Data Processing Framework (GDPR Art. 28)

Last updated: August 17, 2026

This page describes the platform's current processing framework. It is not a signature receipt and does not by itself prove that a Data Processing Agreement has been executed. A separately concluded DPA and its documented instructions control where they differ from this summary.

Parties & Roles

When a customer determines why and how personal data is submitted to Patentopia, that customer is the data controller and Patentopia.AI ApS is the data processor for that customer data.

Under Patentopia's separate platform-development arrangement, Patentopia.AI ApS is the controller and Seven Consult ApS is its processor. Seven Consult therefore operates as a subprocessor in the customer-facing chain when it handles customer personal data for the platform. The signed agreement or DPA for the relevant relationship remains the authoritative role record.

Subject-Matter, Duration & Purpose

Processing supports account access, patentability-assessment inputs, prior-art retrieval, OCR and translation when used, structured analysis, report generation, payment handling, transactional communication, security, and support. Processing continues for the service relationship and the applicable retention period, or until earlier erasure, return, or termination requires deletion.

Submitted claim text and documents are used to provide the requested service. They are not used to train a shared Patentopia model.

Types of Data & Data Subjects

  • Account data — email address, authentication, and session metadata.
  • Submitted content — patent claims, descriptions, prior art, and uploads, which may incidentally identify inventors or other people.
  • Assessment data — approvals, evidence records, analysis results, reports, and audit events.
  • Billing and operational data — payment references, service usage, cost events, and security metadata.

Processor Obligations

The processor acts only on documented controller instructions, binds authorized personnel to confidentiality, applies appropriate technical and organizational measures, assists with data-subject requests and Articles 32–36 obligations, reports personal-data breaches without undue delay, makes compliance information available, and supports proportionate audits.

Subprocessors & External Processing Services

Depending on the configured assessment path, Patentopia uses the following service providers. The executed DPA must contain the approved legal entities, purposes, locations, and transfer mechanisms for the relevant account.

  • Seven Consult ApS — platform operation and development.
  • Supabase — database, authentication, and storage services.
  • Vercel — hosting and serverless runtime.
  • OpenRouter — model routing and inference.
  • OpenAI — embeddings and configured model services.
  • Google Cloud — patent-data queries and OCR when configured.
  • Bright Data — proxied prior-art search retrieval when configured.
  • European Patent Office (EPO OPS) — patent bibliographic and prior-art retrieval.
  • Crossref — scholarly-literature metadata retrieval.
  • Stripe — payment processing.
  • Resend — transactional email delivery.

Controllers must be informed of intended additions or replacements and given the opportunity to object in accordance with the executed DPA.

Security Measures

  • Encryption — TLS in transit, provider-managed encryption at rest, and application-layer case encryption on supported case paths.
  • Access control — authentication, owner and organization checks, row-level security, and fail-closed service boundaries.
  • Logging — approvals and privileged actions are recorded; raw claim or document content must not be written to operational logs.
  • Provider controls — model-provider retention or zero-retention status is treated as a configuration and account receipt, not assumed from product wording.

Current Retention & Deletion

Anonymous assessment data is automatically deleted 24 hours after submission. Authenticated assessments that remain incomplete and are not direct-payment cases, including credit-funded assessments, are deleted 30 days after their last recorded update. Completed assessments and direct-payment cases are deleted 24 months after their last recorded update, unless erased sooner.

Account erasure removes case content and derived assessment data. Legally required accounting records follow separate retention obligations and are separated or anonymized where possible. On termination, the executed DPA must specify return or deletion, backup expiry, and any mandatory legal exception.

International Transfers

Transfers outside the EU/EEA require the mechanism documented for the relevant provider and account, such as an adequacy decision or applicable Standard Contractual Clauses with supplementary measures. A provider privacy page or a general “no training” statement is not treated as a transfer receipt.

Contact

To request the applicable DPA, exercise a data right, or ask about processing, contact info@patentopia.ai.