top of page

Privacy Policy​

​​

Version 2026.1 · Effective date: 18-Oct-2026 · Replaces the policy dated 21-Mar-2021.

​

At a glance

  • We do not sell personal information or use it for advertising.

  • The client portal sets only two cookies, both needed to keep you signed in.

  • Our staff can view the portal as you see it to support you; that view is read-only and every use is recorded.

  • Questions or requests: operations@hexosip.com or +1 (877) 439-6747.

1. Who we are

This policy explains how Hexos Incorporated, d/b/a Hexos IP, a North Carolina corporation ("Hexos", "we", "us"), handles personal information when you:

  • visit our website at hexosip.com or our campaign pages at go.hexosip.com;

  • contact us, or complete one of our inquiry or onboarding forms;

  • use the my Hexos IP client portal at my.hexosip.com (the "Portal") or the Hexos API (the "API"); or

  • work for, or are named in the records of, a client whose patents and trademarks we manage.

Hexos Incorporated, 555 Fayetteville St, Ste 300, Raleigh, NC 27601-3066, USA.

Privacy questions and requests: operations@hexosip.com · +1 (877) 439-6747.

Our services are for businesses, law firms and universities. This policy does not cover our clients' own websites or services.

2. What we collect

From our website and forms

  • What you type into a contact, inquiry or onboarding form: name, job title, organization, email, telephone, address and your message.

  • For new clients, the business and billing details we need to set up an account, including tax forms such as a Form W-9, which carry a taxpayer identification number.

  • Basic technical information our website host records when a page is requested, such as IP address, browser type and the time of the request.

From the Portal

  • Your account details: name, email address, role, the organization you work for and the organizations you can see.

  • Sign-in and security records: when you sign in, your IP address, browser details, the sign-in method you used (password plus an emailed code, or an authenticator app), computers you have marked as trusted, failed sign-in attempts, and password changes. We store passwords only in a protected (hashed) form, and we never see a password you choose. If our staff set a temporary password for you, it works only to sign in and choose your own, and it expires.

  • What you do in the Portal: requests you send, invoice reviews, notice preferences, and the time and version of the Terms of Use you accepted.

  • Messages, requests and files you send us through the Portal.

  • Notes you add to a case, which are stored with the case in the Hexos platform.

From the API

  • For integrators a client has authorized: name, organization, email, the version of the API terms accepted, when, and the IP address used to accept them, and a record of each request made with each credential.

From our clients about their cases

  • Case records: application and patent or registration numbers, dates, and the names of owners and applicants (some of whom may be individuals, such as inventors or sole owners) and their addresses as they appear in official records.

  • Contact details of client staff we work with: name, job title, email and telephone.

About payments

  • Invoices, payments and remittance details. Card and bank payments made online are handled by our payment processor; we do not store full card numbers.

From public sources

  • Information published by patent and trademark offices (for example, the USPTO and the European Patent Office) about the cases we manage, which we check against our records.

3. Why we use it, and our legal bases

We use personal information to:

  • provide our renewal and recordal services, including paying fees to patent and trademark offices directly or through local agents;

  • run the Portal and the API, verify who you are, and keep them secure;

  • detect and prevent fraud, misuse and security incidents, and keep audit records;

  • invoice, take payment and keep accounts;

  • send service emails, such as sign-in codes, password emails, notices you have chosen and replies to your messages;

  • answer inquiries and, where section 10 allows, send business marketing emails;

  • keep a record of the instructions we receive and what we did, so we can show how a right was maintained;

  • meet legal, tax and regulatory duties, and establish or defend legal claims; and

  • improve our services, using aggregated information that does not identify you.

How we use AI. We use AI tools to help our staff work accurately and quickly: for example, to read documents (such as assignments, and papers filed at patent and trademark offices) and pull out names, dates and numbers; to summarize documents; and to help us run and maintain our systems. The AI built into our systems runs privately on Cloudflare's own network (Cloudflare Workers AI). Our staff also use an AI assistant from Anthropic, which can see the information needed for the task in hand. These providers process information only to give us the result: it is not used to train their AI models, and it is not sold or shared for advertising. AI results about a case can be used to update that case's record — for example, a patent's expiry date read from a terminal disclaimer filed at the USPTO — but we do not use AI to make decisions about people that have legal or similarly significant effects.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on: performance of a contract (providing services to our client and to you as its user); our legitimate interests in running a secure, efficient renewals business and keeping accurate records, which we balance against your rights; legal obligation (tax and accounting records); and consent where we ask for it, which you can withdraw at any time.

