, email, IP address)
• Commercial information (credit purchases)
• Internet or network activity (logs and activity records within our platform)
• Professional information (job title, company)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

14.1 Data Controller

AW3 Technology, Inc. is the data controller for personal information collected through the Services.

14.2 Your GDPR Rights

In addition to the rights described in Section 7, you have the right to:

• Lodge a complaint with your local data protection authority
• Receive information about our data processing activities
• Object to automated decision-making and profiling

14.3 Privacy Contact

For GDPR-related inquiries, contact us at obsidyan@aw3.tech.

14.4 Supervisory Authority

You have the right to lodge a complaint with a supervisory authority in your country of residence if you believe we have violated your privacy rights.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

15.1 Notification of Changes

We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last updated" date
• Sending an email notification to registered users for significant changes

15.2 Review and Acceptance

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

If you have questions or requests about this Privacy Policy, please contact us: