Privacy Policy

Effective Date: 02/08/2026 

Crafted IP LLC (“Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services. By accessing or using our website, services, or communications, you agree to the terms of this Privacy Policy.

1. INFORMATION WE COLLECT

We may collect:

• Personal Information: Name, email address, phone number, billing details, and other identifiers you voluntarily provide.
• Technical Information: IP address, browser type, operating system, device identifiers, and usage data.
• Business Information: Invention disclosures, documents, or communications you choose to share with us.
  

2. HOW WE USE INFORMATION

We use information solely for:

• Providing and improving our patent services.
• Communicating with you about your account, projects, or inquiries.
• Complying with legal and regulatory obligations.
• Protecting against fraud, abuse, or misuse of our services.
• Assisting in patent drafting and research through the use of secured, professional-grade Artificial Intelligence tools, as disclosed in our Engagement Agreements.
  

3. DISCLOSURE OF INFORMATION

We do not sell your information. We may disclose information only:

• To trusted service providers who assist in operations (bound by confidentiality obligations).
• As required by law, regulation, or court order.
• To protect our rights, safety, or property.
• To the USPTO and governmental patent offices for patent filings and prosecution.

4. DATA SECURITY

4.1 Overview

We implement commercially reasonable administrative, technical, and physical safeguards to protect your information, including encryption of data in transit and at rest, access controls, and regular security assessments. However, no electronic system is completely secure.

To the fullest extent permitted by law, we shall not be liable for unauthorized access, disclosure, or loss resulting from circumstances beyond our reasonable control, including but not limited to third-party cyberattacks, hacking, or security breaches, provided we have implemented and maintained the commercially reasonable safeguards described above.

This limitation does not apply to liability arising from our gross negligence or willful misconduct.

4.2 Technical Security Measures

We implement the following security measures:

(a) Encryption

• Data in transit: TLS/SSL encryption (HTTPS)
• Data at rest: Encryption for sensitive files and databases
• Email: Encrypted email options available for confidential communications

(b) Access Controls

• Role-based access controls (RBAC)
• Multi-factor authentication (MFA) for administrative access
• Strong password requirements
• Regular access reviews and revocation

(c) Network Security

• Firewalls and intrusion detection systems
• Regular security updates and patches
• Network segmentation where applicable

(d) Data Backup

• Regular automated backups
• Encrypted backup storage
• Tested disaster recovery procedures

(e) Monitoring and Logging

• Security event logging
• Regular review of access logs
• Anomaly detection

4.3 Administrative Security Measures

(a) Staff Training

• Regular privacy and security training
• Confidentiality agreements with all personnel
• Limited access based on job functions

(b) Policies and Procedures

• Written information security policy
• Incident response plan
• Vendor management procedures

(c) Regular Assessments

• Annual security risk assessments
• Third-party security audits (as appropriate)

4.4 Physical Security

For physical documents and devices:

• Secure storage (locked filing cabinets, secure facilities)
• Clean desk policy
• Secure disposal (shredding, device wiping)

4.5 Disclaimer and Limitations

Despite our security measures:

(a) No Security is Absolute No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

(b) User Responsibility You are responsible for:

• Maintaining the confidentiality of account credentials
• Using strong, unique passwords
• Reporting suspicious activity promptly
• Securing your own devices and networks

(c) Limitation of Liability To the fullest extent permitted by law, we shall not be liable for unauthorized access, disclosure, or loss resulting from circumstances beyond our reasonable control, provided we have implemented and maintained the security measures described above. This limitation does not apply to liability arising from our gross negligence or willful misconduct.

5. DATA RETENTION

We retain personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law.

Retention Periods:

(a) Website Visitors (No Account/Service)

• Analytics data: Maximum 26 months (then automatically deleted)
• IP addresses: Anonymized immediately; logs retained up to 90 days
• Contact form submissions: Until inquiry resolved plus 1 year

(b) Prospective Clients (Consultation Only)

• Consultation records: 3 years from last contact
• Correspondence: 3 years from last contact

(c) Active Clients (Engagement Agreement)

• Client files and records: Duration of engagement plus 7 years
• Billing and tax records: 7 years (IRS requirement)
• Invention disclosures: Duration of engagement plus 7 years (retention is subject to 37 CFR § 11.18, which requires patent practitioners to maintain copies of documents presented to the USPTO)
• Correspondence: Duration of engagement plus 7 years

(d) Former Clients

• Essential records: 7 years after engagement ends
• Tax and financial records: 7 years (legal requirement)
• After retention period: Securely deleted or anonymized

(e) Legal Holds and Exceptions If litigation, governmental investigation, or audit is pending or reasonably anticipated, we may retain data beyond the standard retention period until the matter is resolved.