4. The Portal: specifics

  • Two-step sign-in. Each sign-in needs your password and a second step: a code we email you, or a code from your authenticator app. If you mark a computer as trusted, the second step is skipped on that computer for 30 days; your password is still needed.

  • Sign-out. A session ends after 30 minutes without activity, and in any case after 12 hours.

  • Staff support view. To support you, our staff can view the Portal as you see it. Only staff with that permission can start it, it lasts at most 30 minutes, they cannot make changes that way, and each such view is recorded.

  • Staff account actions. On your organization's request or to protect the Portal, our staff can reset your password, remove your authenticator app, sign you out everywhere, or disable your access. Each such action is recorded.

  • Encryption. Connections to the Portal are encrypted. Messages, requests, invoice reviews and files you send through the Portal are also encrypted where the Portal stores them. Notes you add to a case are stored with the case in the Hexos platform. An email is not encrypted once it leaves the Portal.

  • Cookies and browser storage. The Portal itself sets only two cookies, both strictly necessary: one keeps you signed in, and one remembers a trusted computer for 30 days if you choose that. Our hosting provider may also set a short-lived security cookie to block automated attacks. The Portal also keeps a few settings in your browser's own storage: display and download preferences, and the time of your last activity, so that every open tab signs out together. The Portal uses no advertising, analytics or tracking cookies.

  • Your organization's administrator can see who in your organization has Portal access, and can add, narrow or remove users.

Our website. Our website is hosted by Wix. It uses only cookies that are strictly necessary for it to work; analytics and advertising cookies are turned off. If that ever changes, we will update this policy and the website's cookie notice first.

5. Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We share personal information only:

  • With patent and trademark offices and local agents, as needed to pay renewals and record changes. Offices often publish what they receive.

  • With patent and trademark offices' public registers (such as the USPTO and the EPO), which we query using case numbers to check our records.

  • With service providers who run parts of our business for us, under contracts that require them to protect it and use it only on our instructions:

  • Cloudflare (hosting, databases and file storage for the Portal, the API and our internal systems; network security; and the AI built into our systems, which runs on Cloudflare's network);

  • Backblaze (encrypted off-site backup copies of our databases and Portal files, stored in the United States — Backblaze holds only encrypted copies and cannot read them);

  • Amazon Web Services (hosting, databases, file storage and email for the Hexos renewals platform, which holds case, invoice and case-note records);

  • Microsoft (email delivery, including Portal emails, and document storage);

  • Anthropic (an AI assistant our staff use to help run and maintain our systems and to work on cases; it is not used to train AI models);

  • Wix (our website and its forms);

  • Stripe (online card and ACH payments) and our banks;

  • Wise (international payments to patent offices and agents, and refunds where used);

  • DocuSign (signing client agreements and forms);

  • our professional advisers, such as accountants and lawyers, under duties of confidentiality.

  • Within the client relationship. Information about a client's cases is shared with that client's authorized users and with integrators the client has authorized through the API.

  • For legal reasons: where the law, a court or a government authority requires it, or where needed to protect the rights, property or safety of Hexos, our clients or others.

  • In a business transfer: if Hexos is sold or merged, to the buyer, who must continue to protect it under this policy.

We keep the current list of service providers in this section and update it when it changes.

6. International transfers

We are based in the United States, and our data is stored in the United States, including our off-site backups with Backblaze (US East region); Cloudflare's network may process it in transit worldwide. To renew rights in other countries, we must send case information, which can include owners' names and addresses, to patent and trademark offices and local agents in those countries. Where the law requires, we protect transfers out of the EEA, the UK or Switzerland with appropriate safeguards, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework where a provider is certified.

7. How long we keep it

We keep personal information only as long as we need it for the purposes in section 3, then delete or de-identify it.

