1. Overview
Avanti Mind Ltd (“we”, “us”, “our”) operates Avanti Notum, a trade mark risk screening tool accessible at avantinotum.com. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our service.
We are committed to handling your personal data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Avanti Mind Ltd acts as the data controller for the personal data you provide when using Avanti Notum. We are a company registered in England and Wales (company number 16049394, registered office The Venture Centre Sir William Lyons Road, University Of Warwick Science Park, Coventry, England, CV4 7EZ) and are registered with the Information Commissioner’s Office under number ZC172544. We have not appointed a data protection officer; the processing described here does not require one.
This policy applies to personal data collected via the Avanti Notum platform. It does not cover data practices of third-party services linked from our platform.
2. What We Collect
We collect the following categories of personal data:
Account information
- Name: provided when you register for an account.
- Email address: used for authentication, account management, and service communications.
- Password: stored in hashed form; we never store plain-text passwords.
Search and usage data
- Search queries: the trade mark names and terms you enter into Avanti Notum, together with the Nice Classification classes selected.
- Screening results and similarity scores: outputs generated for your queries, including data drawn from the UK trade marks register.
- Usage metadata: timestamps, search frequency, and subscription tier, used to manage service limits and improve the platform.
Payment information
- Payment details (card number, expiry, CVC) are processed exclusively by Stripe. We receive only limited billing metadata such as the last four digits of your card, card type, and billing address, for account and subscription management purposes.
- We do not store your full card details on our servers at any time.
Technical data
- IP address and browser information, collected for security, fraud prevention, and service diagnostics.
- Session and authentication tokens, stored temporarily in your browser.
What is sent to AI providers
We send information to an AI provider only when you use a feature that needs one, and only while that feature is switched on; a search that uses none of them sends nothing to any AI provider. When AI conceptual scoring or a risk explanation is produced for a search, the name or mark you searched for and the marks it is compared with are sent to our AI inference provider. When you ask for suggested classes, a drafted goods and services specification or name suggestions, what you type for that request (such as a business description, a name and its classes) is sent to our AI inference provider. When you upload a logo to compare, the image is sent to it. When names are compared by meaning, the name you search for is sent to our embedding provider to be turned into a vector. The providers, their roles and the location recorded for each are listed in section 7.
We do not send your name, email address, password, payment details or account identifiers to these providers.
3. How We Use Your Data
We use your personal data for the following purposes:
- Service delivery: processing your trade mark searches, generating similarity scores, checking the UK trade marks register on your behalf, and presenting results.
- Account management: authentication, subscription management, and responding to support requests.
- Billing: managing your subscription via Stripe and tracking search usage against your plan limits.
- Service improvement: analysing aggregated usage patterns to improve search accuracy, similarity scoring, and overall platform quality. Individual search queries are not shared externally for this purpose.
- Legal compliance and security: detecting and preventing fraud, abuse, or unauthorised access, and complying with applicable legal obligations.
- Communications: sending transactional emails (account confirmation, password reset, subscription notices). Marketing communications are only sent with your explicit consent.
Our legal basis for processing your data is primarily the performance of a contract (providing the Avanti Notum service to you) and, where applicable, our legitimate interests in operating a secure and reliable platform. Payment data processing is covered by our contractual relationship with you and Stripe’s own processing agreements.
4. Data Retention
We retain your personal data for as long as your account remains active and for a reasonable period thereafter to fulfil legal and operational obligations.
Specific retention periods
- Search history: retained for 12 months from the date of each search. After this period, individual search records are deleted automatically.
- Account data (name, email): retained for the duration of your account and deleted within 30 days of account closure, subject to any legal retention obligations.
- Billing records: retained for 7 years in accordance with UK financial record-keeping requirements.
- Security and audit logs: retained for up to 90 days for fraud prevention and security investigation purposes.
You may request earlier deletion of your data, subject to legal retention obligations, via the account deletion feature in your account settings or by contacting us directly.
5. Your Rights (UK GDPR)
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
- Right of access: You may request a copy of the personal data we hold about you. We will respond within 30 days.
- Right to rectification: You may request that we correct inaccurate or incomplete personal data.