Deletion Methods:

When data is deleted, we use secure deletion methods including:

• Overwriting electronic data multiple times
• Physical destruction of storage media when decommissioned
• Anonymization where deletion is not feasible

Archival Exceptions:

We may retain one archival copy of certain records for:

• Professional liability insurance purposes
• Defense against claims or complaints
• Compliance with USPTO professional obligations under 37 CFR § 11.18

This archival copy remains subject to confidentiality obligations.

Important Note Regarding Deletion Requests:

While we honor deletion requests where legally permissible, certain records must be retained to comply with USPTO Rules of Professional Conduct (37 CFR § 11.18) and other legal obligations. We will explain any limitations on deletion when responding to your request.

6. YOUR RIGHTS

6.1 Applicability and Voluntary Compliance

While Crafted IP LLC may not meet the statutory thresholds requiring compliance with certain international or out-of-state privacy laws (such as GDPR or CCPA revenue and data volume requirements), we provide the rights described below to our users as a matter of best practice and commitment to privacy.

6.2 California Consumer Privacy Act (CCPA) Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

(a) Right to Know You may request disclosure of:

• Categories of personal information we collect
• Categories of sources from which we collect personal information
• Business or commercial purposes for collecting personal information
• Categories of third parties with whom we share personal information
• Specific pieces of personal information we have collected about you

(b) Right to Delete You may request deletion of personal information we have collected from you, subject to certain exceptions under law (such as legal compliance, fraud prevention, or completing transactions).

(c) Right to Opt-Out of Sale We do NOT sell personal information. However, you have the right to opt out if our practices change in the future.

(d) Right to Non-Discrimination We will not discriminate against you for exercising your CCPA rights, including by:

• Denying goods or services
• Charging different prices or rates
• Providing a different level of quality
• Suggesting you will receive different pricing or quality

(e) Right to Correct You may request correction of inaccurate personal information we maintain about you.

(f) Right to Limit Use of Sensitive Personal Information If we collect “sensitive personal information” as defined by CCPA (such as precise geolocation, financial account information, or contents of communications), you may request that we limit its use to certain purposes. Currently, we do not collect sensitive personal information beyond what is necessary for providing patent services.

How to Exercise Your Rights:

Submit requests via the contact page on our website or by email using the contact information in Section 16. We will respond within 45 days (extendable by 45 days if necessary). You may designate an authorized agent to make requests on your behalf by providing written authorization.

Verification Process:

To protect your privacy, we will verify your identity before fulfilling requests. We may request additional information to verify your identity, such as:

• Name and email address
• Account information (if applicable)
• Description of your relationship with us (client, website visitor, etc.)

We will only use information provided for verification purposes.

No Sale of Personal Information:

We do not and will not sell your personal information to third parties for monetary consideration. We have not sold personal information in the preceding 12 months.

Categories of Personal Information Collected (Last 12 Months):

• Identifiers (name, email, phone number, IP address)
• Commercial information (services requested, invoices)
• Internet activity (website usage via analytics)
• Professional information (invention disclosures, technical documents)
• Inferences (user preferences, interests)

Sources of Personal Information:

• Directly from you (forms, email, consultations)
• Automatically (website analytics, IP addresses)

Business Purposes for Collection:

• Providing patent services
• Communicating about projects and inquiries
• Improving website and services
• Legal compliance and fraud prevention

Categories of Third Parties with Whom We Share Information:

• Service providers (analytics platforms, payment processors, cloud storage providers, email service providers, website hosting providers, AI service providers)
• USPTO and governmental patent offices (for patent filings)
• Professional advisors (legal, accounting, insurance, as needed)

6.3 General Data Protection Regulation (GDPR) Rights

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the GDPR:

(a) Right of Access (Article 15) You have the right to request a copy of the personal data we hold about you.

(b) Right to Rectification (Article 16) You may request correction of inaccurate or incomplete personal data.

