Privacy Policy

Last Updated: October 23, 2026

This Privacy Policy explains how Crinoid Technologies Pvt. Ltd. ("Company", "IPR Manager", "we", "our", or "us") collects, uses, stores, processes, shares, protects, retains, and deletes information when you access or use IPR Manager and related services.

This Policy applies to the website, software platform, subscription features, account areas, organization workspaces, client portal, optional IPO Autofill Chrome browser extension, billing flows, support channels, communications, hosted infrastructure, and related services made available by IPR Manager (collectively, the "Services"). It should be read together with the Terms and Conditions and the Refund and Cancellation Policy.

By accessing, registering for, subscribing to, inviting others to, paying for, or otherwise using the Services, you agree to the collection and processing of information as described in this Privacy Policy. If you do not agree, you must not use the Services.

1. Company Information

IPR Manager is operated by Crinoid Technologies Pvt. Ltd., with its registered office at Plot 81-B, New Rishi Nagar, Hisar, Haryana, 125001, India.

For privacy, account, support, security, or grievance-related communication, you may write to support@iprmanager.com. For billing, subscription, invoice, payment, or refund-related communication, you may write to billing@iprmanager.com.

2. Scope and India-Primary Processing

The Services are intended primarily for use in India by patent practitioners, law firms, companies, organizations, and clients who need a structured workspace for Indian Patent Office workflows. Your information will primarily be stored and processed in India where our production infrastructure and configuration support that processing.

Some third-party providers that support the Services, including cloud infrastructure, authentication, payment, analytics, monitoring, communication, and support providers, may process limited information or operational metadata according to their own infrastructure, legal obligations, and service terms. Where such processing involves transfer or access outside India, we rely on the provider's contractual, technical, and legal safeguards and process information only as reasonably necessary for the Services.

3. Information We Collect

We collect information that you provide directly, information generated through your use of the Services, information created by other authorized users in your organization or client relationship, and information received from service providers such as payment processors or authentication systems.

Account information may include your name, email address, phone number, password or authentication credential references, role, organization name, firm details, professional details, account status, onboarding choices, workspace type, plan information, preferences, and settings. Where the product requires organization setup, we may collect organization legal name, billing email, billing contact name, entity type, optional GSTIN, state or region, country, optional postal address fields used for IPO-related correspondence, membership details, invite status, owner identity, administrator status, and member role information.

For solo subscription billing, we may store your billing address, billing state or region, billing country, optional company or firm name for invoice display, and optional GSTIN on your user profile, in addition to your name and sign-in email.

Billing and subscription information may include selected plan, billing period (monthly or yearly prepaid for solo accounts), number of team seats on Firm plans, subscription status, trial dates, renewal dates, cancellation status, payment references, transaction identifiers, invoice or tax information, GST-related information, refund requests, failed-payment status, and records from our payment partners. See also the Billing and tax invoice template for how customer identity on tax invoices ties to these profiles. Card and UPI details are handled by payment providers — we do not store full card numbers or full UPI credentials in IPR Manager.

User Content may include patent-related records, case titles, application numbers, patent numbers, filing dates, priority dates, statuses, form records, milestone records, renewal records, hearing details, agent profiles, applicant and inventor information, client information, notes, uploaded documents, generated documents, attachments, import files, import results, communications, invoices, contracts, confidential invention information, business records, and any other material submitted to or generated through the Services. You are responsible for ensuring that you have authority to upload, store, and share this information.

Usage and technical information may include login activity, session activity, route and page usage, feature usage, browser type, device information, operating system, IP address, approximate location derived from technical data, timestamps, referral information, cookie or local storage identifiers, error reports, crash reports, performance data, security logs, audit logs, and other operational metadata needed to run, secure, and improve the Services.

Client portal access information may include invite email address, invite token status, linked case references, account claim status, client sign-in activity, documents made visible to the client, download activity where logged, and limited interaction data related to client access. Client portal users receive only the limited view chosen by the staff user or organization, but we may process access records to provide, secure, and audit that access.

