Privacy Policy

1. Introduction

Welcome to Pathub (pathub.ai), an AI-powered patent search, analysis, and drafting platform operated by Ada X LLC, a Limited Liability Company organized under the laws of Wyoming ("Ada X," "we," "us," or "our").

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use Pathub, including our website, applications, APIs, and related services (collectively, the "Service").

This Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR), the EU Artificial Intelligence Act (EU AI Act), and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA). By using our Service, you acknowledge that you have read and understood this Privacy Policy.

Effective Date: June 29, 2026

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using the Service:

• Account Information: Name, email address, password (hashed), organization name, and professional role when you create an account.
• Payment Information: Billing details processed securely through our payment processor, Stripe, Inc. We do not store full credit card numbers on our servers. See Stripe's Privacy Policy for details.
• User Content: Patent documents, search queries, analysis requests, drafts, annotations, and any other content you upload, submit, or generate through the Service.
• Communications: Messages you send to us via email, support tickets, or feedback forms.

2.2 Information Collected Automatically

When you access the Service, we automatically collect certain information:

• Device Information: Device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Log Data: IP address, access times, pages viewed, referring URL, and actions taken within the Service.
• Usage Data: Features used, search queries performed, analysis types requested, session duration, and interaction patterns.
• Location Data: Approximate geographic location inferred from your IP address (country/region level only).

2.3 Information from Third Parties

We may receive information about you from third-party sources:

• Authentication Providers: If you sign in through a third-party service (e.g., Google, GitHub), we receive your name, email, and profile information as authorized by you.
• Public Patent Databases: We retrieve patent data from public sources (e.g., USPTO, EPO, WIPO) to provide the Service. This data is publicly available and does not constitute personal data.
• Analytics Providers: We may receive aggregated analytics data from service providers that help us understand usage patterns.

3. Legal Basis for Processing (GDPR Article 6)

For users in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, we process your personal data on the following legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service, manage your account, and fulfill our contractual obligations to you.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate interests, including improving the Service, ensuring security, preventing fraud, and conducting analytics, where those interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for marketing communications or optional analytics cookies. You may withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable laws, regulations, or legal proceedings, including tax and financial reporting requirements.

4. AI Data Processing and Third-Party Model Providers

4.1 AI System Transparency (EU AI Act Article 50)

In accordance with the EU AI Act, we inform you that Pathub uses artificial intelligence systems to provide its core functionality, including patent search, analysis, claim drafting, and novelty assessment. When you interact with AI-generated results, summaries, or recommendations within the Service, you are interacting with output produced by AI models.

AI-generated content is provided as assistive information only and does not constitute legal advice. All AI outputs should be reviewed by qualified professionals before reliance.

4.2 AI Sub-Processors

We use the following third-party AI model providers as sub-processors to deliver AI-powered features:

We have executed Data Processing Agreements (DPAs) with each AI sub-processor. These agreements contractually prohibit the use of your data for model training and ensure GDPR-compliant processing.

4.3 Data Flow

Data sent to AI model providers includes:

• User queries and prompts submitted through the Service.
• Patent text excerpts provided for analysis, comparison, or drafting purposes.
• System prompts and contextual information necessary for accurate AI responses.

Data NOT sent to AI model providers:

• Account credentials or authentication tokens.
• Payment or billing information.
• Email addresses or personal contact details.
• Usage analytics or behavioral data.

4.4 Zero Data Retention by AI Providers

Our API agreements with AI model providers stipulate that user content submitted via API is not retained beyond the duration necessary to process the request and return a response. No user content is stored by AI providers for future use, training, or any other purpose.

4.5 No Training Commitment

We do not use your content to train AI models. Your patent documents, search queries, and analysis results are never used to train, fine-tune, or improve any third-party AI model. This commitment is contractually enforced through our Data Processing Agreements with all AI sub-processors.

5. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve the Service, including AI-powered patent search, analysis, and drafting.
• Account Management: To create and manage your account, authenticate your identity, and provide customer support.
• Payment Processing: To process transactions, send invoices, and manage billing through Stripe.
• Communication: To send you service-related notifications, security alerts, and (with your consent) marketing communications.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.
• Analytics: To understand usage patterns and improve the Service, using aggregated and anonymized data where possible.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

6. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With third-party vendors who perform services on our behalf (e.g., hosting, payment processing, analytics), subject to contractual obligations to protect your data.
• AI Sub-Processors: With AI model providers as described in Section 4, solely for the purpose of delivering AI-powered features.
• Legal Requirements: When required by law, regulation, legal process, or governmental request.
• Protection of Rights: To protect the rights, property, or safety of Ada X LLC, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. You will be notified of any such change.
• With Your Consent: We may share your information with third parties when you have given explicit consent.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. You can manage your cookie preferences through your browser settings or our cookie consent mechanism.

• Essential Cookies: Required for the Service to function properly, including authentication and security. These cannot be disabled.
• Performance Cookies: Help us understand how users interact with the Service by collecting anonymous usage statistics.
• Functional Cookies: Remember your preferences and settings to provide a personalized experience.
• Marketing Cookies: Used to deliver relevant advertisements and measure campaign effectiveness. These are only set with your explicit consent.

For more information about the specific cookies we use, please refer to our Cookie Policy.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained while your account is active and for a reasonable period thereafter (up to 30 days) to allow for account recovery or reactivation.
• Transaction Records: Retained for 7 years to comply with tax, accounting, and financial reporting obligations.
• Usage Data: Aggregated and anonymized usage data may be retained indefinitely for analytics and service improvement purposes. Identifiable usage data is deleted or anonymized within 24 months.
• Support Communications: Retained for 3 years from the date of resolution to maintain service quality and resolve potential disputes.
• AI Processing Logs: Metadata related to AI requests (excluding content) is retained for up to 90 days for debugging and abuse prevention purposes.

Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

9. Data Security

We implement industry-standard technical and organizational measures to protect your personal data:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Stored data is encrypted using AES-256 encryption.
• Access Controls: Role-based access controls and multi-factor authentication for internal systems. Access to personal data is limited to authorized personnel on a need-to-know basis.
• Monitoring: Continuous security monitoring, intrusion detection, and regular vulnerability assessments.
• Incident Response: We maintain an incident response plan and will notify affected users and relevant authorities within 72 hours of becoming aware of a data breach, as required by GDPR Article 33.

While we strive to protect your personal data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Ada X LLC is based in the United States. If you are accessing the Service from outside the United States, your personal data will be transferred to, stored, and processed in the United States and potentially other jurisdictions where our service providers operate.

For transfers of personal data from the EEA, UK, and Switzerland, we rely on:

• EU-US Data Privacy Framework (DPF): Where applicable, our sub-processors are certified under the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Data Privacy Framework.
• Standard Contractual Clauses (SCCs): We execute EU-approved Standard Contractual Clauses with our sub-processors as an additional safeguard for international data transfers.

You may request a copy of the safeguards we use for international transfers by contacting us at privacy@adax.ltd.

11. Your Rights

11.1 Rights Under GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data where there is no compelling reason for continued processing.
• Right to Restrict Processing (Art. 18): Request that we limit the processing of your personal data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact us at privacy@adax.ltd. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

11.2 Automated Decision-Making (GDPR Article 22)

Pathub uses AI to assist with patent search, analysis, and drafting. However, our AI systems are assistive tools only and do not make legally binding or similarly significant decisions about individuals without human involvement.

• AI outputs are recommendations and analyses that require human review and validation.
• No automated decision is made that produces legal effects or similarly significantly affects you without human oversight.
• You have the right to request human review of any AI-assisted output or decision.

11.3 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know and Access: Request information about the categories and specific pieces of personal information we have collected, the purposes of collection, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this practice changes, we will provide a clear opt-out mechanism.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA request, contact us at privacy@adax.ltd. We will verify your identity and respond within 45 days.

12. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such information promptly. If you believe a child under 18 has provided us with personal information, please contact us at privacy@adax.ltd.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via email or a prominent notice on the Service prior to the changes becoming effective.
• Where required by law, obtain your consent before implementing material changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@adax.ltd
• Mail: Ada X LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States
• Phone: +1 (838) 699-8099

For GDPR-related inquiries, you may also contact your local data protection authority. A list of EEA data protection authorities is available at edpb.europa.eu.