(c) Right to Erasure / “Right to be Forgotten” (Article 17) You may request deletion of your personal data in certain circumstances, such as:

• The data is no longer necessary for the purposes collected
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The data was unlawfully processed
• Erasure is required for legal compliance

Exceptions apply where we must retain data for legal obligations (including USPTO professional obligations under 37 CFR § 11.18), defending claims, or exercising legal rights.

(d) Right to Restriction of Processing (Article 18) You may request that we limit how we use your personal data in certain situations.

(e) Right to Data Portability (Article 20) You have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as CSV or JSON) and transmit it to another controller.

(f) Right to Object (Article 21) You may object to processing of your personal data based on legitimate interests or for direct marketing purposes.

(g) Right to Withdraw Consent (Article 7) Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

(h) Right Not to be Subject to Automated Decision-Making (Article 22) You have the right not to be subject to decisions based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you. We do not engage in such automated decision-making.

(i) Right to Lodge a Complaint You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or place of alleged infringement.

Legal Basis for Processing (GDPR Article 6):

We process personal data under the following legal bases:

• Consent: When you provide explicit consent (e.g., for marketing communications)
• Contract: To perform our obligations under engagement agreements
• Legal Obligation: To comply with USPTO requirements (37 CFR § 11.18), tax laws, and other regulations
• Legitimate Interests: To improve our services, prevent fraud, and operate our business (balancing your rights with our interests)

International Data Transfers:

If you are located outside the United States, your information may be transferred to and processed in the U.S., where data protection laws may differ from those in your country.

We take steps to ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission
• Other appropriate safeguards as required by GDPR

How to Exercise Your Rights:

Submit requests via the contact page on our website using the information in Section 16. We will respond within one month (extendable by two months if complex). We may request additional information to verify your identity.

Data Protection Officer:

As of the effective date, we are not required to appoint a Data Protection Officer. For privacy inquiries, contact us using the information in Section 16.

7. INTERNATIONAL DATA TRANSFERS

If you are located outside the United States, your information may be transferred to and processed in the U.S. or other jurisdictions. We take steps to ensure such transfers comply with applicable data protection laws, including GDPR, through the use of Standard Contractual Clauses, adequacy decisions, or other appropriate safeguards.

8. THIRD-PARTY LINKS

Our services may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. Your use of third-party websites is governed by their respective privacy policies and terms of service.

9. CHILDREN’S PRIVACY

(a) No Knowing Collection We do not knowingly collect personal information from children under 18 without verifiable parental consent.

(b) Parental Rights If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will delete such information from our systems within a reasonable timeframe.

(c) COPPA Compliance (Children Under 13) We comply with the Children’s Online Privacy Protection Act (COPPA) for children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information as soon as possible.

(d) Age Verification By using our services, you represent that you are at least 18 years old. We may request age verification if we suspect a user is under 18.

(e) Educational Exceptions If you are under 18 and using our services as part of an educational program or project supervised by a parent, guardian, or teacher, such adult must provide consent and supervise your use of our services.

Our services are not directed to individuals under 18. We do not knowingly collect information from minors.

10. LIMITATION OF LIABILITY

To the fullest extent permitted by law, our aggregate liability for any claims arising from this Privacy Policy or the collection, use, or disclosure of your information shall be limited to direct damages not to exceed $5,000 USD or the total amount of fees you paid to us in the twelve (12) months preceding the claim, whichever is lower. We shall not be liable for consequential, incidental, special, punitive, or exemplary damages.

For clients who have executed an Engagement Agreement with us, the liability limitations set forth in that Engagement Agreement shall supersede and control over the limitations in this Privacy Policy with respect to services provided under that agreement.

This limitation does not apply to:

(a) Liability arising from our gross negligence or willful misconduct;
(b) Violations of specific statutory privacy rights that cannot be waived; or
(c) Claims where applicable law prohibits such limitation.

Your use of our services is at your own risk for issues beyond the scope of our reasonable control.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy at any time. Updates will be posted on this page with a revised “Effective Date” and version number at the top of this document.

Continued use of our services after changes are posted constitutes acceptance of the updated Privacy Policy. If you do not agree to the modified Privacy Policy, you must stop using our services.

For material changes that significantly affect your rights, we will make reasonable efforts to provide notice through the website or via email if you have provided contact information.

We recommend reviewing this Privacy Policy periodically to stay informed of any changes.

