Privacy Policy

Information we collect

Information you provide: When you submit a contact form, purchase a plan, or communicate with us, we collect your name, email, company name, phone number (if provided), and the substance of your inquiry.

Automatically collected: Vercel collects standard website analytics such as browser type, pages visited, and time on site. On public marketing and checkout pages, Google Ads may also receive the page path, browser and device information, advertising identifiers, and conversion details so we can measure advertising performance. We do not send Google the contents of forms, searches, account pages, portal activity, OAuth activity, or password-reset and email-verification links.

API and MCP usage data: If you use the Goalie IP Trademark Database API or our MCP server, we record one usage log row per billable request. Each row contains the identifier of the API key or OAuth credential used, the name of the endpoint or tool called (for example mcp:search_trademarks), the HTTP status code, and the timestamp. We do not store the contents of your API or MCP queries — the mark names, owner names, goods and services text, or other search terms you submit are used to run the query and are not retained. This data is used for quota enforcement, billing, and abuse detection. It is not sold, not shared for marketing, and not used to train any model.

MCP client identity: For requests to our MCP server we record which MCP client software you connect with (for example "claude-code/2.1" or "cline/3.2"), aggregated into a single running count per account per billing period. We do not record per-request client data, and we receive no information about your conversation, prompts, files, or any other tool you use.

Website search: Searches run through the trademark search tool on our website are logged separately, including the search terms entered, the number of results returned, and the originating IP address. This log exists to detect abuse and to tune search performance. It applies to the website search form only — not to the API or MCP server, which are covered above.

How we use your information

We use your information to respond to inquiries, provide requested services, deliver monitoring reports, send service updates, enforce plan quotas, bill for usage, improve our services, and measure advertising performance on public marketing and checkout pages. We do not sell or rent your personal information, and we do not use client data or query contents for advertising or to train any machine learning model.

Third-party sharing

Your information is shared only with the service providers we need to operate the business, and only to the extent required to do so:

• Square — payment and subscription processing. Card details are entered directly into Square and are never stored on our systems.
• Resend — delivery of transactional email (receipts, report notifications, account and usage notices).
• Vercel — website and API hosting, and private storage of report PDFs.
• Neon — managed PostgreSQL database hosting.
• Upstash — rate limiting on our API endpoints.
• Cloudflare — bot challenge on our contact and signup forms.
• Google Ads — advertising attribution and conversion measurement on public marketing and checkout pages. Google Ads is not loaded on account, portal, administrative, OAuth, search-result, password-reset, or email-verification pages.

Beyond these providers, we disclose information only where we are legally required to, or where you have asked us to. Confidential client matter information and the substance of enforcement work are attorney work product and are not sent to any third-party service.

API key management

API keys are tied to your Goalie IP account. We store a hashed representation of your API key — we cannot retrieve the raw key after it is issued. If you lose your key, you must generate a new one from your account portal.

API keys may be revoked at any time from your account portal. Revoked keys immediately cease to function. We reserve the right to revoke keys that violate our Terms of Service. The data exposed through the API consists entirely of publicly available USPTO trademark records. No subscriber personal information is accessible through the API.

MCP server and OAuth authorization

Our MCP server lets an AI client such as Claude search our copy of the USPTO trademark register on your behalf. You can connect it either with an API key or by authorizing it through OAuth 2.1.

When you authorize an MCP client over OAuth, we store a record of the registered client application (its name and redirect URLs), a record of your consent, and hashed representations of the issued access and refresh tokens. We store hashes, not the tokens themselves, so we cannot recover a token after it is issued. We also keep a security audit trail of client registrations, consent grants and denials, and token issuance, refresh, and revocation, which includes the originating IP address of those authorization events.

The scope of an OAuth grant is limited to searching public USPTO trademark data and reading your own account's plan and usage totals. An MCP connection cannot read your monitoring reports, alerts, billing details, or any other customer's data. We receive nothing about the conversation the client is having with you beyond the tool arguments needed to run a search, and those arguments are not retained.

You can see every application you have authorized and revoke any of them at any time from your account portal. Revocation takes effect immediately.

Data retention

We retain client information for as long as necessary to provide services and comply with legal obligations. Engagement records are retained for a minimum of 5 years from the last service interaction.

API and MCP usage logs are retained for 13 months from the date of the request, to support billing reconciliation and quota enforcement across rolling calendar months, and are then deleted automatically.

OAuth authorization codes are single-use and expire within minutes. Expired access and refresh tokens are deleted automatically, and revoked tokens are kept for seven days — the window in which a replayed token can still be detected — and then deleted. The security audit trail described above is retained as a record of authorization activity.

Security

We use industry-standard security measures to protect your information, including encrypted storage of credentials and HTTPS-only API communication. No transmission of data over the internet is completely secure.

Your rights

You may request access to, correction of, or deletion of personal information we hold by contacting us. We will respond within 30 days. You may also revoke any API key or authorized MCP client yourself, at any time, from your account portal.

Deleting your account removes your profile, API keys, and OAuth authorizations. Records we are required to keep — billing and payment records, and engagement records subject to the retention periods above — are retained for the period stated, then deleted.

Contact information

Questions about this policy, or requests concerning your personal information, can be sent to reid@goalieip.com or through our contact form. Goalie IP Inc., United States.