Connected mailbox (email sync)

If you enable Email sync (Professional and Firm plans), an authorised staff user may connect a firm Google Workspace / Gmail or Microsoft 365 mailbox that receives Indian IP prosecution notices.

What we access: Read-only mailbox access limited to messages we can match to trusted IPO sender addresses (and any additional allowlist your admin configures). We process message metadata (sender, subject, received time), a short text snippet (typically up to about 2 KB), and fields extracted by deterministic templates (for example application number, hearing date, notice type). We do not index or store your full inbox.

What we do not store in Firestore: OAuth refresh tokens or access tokens. Tokens are stored in Google Secret Manager and used only by server-side sync jobs.

How we use it: To create or update Watchtower review items and related case workflow data so your team can approve or dismiss detected prosecution events inside IPR Manager.

Retention: Connection-scoped sync logs and unparsed message snippets are deleted when you disconnect the mailbox. Case records and Watchtower events already applied or saved on a matter remain as part of your portfolio data.

Third parties: Google and Microsoft act as processors for mailbox API access under their respective terms. Our use of Google user data complies with the Google API Services User Data Policy, including Limited Use requirements.

Your responsibility: You must have authority to connect the mailbox and to process prosecution mail that may contain client or applicant personal data. Provide any notices your firm requires to clients and staff.

IPO Autofill (Chrome extension)

If you install IPR Manager — IPO Autofill from the Chrome Web Store (or an internal build we provide), the extension is part of the Services for authorised staff users only. Client portal accounts cannot sign in through the extension.

Host access: The extension is designed to interact only with the official Indian Patent Office e-filing origins https://ipronline.ipindia.gov.in/ (patents and designs) and https://ipindiaonline.gov.in/ (trade marks). It does not request access to other websites and does not read or modify pages outside those hosts.

What we access on the portal: When you use autofill, copy assist, or preflight, the extension may read form fields and related page elements on an open IPO e-filing tab so it can compare or transfer values you initiate. Product rules are intended to avoid overwriting portal values you have already entered unless you run an explicit fill action that targets empty fields.

What we retrieve from IPR Manager: After staff sign-in, the extension calls our authenticated APIs to load configuration, search cases you are permitted to see, and retrieve a limited case snapshot (allowlisted fields for the form you are working on). The extension does not include a direct database client to your case data and does not bypass server-side access controls.

Local storage: The extension may store sign-in session state, a remembered email address for convenience, UI preferences (for example whether to show empty fields), a temporarily selected case, and cached support-directory metadata in Chrome extension storage on your device.

Support reports: If you choose Add support for an unsupported portal page, we may receive the page host, path, an optional note you provide, and sanitised form structure metadata (for example select options and field labels) to improve coverage. We do not intentionally collect your portal password or payment credentials through this flow.

AI field matching: If you choose Try AI fields on a portal page we do not yet support, the same sanitised form structure metadata is sent to our backend and processed by our AI provider so that the page's fields can be matched to the case fields available to you. The case values themselves are not sent — the request contains the names of available case fields and the page's structure, not your case data, and values are filled locally on your device only after you review the proposed matches. The resulting field match is stored against that portal page and reused for other users of the Services, because it describes a public government form and contains no case or client data. Values you have already typed into the page are stripped before the metadata leaves your browser. See AI Features and Data Processing for our general AI processing terms.

Clipboard: If you use copy assist, the extension may write field values to your clipboard when you click copy.

Third parties: The extension uses Google Firebase (authentication and cloud functions) as described elsewhere in this Policy. Google Chrome and the Chrome Web Store are provided by Google under their own terms.

Your responsibility: You must have authority to sign in, select cases, and transfer case data into government forms. Verify every value on the portal before submission. The government portal remains the system of record.

AI Features and Data Processing

If you use AI-assisted features (such as AI Patent Drafting, claims expansion, invention brief extraction, Desk AI suggestions, response drafting, quality checks, or text enhancement), we process the inputs you submit to generate AI outputs for your portfolio matters.

What we process: When you invoke an AI action, we process the text, documents, notes, claims, specification sections, and metadata you provide for that specific request (collectively, "AI Prompts").

