Privacy Policy

Last updated: 24 October 2026

IPRwise Teknoloji A.Ş. ("IPRwise", "we") operates the platform at www.iprwise.com, a marketplace where trademark and patent attorneys are verified and instructed across borders. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have.

For the purposes of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), IPRwise Teknoloji A.Ş. is the data controller. You can reach us at info@iprwise.com for any question or request about your personal data.

1. Personal data we collect

Account and profile data. Your first and last name, email address, password (stored only as a hash by our authentication provider), professional registry number and the authority that issued it (for example TÜRKPATENT or the EPO), account type (individual or agency), country, jurisdictions you practise in, professional titles, biography, areas of expertise, profile photograph, preferred language, a link to your LinkedIn profile if you provide one, and your office address if you choose to publish it in the directory.

Verification (KYC) documents. Documents you upload so that we can confirm you are an authorised professional — registry certificates, bar or attorney credentials, and the identifying information those documents contain.

Marketplace activity. Tasks you create or accept, bids, messages and files exchanged with the other party, appointments, deadlines and status records, ratings and reviews.

Payment data. Payments are processed through Stripe under an escrow model. We do not receive or store your full card number. We retain the transaction identifier, amount, currency, status, and the invoice and accounting records required by law.

Marketing and lead data (LinkedIn Lead Gen Forms). If you submit a LinkedIn Lead Gen Form shown in one of our advertisements, LinkedIn transfers to us the fields you filled in — typically your name, business email address, job title, company, country and, where you provide it, your telephone number. Section 3 explains how we use this data.

Technical data. IP address, browser and device information, server and security log records, and cookie identifiers.

Communications. Emails, support requests and other correspondence you send us.

2. Why we process your data, and on what legal basis

• To provide the platform — creating your account, matching instructions between clients and professionals, messaging, file exchange and appointment management. Basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To verify professional credentials — so that every listed attorney is a genuine, registered professional. Basis: our legitimate interest in a trustworthy network and, where applicable, a legal obligation (GDPR Art. 6(1)(f) and (c); KVKK Art. 5(2)(ç) and (f)).
• To take and settle payments through escrow — including invoicing and bookkeeping. Basis: contract and legal obligation (GDPR Art. 6(1)(b) and (c); KVKK Art. 5(2)(a) and (ç)).
• To keep the platform secure — fraud prevention, abuse detection, log keeping. Basis: legitimate interest and legal obligation.
• To send marketing communications about IPRwise services, including follow-up to a LinkedIn Lead Gen Form you submitted. Basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). You can withdraw consent at any time, with no effect on processing carried out before withdrawal.
• To comply with legal obligations under Turkish commercial, tax, e-commerce and electronic-communications legislation, and to establish or defend legal claims.

3. LinkedIn: sign-in and advertising

Sign in with LinkedIn. If you choose to create an account or log in with LinkedIn, we use LinkedIn's OpenID Connect service and receive only your name, email address, profile picture and LinkedIn member identifier, under the `openid`, `profile` and `email` scopes. We use this data solely to create and authenticate your IPRwise account. We do not post on your behalf, we do not access your connections, and we do not read your LinkedIn messages.

LinkedIn Lead Gen Forms. We advertise on LinkedIn. When you submit a Lead Gen Form attached to one of our advertisements, you consent to LinkedIn sharing the fields you submitted with IPRwise. We use that data to contact you about the IPRwise platform and the services you asked about — by email and, if you provided a number, by telephone. We do not sell this data and we do not share it with third parties for their own marketing.

You can opt out at any time by emailing info@iprwise.com; we will then delete your lead record and stop contacting you. LinkedIn's own processing of your data is governed by the LinkedIn Privacy Policy, and LinkedIn acts as an independent controller for it.

4. AI assistants connected to your account

You can connect an AI assistant, for example Claude or ChatGPT, to your IPRwise account through our connector at https://www.iprwise.com/mcp. You start the connection in the AI application, sign in to IPRwise and approve it on our consent page.

What the connector does. It lets the assistant look up IPRwise reference data on your behalf: country IP facts, international filing routes, the attorney directory, IP Radar announcements and Nice Classification checks. It only reads. It cannot change your profile, send messages, create or accept tasks, or see your private data.

What we process.

