This Privacy Policy explains how Luki's Companies LLC, doing business as MarkHarbor ("MarkHarbor," "we," "us"), collects, uses, and protects information in connection with the MarkHarbor websites and service (the "Service"). The Service is a business product for legal professionals; we designed our data practices for that audience.
For account and billing information (who you are, how you pay), we act as the data controller. For docket data your firm enters (tracked marks, monitored attorneys, notes, client references), we act as a processor/service provider on your firm's behalf: your firm decides what goes in, and we process it only to provide the Service. A data processing addendum is available on request at [email protected].
| Category | Examples | Source |
|---|---|---|
| Account identifiers | Name, email address, password (stored only as a salted bcrypt hash), firm name, role | You, at signup |
| Docket data | Trademark serial numbers you track, attorney names you monitor, notes, deadline completion status, client reference labels | You; USPTO public records |
| USPTO records | Application status, prosecution history, owner and correspondent information | USPTO systems (public data) |
| Billing information | Plan, subscription status, invoice history. Card numbers are collected and stored by Stripe, our payment processor — they never touch our servers. | You, via Stripe |
| Technical / usage data | IP address, browser type, timestamps, request logs, a session token in your browser's local storage | Automatic |
| Communications | Emails you send us; support requests | You |
We do not collect sensitive personal information categories (health, biometrics, precise geolocation), and we ask that you not enter privileged client communications — the Service needs only identifiers and docketing details.
What we don't do: we do not sell or "share" (as defined by U.S. state privacy laws) personal information; we do not use your docket data to train machine-learning or generative-AI models; we do not serve ads or use advertising trackers; and we make no decisions producing legal or similarly significant effects about individuals by solely automated means.
Your firm's docket — tracked marks, deadlines, alerts, notes — is visible only to your firm's users. Isolation is enforced in the application and again at the database layer through row-level security. USPTO records themselves are public data.
We disclose personal information only to:
The Service is hosted in the United States, and information we collect is processed in the United States. If you use the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S., where privacy laws may differ from those of your jurisdiction. Where required, we rely on appropriate safeguards for such transfers.
Measures include: TLS encryption in transit; passwords stored only as salted bcrypt hashes; databases not exposed to the public internet; least-privilege database roles with row-level security enforcing tenant isolation; per-IP rate limiting on authentication; multi-factor-protected infrastructure accounts; and daily encrypted backups. No system is perfectly secure — please use a strong, unique password. If we learn of a breach affecting your personal information, we will notify affected customers without undue delay consistent with applicable law and provide information needed for your own obligations.
Depending on your jurisdiction (including under state privacy laws such as the California Consumer Privacy Act), you may have rights to:
To exercise rights, email [email protected] from your account address (or have your authorized agent do so with proof of authorization). We will verify requests against account information and respond within the time required by law. If your information is in a firm's docket, we may refer the request to that firm as the controller. You can also access and update most account information directly in the Service. Deleting your firm's account ends monitoring of your tracked marks.
The application uses browser local storage for a session token and basic profile details — strictly necessary for signing you in; no advertising or analytics trackers. The marketing site sets no cookies. Because we don't track visitors across sites, we do not respond differently to "Do Not Track" signals; universal opt-out signals (such as GPC) are honored to the extent they apply — noting again that we sell and share nothing. Third-party pages you reach from the Service (for example Stripe checkout) have their own policies.
The Service is for professional use, is not directed to anyone under 18, and we do not knowingly collect information from children.
Docket data may include names of attorneys of record and mark owners drawn from public USPTO records, and client reference labels your firm enters. Your firm is responsible for having an appropriate basis for the client information it enters; we process it only on your firm's instructions as described above.
We may update this Policy. For material changes we will give notice through the Service or by email before the changes take effect. The dates above reflect the latest revision.
Luki's Companies LLC, d/b/a MarkHarbor — [email protected]