Zero AI Training on Your Data: Your AI Prompts, invention disclosures, technical briefs, claims, specifications, client records, and generated outputs are NEVER used to train, retrain, or fine-tune any foundation, public, or third-party AI models. We enforce enterprise agreements with our AI infrastructure providers that contractually guarantee zero data retention for model training purposes.

No Data Selling or Monetization: We do not sell, rent, license, or monetize your AI Prompts, disclosure materials, or generated outputs to advertisers, data brokers, or AI developers. Data processed by AI features remains your confidential property and is processed solely to fulfill your requested AI operations.

Security and Encryption in Transit: All communications with AI endpoints are conducted over encrypted TLS 1.3 channels. AI processing occurs on secure enterprise infrastructure, and generated outputs are stored directly in your workspace database or encrypted document vault governed by your firm's role-based access controls.

Where AI Processing Happens: AI features run on Google Cloud Vertex AI. Most AI requests are processed in Google's Mumbai (India) region. Some advanced drafting features — claim generation and the claims Desk AI, specification section drafting, FER response drafting, and hearing briefs and written submissions — use models that Google serves only from its global endpoint, so the content of those requests may be processed outside India. Outputs are returned to and stored in your workspace as described above.

AI Usage Metrics: We log operational metadata regarding AI feature usage (such as action type, token counts, timestamps, and credit consumption) solely for metering billing allowances, managing AI credit balances, auditing platform usage, and technical troubleshooting.

Human Oversight & Professional Responsibility: AI features produce preliminary automated drafts intended exclusively for professional review. AI outputs are not automatically submitted to government registries or third parties without explicit user verification and action.

4. How We Use Information

We use information to provide, operate, maintain, secure, troubleshoot, and improve the Services. This includes creating and authenticating accounts, provisioning solo or organization workspaces, managing roles and permissions, showing case data, calculating and displaying deadlines, generating or storing documents, providing AI-assisted drafting and Desk AI features, supporting client portal access, sending service emails, handling billing, processing subscriptions, maintaining ledgers, reconciling payment status, responding to support requests, and enforcing access controls.

We use information to communicate with you about the Services. This may include account notices, onboarding emails, organization invites, client portal invites, subscription status, payment issues, trial reminders, account deletion reminders, security notices, support responses, product updates, and legally required notices. Product email settings may allow you to disable certain optional digest or preference-based messages, but those settings do not necessarily disable transactional, billing, security, legal, or account-critical communication.

We use information to protect the Services and users. This includes detecting abuse, fraud, unauthorized access, credential compromise, malicious activity, payment abuse, duplicate trial abuse, security incidents, data-integrity issues, operational failures, and Terms violations. We may use logs, audit trails, payment records, access records, and diagnostic information for investigation, prevention, support, and compliance.

We use information to improve functionality and user experience. This may include understanding which features are used, identifying bugs, measuring onboarding and subscription flows, improving performance, prioritizing roadmap work, reviewing support patterns, and generating aggregated or anonymized insights. We do not sell personal information.

We may also process information to comply with law, respond to legal process, enforce our agreements, protect rights and safety, resolve disputes, maintain tax and accounting records, manage corporate transactions, and satisfy legitimate business needs.

Where applicable, we process information based on your consent, the need to perform a contract with you, the need to provide the Services you requested, compliance with legal obligations, legitimate business interests, fraud prevention, security, dispute resolution, billing operations, and protection of rights.

By using the Services, uploading information, inviting users, sharing documents, approving payment mandates, or providing information about other people, you represent that you have the authority and lawful basis to do so. If you disclose personal data relating to clients, inventors, applicants, agents, employees, organization members, or other individuals, you are responsible for ensuring that the disclosure and processing are lawful and that any required notices or consents have been obtained.

You may withdraw consent by contacting us, subject to verification and applicable law. Withdrawal of consent may affect our ability to provide features that require the relevant information. It may not affect processing already completed, processing required by law, billing records, security records, dispute records, or processing based on another lawful basis.

6. Analytics and Product Usage Measurement

We may use Google Analytics 4 (GA4) and similar analytics tools to measure anonymous and aggregated usage of the Services. Analytics may help us understand which pages are visited, which features are used, how signup and onboarding flows perform, how subscription funnels behave, and where users experience friction.