InformationHow long

Portal sessions: End after 30 minutes without activity, or 12 hours at most. The record of each session (time, IP address, browser) is kept with our security records.

Trusted-computer records: Stop working after 30 days, or sooner if you or we remove them

Sign-in codes and set-up or reset links: Stored only in hashed form, and stop working when they expire

Sign-in attempt counters: Deleted after about one day

Portal security and activity records (audit log): The client relationship plus 7 years

Records of terms accepted: The client relationship plus at least 7 years, as evidence of the contract

Instructions, requests and our confirmations: The life of the last right we managed for the client, plus 7 years, and longer while a claim is pending

Messages and files: The client relationship plus 7 years

Case, invoice and payment records: As long as needed to provide the services and as tax and accounting law requires (generally at least 7 years after the year of the transaction)

Website inquiries from people who do not become clients: 3 years from last contact

Marketing suppression list (people who unsubscribed): Kept indefinitely, so we never email them again

Backups: We keep encrypted backups so that we can recover records needed for renewal deadlines, our services and our legal obligations: daily copies of our database for 90 days, weekly copies for 13 months and month-end copies for 7 years. Copies of files sent through the Portal are also kept in our backups, and may remain there after the original is deleted. Backups are locked: during these periods they cannot be changed or deleted early, even by us, so information deleted from our live systems remains in our backups until those copies expire. We use backups only to recover lost or damaged information.

8. How we protect it

We use administrative, technical and physical safeguards suited to the information, including: encryption of connections; encryption of Portal messages, requests and files where stored; backups that are encrypted before they leave our systems, with the key needed to read them held only by Hexos, and an encrypted off-site copy kept with a separate provider; two-step sign-in; passwords stored only in hashed form; staff sign-in to our internal systems through our identity provider, with access limited to staff who need it; and records of sign-ins and actions. No system is completely secure. If a security breach affects your personal information, we will tell you and, where it concerns a client's information, the client, as the law requires and without undue delay.

9. Your rights

Depending on where you live, you may have the right to:

  • know what personal information we hold about you and get a copy;

  • correct it;

  • delete it (information we delete may remain in our backups until they expire, as described in section 7);

  • receive it in a portable form;

  • object to or restrict some uses, or withdraw consent; and

  • not be treated differently for using these rights.

How to ask. Email operations@hexosip.com or call +1 (877) 439-6747. We log each request and its due date when we receive it. We will confirm who you are before acting (for a Portal user, normally by asking you to confirm from your registered email address). You may use an authorized agent where the law allows; we may ask for proof of their authority. We will reply within the time the law requires, normally within 30 days (45 days for US state law requests).

When we act for a client. Where we hold your information only because a client gave it to us (for example, your name as an owner or inventor in a case record), the client decides how it is used. We will pass your request to that client and help it respond. Some information cannot be deleted while a right is maintained, because it is in the official record of the patent or trademark office. We may also keep records of instructions given to us, and of what we did, for as long as we need them to show how a right was maintained.

EEA and UK residents may also complain to their local data protection authority.

Where a privacy law does not apply to us, we still honor these requests as a voluntary commitment.

10. Marketing emails

We may send business marketing emails about our services to people at organizations we work with or that have contacted us. If you contact us through a form that says we will use your details only to reply to you, we will use them only for that, and will not add you to our marketing emails unless you ask us to. Every marketing email includes a one-click unsubscribe link, and we record unsubscribes so we do not email that address again. Marketing emails carry links personal to each recipient, so we can see whether a link was clicked. We do not use tracking pixels to record whether an email was opened. Service emails (sign-in codes, invoices, notices you chose, replies to you) are not marketing and do not carry an unsubscribe link.

11. Children

Our services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We will update this policy when our practices change. Each version shows its version number and effective date, and we keep earlier versions, which are available on request. If we make a material change, we will tell clients by email or in the Portal at least 30 days before it takes effect, unless the law requires a change sooner.

 

Version 2026.1 · Effective 18-Oct-2026 · Hexos Incorporated, d/b/a Hexos IP, 555 Fayetteville St, Ste 300, Raleigh, NC 27601-3066, USA.

bottom of page