• Requests: the name of the tool the assistant calls and its parameters (for example a country, a practice area or a list of goods and services terms). We use them only to produce the answer and do not store them.
• Application registrations: the name and return address that an AI application registers with us. They do not identify you.
• Connection records: the account you connected, the permissions you approved and the time of each step. Authorization codes and access tokens are stored only as cryptographic hashes.
• Usage records: for each account and day, the number of requests in total, per tool and per application. We use them to apply daily limits and to prevent abuse.
• Server logs: the tool called, the response time and size, whether an error occurred, the application name and a shortened account identifier. Logs do not contain the content of your requests.

Legal basis. Performance of the service you request (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) and our legitimate interest in keeping the service secure and preventing abuse (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

The AI provider. What you type into the AI application, and the answers it receives from us, are processed by the provider of that application under its own privacy policy, as an independent controller (for example Anthropic for Claude or OpenAI for ChatGPT). IPRwise does not receive your conversation.

Ending a connection. You can disconnect at any time in the AI application. You can also ask us at info@iprwise.com to close every connection of your account.

Retention. Authorization codes expire after 5 minutes, access tokens after 1 hour and refresh tokens after 30 days; expired connection records are deleted within 30 days. Usage records are deleted 12 months after the day they cover, and application registrations 12 months after they were last used. Server logs are kept as traffic and security log records (section 7).

5. Cookies and analytics

We use strictly necessary cookies to keep you signed in and to keep the platform secure, and analytics tools to understand how the site is used. Our analytics and embedded services are Google Tag Manager, Cloudflare Web Analytics and the Calendly appointment widget. You can delete or block cookies in your browser settings, but core functions such as signing in and uploading files may stop working if strictly necessary cookies are blocked. Full details are in our Cookie Policy.

6. Who we share your data with

• Service providers acting on our instructions: Stripe (payments and escrow), Google/Firebase (authentication, database and file storage), Vercel (hosting), SendGrid (transactional email), Cloudflare (content delivery and analytics), Calendly (appointment scheduling).
• Other platform users: the professional profile information you choose to publish, and the content you exchange with the other party in a task.
• LinkedIn, in the context described in Section 3.
• Public authorities, courts and regulators, where disclosure is required by law or necessary to establish or defend legal claims.

Some of these providers process data outside Türkiye and the European Economic Area, including in the United States. Such transfers are made under the safeguards required by GDPR Chapter V — as a rule the European Commission's Standard Contractual Clauses — and, for transfers from Türkiye, on the grounds set out in Article 9 of the KVKK.

7. How long we keep your data

• Account, profile and verification data: for as long as your membership continues, and afterwards for the periods required by commercial and tax legislation (as a rule ten years for commercial books and records, five years for tax records).
• Marketplace records, invoices and payment records: ten years from the end of the relationship, in line with Article 82 of the Turkish Commercial Code.
• Traffic and security log records: two years.
• AI assistant connection, usage and application registration records: as set out in section 4.
• Marketing and lead data: until you withdraw your consent, and in any event no longer than three years from your last interaction with us.

When a retention period ends, data is deleted or irreversibly anonymised.

8. Your rights

Under Article 11 of the KVKK and Articles 15 to 22 of the GDPR you may ask us: whether we process data about you and to obtain a copy of it; to correct data that is inaccurate or incomplete; to delete data or restrict its processing; to receive your data in a portable format; to object to processing based on our legitimate interests; to withdraw a consent you have given; and to be informed if data has been transferred abroad or to third parties.

Send your request to info@iprwise.com. We respond within thirty days under the KVKK and within one month under the GDPR. If you are not satisfied with our response you may complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, in the EEA, to your local supervisory authority.

9. Security

Data in transit is protected with TLS encryption. Access to production data is restricted to authorised personnel, database and file storage access is governed by rule-based authorisation, and payments are handled entirely within Stripe's PCI-DSS certified infrastructure. No system can be guaranteed absolutely secure, but we review these measures regularly.

10. Children

IPRwise is a platform for professionals and is not directed at anyone under the age of eighteen. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy as our services or the applicable law change. The date at the top shows when it was last revised; if a change materially affects your rights, we will notify you by email or through the platform.

12. Contact

IPRwise Teknoloji A.Ş. — Atatürk Bulvarı No: 8, Kütahya, Türkiye — info@iprwise.com