We do not intentionally send your name, email address, case content, case identifiers, organization identifiers, party names, user-typed notes, uploaded documents, or confidential case data to GA4. GA4 may set or use a first-party browser identifier, such as a client ID, to count repeat visits and understand aggregate product usage. We do not use that identifier as your account identity.

Anonymous analytics may be collected from the moment you visit the public platform, including before sign-in, so that we can measure landing page, signup, and onboarding performance. After you sign in, where the product provides the setting, you can disable product analytics for your account from Settings -> Privacy -> "Share anonymous usage data with IPR Manager." The change is intended to take effect promptly and be preserved across devices for that signed-in account.

On our public marketing pages (such as the home, pricing, signup, demo, tools and blog pages), we also use the Meta Pixel to measure the performance of our advertising on Facebook, Instagram and WhatsApp. The Meta Pixel is loaded only after you allow advertising cookies in the banner shown on those pages; if you choose "Not now", or make no choice, it is not loaded. You can change your choice at any time from "Cookie settings" in the website footer. The Meta Pixel may set cookies and send Meta technical information such as the page visited, browser and device details, and whether a signup, demo request or subscription occurred. We do not load the Meta Pixel inside the signed-in application, and we do not send case content, case identifiers, client details or uploaded documents to Meta. Meta processes this information under its own terms and privacy policy. The analytics setting described above also turns off the Meta Pixel for your signed-in account.

Analytics preferences are separate from operational diagnostics, security logging, billing records, and legally required records. Disabling product analytics does not disable the processing that is necessary to provide, secure, troubleshoot, bill, or operate the Services.

7. Crash Reports and Operational Diagnostics

Independent of optional analytics settings, we may collect operational diagnostics such as application crashes, error stacks, route patterns where an error occurred, release version, browser and device details, timestamps, and related technical context. We use this information to detect, investigate, and fix bugs, reliability issues, and security problems.

Operational diagnostics are intended to be scrubbed of personal data on the client and on the server before storage where the product supports that scrubbing. Diagnostics are accessible only to personnel or service providers who need them for engineering, security, support, or operational purposes. We do not use diagnostics to sell personal data or to build advertising profiles.

8. Cookies, Local Storage, and Similar Technologies

The Services may use cookies, local storage, session storage, browser storage, analytics identifiers, and similar technologies to maintain sessions, remember preferences, preserve form drafts, route users after login, store invite tokens through authentication, secure accounts, measure aggregate usage, and improve performance.

You may adjust your browser settings to block or delete cookies and storage. Some features may not work correctly if you disable these technologies. For example, login sessions, draft preservation, invite redirects, analytics preferences, or other product behavior may be affected.

We share information only as reasonably necessary to provide, operate, secure, bill, support, improve, or legally protect the Services. We do not sell user personal data to advertisers.

We may share information with cloud infrastructure providers, Firebase and Google Cloud services, authentication providers, payment gateways, payment processors, payment-related infrastructure, banks, card networks, or UPI participants where needed for payment processing, email and communication providers such as Resend, analytics providers such as GA4, monitoring and error-reporting providers, customer support tools, professional advisors, tax or accounting service providers, and other vendors that support platform operations.

We may share information with organization administrators, organization owners, staff users, members, or client portal users according to the access controls and sharing choices made inside the product. For example, administrators may see who has been invited and who is on the team; staff users may share selected case documents with a client; and the organisation owner may see billing and subscription details. You and your organization are responsible for managing those permissions appropriately.

We may disclose information to courts, government authorities, law enforcement, regulators, or other third parties where required by law, legal process, contractual enforcement, fraud prevention, security protection, dispute resolution, or protection of rights, property, users, the public, or the Company.

If the Company is involved in a merger, acquisition, financing, restructuring, sale of assets, insolvency, or similar corporate transaction, information may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards where applicable.