- Right to erasure: You may request that we delete your personal data where there is no compelling reason for its continued processing.
- Right to data portability: You may request your data in a structured, commonly used, machine-readable format. Use the data export feature in your account settings or contact us directly.
- Right to restrict processing: You may request that we limit how we use your data in certain circumstances.
- Right to object: You may object to processing based on legitimate interests.
- Right to complain to us: You may complain to us about how we handle your personal data. Use our contact page and say that it is a complaint; we will acknowledge it within 30 days and tell you the outcome.
To exercise any of these rights, please contact Avanti Mind Ltd through our contact page. We will respond within 30 days of receiving your request. You also have the right to complain to the Information Commission (formerly the Information Commissioner’s Office) at ico.org.uk or on 0303 123 1113. Your name, email address and payment details are needed to open an account and to pay for a plan or report; without them we cannot provide the service. Our scoring is automated, but it does not make any decision about you that has a legal or similarly significant effect: it gives you information for your own decision.
7. Third Parties and Recipients
We share limited personal data with the following recipients in order to operate the Avanti Notum service. The list below is the same register that is published on our sub-processors page.
- AWS: Transactional email (Amazon SES). Provided by Amazon Web Services EMEA SARL (Luxembourg), with Amazon Web Services, Inc. as a DPA party. Country: Europe (London) region, eu-west-2, United Kingdom. Safeguard: UK Addendum to EU SCCs.
- Amazon Bedrock: AI inference host: runs Anthropic's Claude models in Europe for the app's AI features, as a sub-processor that OpenRouter engages under its data processing agreement with us; we have no data processing agreement of our own with it. Country: Europe (the EEA, the UK or Switzerland), on OpenRouter's European in-region endpoints. Safeguard: UK adequacy regulations (EEA, Switzerland); none needed in the UK.
- Anthropic: AI models (Claude), used directly by our support system to sort and route contact and support messages. The app's AI features do not reach Anthropic: OpenRouter sends them to Amazon Bedrock or Google Vertex AI in Europe. Provided by Anthropic Ireland, Limited. Country: Stored in the United States; by default inference may run in any available geography (Anthropic names the US, Europe, Asia and Australia). Safeguard: UK Addendum to EU SCCs.
- Google Vertex AI: AI inference host: runs Anthropic's Claude models in Europe for the app's AI features, as a sub-processor that OpenRouter engages under its data processing agreement with us; we have no data processing agreement of our own with it. Country: Europe (the EEA, the UK or Switzerland), on OpenRouter's European in-region endpoints. Safeguard: UK adequacy regulations (EEA, Switzerland); none needed in the UK.
- OpenRouter: AI inference gateway: sends each request through its European in-region endpoint to Anthropic's Claude models run in Europe by Amazon Bedrock or Google Vertex AI only, with no fallback to another provider; processes prompts under its own data processing terms. Provided by OpenRouter, Inc. (United States). Country: Europe (the EEA, the UK or Switzerland) for prompts and completions; account, billing, authentication, security-log, abuse-monitoring and other operational records may be held in the United States. Safeguard: UK Addendum to EU SCCs.
- Scaleway: Hosting, database, file storage and our own mail server. Provided by Scaleway SAS (France). Country: Paris, France (fr-par region). Safeguard: UK adequacy regulations (EEA).
- Stripe: Payment processing. Provided by Stripe Payments Europe, Limited (Ireland), with Stripe Payments UK Ltd; US importer Stripe, LLC. Country: United States (Stripe, LLC). Safeguard: UK-US Data Bridge (DPF certified).
- Voyage: Embeddings: turning the names you search for, and the opening of contact and support messages, into vectors. Provided by Voyage AI Innovations, Inc. (a MongoDB company). Country: United States (no region stated). Safeguard: UK Addendum to EU SCCs.
Contact and support messages
Messages you send through our contact and support forms are held in our support system, hosted by Scaleway SAS in Paris, France. To sort and route them we use Anthropic Ireland, Limited (data stored in the United States) under its Data Processing Addendum incorporating the EU Standard Contractual Clauses and the UK Addendum, and Voyage AI Innovations, Inc. (United States, a MongoDB company) under its Data Processing Agreement incorporating the EU Standard Contractual Clauses and the UK Addendum. Replies are sent from our own mail server in Paris.