12. CONTACT US

If you have questions or concerns about this Privacy Policy or our privacy practices, contact us:

Via our website: Contact Us
By email: [email protected]
By mail: Crafted IP LLC, 5013 S Louise Ave Unit 5133, Sioux Falls, SD 57108

13. ANALYTICS AND VISITOR TRACKING

We use web analytics tools to understand how visitors interact with our website. Analytics help us improve the site by collecting information such as:

• Pages visited: which content is viewed and how long visitors stay
• Navigation paths: how visitors move from one page to another
• Device and browser details: type of device, operating system, and browser used
• Referrer information: how visitors arrive at our site (for example, from a search engine or another website)
• Geographic location (approximate): based on anonymized IP addresses, to see where our audience is located

This data is processed in a way that respects your privacy. IP addresses are anonymized, and no personal information such as your name or email address is tracked through analytics.

13.1 Data Retention for Analytics

Analytics data is retained for a maximum of 26 months. After this period, the data is automatically deleted. IP addresses are anonymized immediately upon collection and are never stored in identifiable form.

13.2 Cookies and Similar Technologies

What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They help websites remember your preferences and improve your experience.

Types of Cookies We Use:

(a) Strictly Necessary Cookies

• Required for website functionality
• Cannot be disabled
• Examples: session management, security features

(b) Analytics Cookies

• Used to understand how visitors interact with our website
• Help us improve content and navigation
• Can be disabled via the opt-out method described in Section 13.4

(c) Preference Cookies

• Remember your settings and preferences
• Examples: language selection, display preferences
• Optional and can be disabled through browser settings

We do NOT use:

• Advertising cookies or third-party advertising networks
• Social media tracking cookies (unless you explicitly use social sharing features)
• Cross-site tracking cookies

Managing Cookies:

You can control and delete cookies through your browser settings. However, disabling certain cookies may limit website functionality.

Browser-specific cookie management instructions:

• Chrome: Settings > Privacy and Security > Cookies
• Firefox: Options > Privacy & Security > Cookies
• Safari: Preferences > Privacy > Cookies
• Edge: Settings > Privacy > Cookies

For more information about cookies and how to manage them, visit www.allaboutcookies.org.

13.3 Do Not Track (DNT) Signals

Some web browsers offer a “Do Not Track” (DNT) signal that requests websites not track users across websites.

Current Status: Currently, there is no industry-wide standard for how to respond to DNT signals. We do not respond to DNT signals at this time.

Alternative Privacy Controls:

You can control tracking through:

• The analytics opt-out method described in Section 13.4
• Your browser’s cookie settings
• Browser privacy extensions
• Private/incognito browsing mode

If industry standards develop, we will update our practices and this Privacy Policy accordingly.

13.4 Opt-Out of Analytics Tracking

We provide an opt-out option so you can choose not to be tracked by our analytics tools. If you opt out, analytics tools will no longer collect data about your visits to our site. Your choice will be stored in a cookie on your browser, and you can change it at any time.

14. DATA BREACH NOTIFICATION

In the event of a data breach that affects your personal information, we will:

(a) Investigate the breach promptly and take steps to mitigate harm;

(b) Notify affected individuals without undue delay if the breach is likely to result in a high risk to your rights and freedoms (GDPR) or as otherwise required by applicable law. In accordance with South Dakota law (SDCL § 22-40-20), we will notify affected South Dakota residents within 60 days of the discovery of a breach, unless a longer period is requested by law enforcement or required by other applicable laws such as CCPA;

(c) Provide information about:

• The nature of the breach
• Categories and approximate number of individuals affected
• Categories and approximate number of records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact information for further inquiries

(d) Notify relevant supervisory authorities as required by law, including the South Dakota Attorney General where required under SDCL § 22-40-20; and

(e) Implement additional security measures to prevent future breaches.

Notification will be provided by email, posting on our website, or other appropriate means depending on the circumstances and legal requirements.

Limitation:

We are not required to provide notification if:

• The personal information was encrypted, redacted, or otherwise secured in a manner that renders it unusable
• Subsequent investigation determines that no significant risk exists
• Other exceptions under applicable law apply
  

15. THIRD-PARTY SERVICE PROVIDERS

We engage third-party service providers to assist with business operations. These providers have access to personal information only to perform specific tasks on our behalf and are obligated to protect your information through contractual agreements.