10. User Content and Confidential Information

User Content may include confidential business, legal, technical, client, inventor, applicant, patent, or invention-related information. We process User Content to provide the Services and do not claim ownership of it. The Terms and Conditions describe the limited license you grant us to host, store, process, transmit, back up, secure, and use User Content as needed to operate the Services. Where User Content is processed through AI features (such as AI drafting, claims expansion, or deskAi prompts), it is governed strictly by our Zero AI Training commitment and enterprise non-retention safeguards.

You are responsible for deciding what information to upload, whether the information is accurate, whether it is confidential or privileged, whether you have authority to process it, and which users or clients should receive access. We do not independently verify whether a document should be shared with a client, whether an inventor record is complete, whether a case field is correct, or whether a document contains privileged or sensitive material.

We may access User Content in limited circumstances where reasonably necessary for technical support, maintenance, abuse investigation, security review, operational administration, legal compliance, migration, backup, or infrastructure management. Internal access is intended to be limited to personnel with a need to know.

11. Security Practices

We implement commercially reasonable technical and organizational safeguards intended to protect information and platform integrity. These safeguards may include authentication controls, access restrictions, role-based authorization, transport encryption, infrastructure protections, monitoring systems, audit logs, operational security measures, error reporting, abuse detection, and provider-level security features.

No platform can be guaranteed completely secure. No storage, transmission, authentication, access-control, monitoring, backup, or encryption system is immune from compromise, misuse, error, or interruption. By using the Services, you accept the inherent security risks of internet-based services and cloud infrastructure.

You are responsible for maintaining strong credentials, controlling user access, managing organization permissions, reviewing client sharing decisions, protecting devices, avoiding credential sharing, maintaining independent backups, and promptly reporting suspected unauthorized access or security incidents.

For technical security controls, document encryption, and infrastructure detail, see our Security page. Case document encryption metadata in Firestore does not include plaintext encryption keys; wrapped keys are usable only by server-side decryption.

12. Data Retention

We retain information only as long as reasonably necessary for the purposes described in this Policy, including platform operations, account management, subscription and billing, support, legal compliance, tax and accounting, dispute resolution, fraud prevention, security, backups, audit, product improvement, and legitimate business needs.

Different categories of information may have different retention periods. Active case data and User Content may be retained while your account or organization workspace remains active. Billing ledger records, subscription records, payment-provider references, webhook records, invoices, tax records, security logs, audit records, support history, and dispute records may be retained for longer where required or reasonably necessary. Aggregated or anonymized analytics may continue to exist after account deletion.

Backups and residual copies may persist temporarily after information is deleted from active systems. We are not obligated to restore deleted information after the applicable retention period expires or after deletion has been completed according to product behavior and legal requirements.

13. Account Deletion and Data Removal

Where the product provides self-serve deletion, eligible staff users may start a deletion request from Settings. For a solo practitioner workspace, the signed-in account holder may be eligible to start the request. For an organization workspace, only the organization owner may start the deletion request under the current product policy. Other administrators and members cannot start or cancel organization deletion unless the product is changed to permit it.

A deletion request begins a thirty (30) day grace period before permanent removal of in-scope workspace data. During the grace period, the requester may be able to cancel the request where the product provides that control. Normal use of the Services may be restricted during the grace period, including through a dedicated pending-deletion screen or frozen workspace behavior. If an organization owner requests deletion, other staff in that organization may also experience restricted access until the request is cancelled or the grace period completes.

After the grace period, and subject to legal and operational exceptions, we may delete or remove application data associated with the deleted user account or workspace according to the product's implemented rules. For a typical solo account, this may include cases not tied to a shared organization workspace, related deadline rows, party records that exist only as part of those cases, solo agent profiles, import job records created by that user, the user's AI conversations, AI job records, saved AI instructions and AI review history, and AI-generated material (such as claim sets, specification drafts, invention briefs and FER analyses) for the solo cases being deleted. AI-generated material on organization cases belongs to the organization workspace and is not removed when one member's account is deleted.

Organization workspaces follow the product's implemented organization deletion rules. The organization, its cases, members, billing records, and related data may be treated differently depending on owner status, remaining active members, pending deletion state, legal obligations, and product capabilities. Self-serve leave organization and ownership transfer are not available in the current version unless and until expressly added, so some organization exit or succession situations may require administrator or support-assisted handling.

