Privacy & your data

What we collect: your intake answers, optional clarity ratings (before and after), generated readiness profiles, optional pilot feedback, saved research prep notes you choose to store, and first-party analytics events (event names, routes, signal keys, and safe counts — not your full invention text).

Google Tag Manager (GTM): when enabled, we load GTM on public marketing pages only to measure visitor traffic and campaign attribution (UTM parameters, referrer, landing page). GA4 measurement (configured inside GTM) receives public page paths and safe event names only — not your invention descriptions, saved research notes, emails, recovery tokens, or private packet content. Private app activity stays in our internal Supabase analytics.

Where it is stored: on your device (local mode) or in our database when Supabase is configured for a pilot. Demo data is clearly marked and excluded from live pilot reporting.

Partner pilot reporting: authorized partners with a dashboard secret may view aggregated pilot metrics and export CSV summaries for readiness reporting. CSV exports exclude raw invention descriptions and free-text feedback notes.

Recovery links: if you create a recovery link, we store only a hashed token (never the raw link text). Anyone with the private link can access your packet until the link expires or you create a new one.

What we do not do: we do not provide legal advice, confidential legal representation, or an attorney-client relationship. SmartProBonoIP is not a secure vault for trade secrets. Do not submit details you are not comfortable sharing unless you understand the risks.

Deletion and export: you may email us to request export or deletion of your pilot data during the pilot period.

Retention, subprocessors & security

Data retention: during the pilot, we keep records only as long as needed to measure readiness impact, support recovery links you create, and improve the product. When you request deletion, we remove or anonymize your pilot data within a reasonable timeframe unless we must retain a minimal record for security or legal compliance.

Subprocessors: we use Netlify for website hosting and deployment, Supabase for database storage when cloud mode is enabled, and optionally Google Tag Manager / Google Analytics 4 on public marketing pages only. These providers process data according to their own terms and only as needed to operate the service.

Security incidents: if you believe your data has been accessed without authorization, contact bferrell@smartprobono.org. We will review reported concerns and respond within a reasonable timeframe.

During the pilot (10–25 inventors), demo records are clearly marked and excluded from live pilot reporting.