Categories of Service Providers:

We work with service providers in the following categories:

(a) Analytics Platforms

• Purpose: Website analytics and performance monitoring
• Data shared: Anonymized IP addresses, page views, device information, navigation patterns
• Security: Data anonymization, encryption in transit

(b) Email Service Providers

• Purpose: Email communications and correspondence management
• Data shared: Email addresses, correspondence content, contact information
• Security: Encryption in transit, access controls, secure data centers

(c) Cloud Storage Providers and AI Service Providers

• Purpose: Secure document storage, collaboration, and assistance with patent drafting and research
• Data shared: Client files, invention disclosures, project documents, technical information for AI-assisted analysis
• Security: Encryption at rest and in transit, access controls, regular security audits
• Note: AI tools process technical data solely for patent-related services and are bound by confidentiality obligations. Use of AI tools is disclosed in our Engagement Agreements.

(d) Payment Processors

• Purpose: Processing payments for services rendered
• Data shared: Name, billing address, payment information
• Security: PCI DSS compliance, encryption, tokenization
• Note: We do not store complete payment card information on our systems

(e) Website Hosting Providers

• Purpose: Website hosting and infrastructure
• Data shared: All website data and user interactions
• Security: Firewalls, DDoS protection, regular security updates

(f) Professional Service Platforms

• Purpose: Client engagement, project management, and collaboration
• Data shared: Profile information, project details, communications
• Security: Encryption, access controls, audit logs

Due Diligence:

We conduct due diligence on service providers to ensure they:

• Maintain appropriate technical and organizational security measures
• Comply with applicable data protection laws
• Enter into data processing agreements with confidentiality obligations
• Provide adequate safeguards for international data transfers (where applicable)

Limitation of Responsibility:

While we carefully select and monitor our service providers, we are not responsible for their privacy practices beyond our contractual agreements with them. Each service provider operates under their own privacy policy and security practices.

Additional Information Upon Request:

For security reasons, we do not publicly disclose the specific names of all service providers. However, if you would like more detailed information about specific service providers we use, you may submit a written request using the contact information in Section 16. We will provide additional details where doing so does not compromise our operational security.

Changes to Service Providers:

We may change service providers from time to time to improve our services or operational efficiency. Material changes will be reflected in updates to this Privacy Policy.

16. HOW TO EXERCISE YOUR PRIVACY RIGHTS

Submitting Requests:

You may exercise your rights by:

(a) Completing the form on our contact page: Contact Us
(b) Emailing us at: [email protected]
(c) Mailing us at: Crafted IP LLC, 5013 S Louise Ave Unit 5133, Sioux Falls, SD 57108

Required Information:

To verify your identity, please provide:

• Your full name
• Email address associated with our services
• Description of your relationship with us (client, website visitor, etc.)
• Specific request (access, deletion, correction, etc.)
• Additional verification information as needed (such as last service date, invoice number, or other identifying details)

Response Timeline:

• CCPA requests: 45 days (extendable by 45 days if necessary)
• GDPR requests: 1 month (extendable by 2 months if complex)
• We will acknowledge receipt of your request within 10 business days

Verification Process:

We take verification seriously to protect against fraudulent requests. We may:

• Ask clarifying questions
• Request additional identification
• Confirm details through secure channels

We will only use information provided for verification purposes and will not retain it longer than necessary.

Fees:

We do not charge a fee for exercising privacy rights unless requests are manifestly unfounded or excessive, or you request duplicate copies beyond the first free copy.

If a fee applies, we will notify you in advance and explain the basis for the fee.

Authorized Agents (California Residents):

You may designate an authorized agent to submit requests on your behalf by:

• Providing written authorization signed by you; or
• Providing proof of power of attorney

The agent must verify both your identity and their authority to act on your behalf.

Denial of Requests:

If we deny a request (in whole or in part), we will explain:

• The reason for denial (including any legal obligations that prevent deletion, such as USPTO requirements under 37 CFR § 11.18)
• Your right to appeal (if applicable)
• How to lodge a complaint with a supervisory authority

Appeal Process:

If you believe we wrongfully denied your request, you may appeal by contacting us using the information above within 30 days of our response. We will respond to appeals within 45 days.

ACCESSIBILITY STATEMENT

We strive to maintain accessibility of this website and our privacy practices in accordance with applicable standards. If you experience difficulty accessing this Privacy Policy or any content on our website, or if you require this Privacy Policy in an alternative format, please contact us using the information in Section 16.