AI inference and embedding providers
Every AI inference provider and every embedding provider we use is named here with its role and the location recorded for it in the same register as the list above. Where no location has been recorded, it says so.
- OpenRouter (inference gateway, European in-region endpoint). Role: Routes each inference request, through its European in-region endpoint, to Anthropic's Claude models run in Europe by Amazon Bedrock or Google Vertex AI only, with no fallback to another provider, for conceptual scoring, risk explanations, classification of a business description into suggested classes, drafting, name suggestions, comparison and Vienna classification of an uploaded logo, and extraction from published tribunal decisions; processes prompts under its own data processing terms. Location: Europe (the EEA, the UK or Switzerland) for prompts and completions; account, billing, authentication, security-log, abuse-monitoring and other operational records may be held in the United States.
- Amazon Bedrock (inference model host, a sub-processor of OpenRouter). Role: Runs the Claude models that answer those requests in Europe, as one of the two sub-processors OpenRouter may choose for each request. Location: Europe (the EEA, the UK or Switzerland), on OpenRouter's European in-region endpoints.
- Google Vertex AI (inference model host, a sub-processor of OpenRouter). Role: Runs the Claude models that answer those requests in Europe, as one of the two sub-processors OpenRouter may choose for each request. Location: Europe (the EEA, the UK or Switzerland), on OpenRouter's European in-region endpoints.
- Anthropic (model developer; inference provider for our support system). Role: Develops the Claude models. The app's AI features do not send requests to Anthropic: Amazon Bedrock or Google Vertex AI run the models for OpenRouter in Europe. Our support system calls Anthropic directly to sort and route contact and support messages. Location: Stored in the United States; by default inference may run in any available geography (Anthropic names the US, Europe, Asia and Australia).
- Voyage (embedding). Role: Embeddings: turning mark text into vectors for the conceptual comparison. Location: United States (no region stated).
Where your data goes
Some of the providers above are outside the United Kingdom. Transfers to the European Economic Area and Switzerland are approved by UK adequacy regulations. For a provider in the United States we rely on the safeguard shown against it in the register: either the UK extension to the EU-US Data Privacy Framework, where the provider is certified under it, or the UK Addendum to the EU standard contractual clauses in our contract with that provider. You can ask for a copy of the safeguard through our contact page. We do not send personal data to any provider whose location and safeguard are not recorded in the register.
Stripe
Payment processing is handled by Stripe (Stripe Payments Europe, Limited, with Stripe Payments UK Ltd, and Stripe, LLC in the United States). When you subscribe to a paid plan, your payment details are transmitted directly to Stripe. We receive subscription status and billing metadata from Stripe to manage your account. Stripe’s privacy practices are governed by the Stripe Privacy Policy.
UK Intellectual Property Office
When you run a search, Avanti Notum screens the UK trade marks register. Most checks run against our own copy of the register’s published data. Where a live lookup is needed, the name and classes you enter may be sent to the UK Intellectual Property Office’s public search service, directly or through a web retrieval service we use for that lookup. No personal account data is sent with a search. The UK Intellectual Property Office’s data practices are governed by its own policies, available at gov.uk.
We do not sell your personal data to any third party. We do not use your data for targeted advertising.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:
- Encryption in transit (HTTPS/TLS) for all data exchanged with our platform.
- Hashed storage for passwords using industry-standard algorithms.
- Access controls limiting which personnel can access production data.
- Regular security reviews of our infrastructure and dependencies.
No method of transmission or storage is entirely secure. If you have reason to believe your account has been compromised, please contact us immediately through our contact page.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date at the top of this page. For material changes that affect how we use your data, we will notify you by email or via an in-product notice.
Continued use of Avanti Notum after a revised policy is published constitutes acceptance of the updated terms.
10. Contact
For any questions, concerns, or data subject requests regarding this Privacy Policy, please contact Avanti Mind Ltd through our contact page.
Avanti Mind Ltd, company number 16049394. Registered office: The Venture Centre Sir William Lyons Road, University Of Warwick Science Park, Coventry, England, CV4 7EZ. ICO registration number: ZC172544.