We may retain certain billing, subscription, ledger, webhook, payment, invoice, tax, accounting, server-side operational, audit, security, support, dispute, fraud-prevention, and legal records even after your user profile and in-scope application data are removed. We may also retain aggregated or de-identified analytics. This retention may be necessary for legal obligations, tax compliance, accounting, dispute resolution, fraud prevention, security, support, audit, or legitimate business purposes.

You are responsible for exporting or saving material you require before access ends. Third-party payment mandates may need to be cancelled, limited, or re-established depending on provider behavior and account state. If you cancel a deletion request after payment authorization has been affected, follow in-app billing guidance or contact support.

14. User Rights and Requests

You may access, correct, and update certain account information directly through the product where available. You may also contact us to request access, correction, deletion, restriction, withdrawal of consent, or other privacy-related assistance, subject to verification, product behavior, contractual obligations, legal requirements, and applicable law.

You may request a copy of your case data and related account information held in the Services by writing to support@iprmanager.com. Data export is available on request. A fee applies; we will confirm the amount before we start work. We will verify that the request comes from you or from someone authorised to act for your organisation, and we will use reasonable efforts to provide the information in a usable format within a reasonable time after any required payment. Export requests are best made while your account is still active and before you start account deletion. After deletion is completed, recovery may not be possible except where law or our retention rules require us to keep copies.

We may refuse, limit, or delay a request where we cannot verify your identity or authority, where the request conflicts with legal obligations, where information must be retained for billing, tax, accounting, security, fraud prevention, dispute resolution, or legal reasons, or where deletion would affect another user's rights or an organization workspace.

If you are an organization member or client portal user, some information may be controlled by the organization or staff user that invited you. In those cases, we may direct you to the relevant organization administrator or staff user, or we may handle the request in coordination with them where appropriate.

15. User Responsibilities

You are responsible for maintaining credential confidentiality, controlling account access, managing organization permissions, ensuring lawful uploads, obtaining required consents, reviewing client sharing decisions, maintaining backups, and avoiding unauthorized disclosure of sensitive information.

Organizations are responsible for managing access granted to employees, administrators, members, contractors, agents, and client portal users. Staff users are responsible for ensuring that client invitations, shared documents, linked cases, and downloaded records are appropriate and lawful.

If you receive a message from anyone claiming to represent IPR Manager or Crinoid Technologies Pvt. Ltd. and asking for passwords, OTPs, card PINs, UPI PINs, or other highly sensitive credentials, do not provide that information. Report suspicious requests promptly to support@iprmanager.com and to appropriate authorities where necessary.

16. Third-Party Links and Services

Our optional IPO Autofill Chrome extension is part of the Services and is described in the IPO Autofill (Chrome extension) section above.

The Services may also contain links to third-party websites, provider pages, payment pages, UPI or bank interfaces, other browser extensions not operated by us, document viewers, or other external services. We are not responsible for third-party content, systems, privacy practices, security practices, outages, policies, or processing. You should review third-party terms and privacy policies before using those services or disclosing information to them.

17. Children's Privacy

The Services are not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided information to us, contact support@iprmanager.com so that we can review the matter.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, product behavior, service providers, data practices, security practices, or business requirements. Updated versions become effective when posted on the Platform or otherwise notified, unless a later effective date is stated.

Your continued use of the Services after an updated Policy takes effect constitutes acceptance of the updated Policy. If you do not agree, you must stop using the Services and, where applicable, cancel your subscription according to the product flow.

19. Grievance Officer

For privacy-related grievances, concerns, or requests, you may contact the Grievance Officer:

Name: Shubham Designation: Grievance Officer Address: Plot 81-B, New Rishi Nagar, Hisar, Haryana, 125001, India Email: support@iprmanager.com Phone: +91 78147 92998 Contact hours: Monday - Friday, 10:00 - 18:00 IST

Case archive: Archiving a case is a visibility state, not erasure. Archived case records remain stored while your workspace is active. Client portal users may lose access to archived cases until a staff user restores them.