Privacy Policy

1. What We Collect

When you register and use Inventi Matrix, we collect the following categories of personal data:

• Account information: email address, organization name, and password (stored as a bcrypt hash — never in plaintext)
• Invention content: blueprints, patent drafts, project scan files, and memory palace entries you create
• LUMINA AI interaction data: all messages you send to LUMINA, her responses, and the Hebbian knowledge graph built from your sessions
• Usage data: which features you use, session duration, login timestamps, and IP address (for security audit purposes)
• Device & browser data: browser type, operating system, and screen size (for UI optimization)
• Consent records: your cookie and data consent choices and timestamps, stored locally

2. How We Use Your Data

Your data is used exclusively to provide, maintain, and improve the Inventi Matrix service:

• To power LUMINA's memory, growth, and invention assistance personalized to your work
• To save and retrieve your blueprints, patent drafts, and memory palace entries
• To process invention analyses through our 8-agent AI pipeline
• To maintain security audit logs (login events, admin actions)
• To detect and respond to distress signals in LUMINA conversations (see Section 6)
• To send transactional notifications about your account (tier upgrades, approvals)
• To comply with applicable legal obligations

We do not sell your data, use it for advertising, or share it with third parties outside of the service providers required to operate the platform (see Section 5).

3. AI Processing & LUMINA

Inventi Matrix uses large language models hosted on Groq infrastructure (models include Llama 3.3-70b, Qwen3-32b, and others) to power LUMINA and all invention analysis tools. When you submit content for analysis, that content is sent to these AI providers for processing. We recommend not including classified, export-controlled, or highly sensitive personal information in submissions unless operating under a signed Defense or Enterprise Agreement with appropriate data handling terms.

LUMINA's knowledge graph — the Hebbian neural map built from your conversations — is stored in our database and is private to your account. Platform-level aggregate analytics (collective neural map) are only visible to administrators.

LUMINA interaction logs (chat transcripts, memory entries, blueprint actions) are associated with your account ID and stored securely. These logs may be accessed by Physis Defense administrators for safety review, abuse investigation, or in response to a valid legal process.

4. Cookies & Local Storage

Inventi Matrix uses the following types of browser storage:

• Essential (always active): Authentication JWT tokens, session state, onboarding completion flags, and cookie consent records. These are required to operate the platform and cannot be disabled.
• Analytics (optional, opt-in): Anonymous usage data including feature interactions and session duration, stored locally or transmitted to our backend. No third-party advertising trackers are used.
• LUMINA AI interaction (optional, opt-in): Chat transcript snippets, idea prefill data, and memory palace sync state stored in browser localStorage to enable personalization and cross-tab state. Declining this category disables memory persistence and personalization features.

We do not use third-party advertising cookies, social media trackers, or cross-site tracking technologies. You may update your consent preferences at any time by clearing browser localStorage (key: im_cookie_consent_v2) and reloading the page.

5. Microphone Access & Voice Features

Inventi Matrix includes an optional Talk to LUMINA voice feature powered by your browser's built-in Speech Recognition and Speech Synthesis APIs (Web Speech API). When you activate this feature:

• Microphone access: Your browser will request permission to access your device's microphone. You must explicitly grant this permission. You can revoke it at any time through your browser's site settings (click the lock icon in the address bar → Microphone → Allow).
• Speech-to-text processing: Voice input is processed locally by your browser's native Speech Recognition engine. On Chrome and Edge, transcription may be sent to Google or Microsoft servers respectively as part of their browser speech API — this is governed by their privacy policies, not ours. We do not receive raw audio data.
• What we receive: Only the final text transcript of what you said, treated identically to a typed message. No audio files are stored on our servers.
• Screen wake lock: When voice mode is active, we request a browser Screen Wake Lock to prevent your device from sleeping mid-conversation. This accesses no personal data and is released automatically when voice mode is turned off.
• Voice is always optional: All voice features can be used or declined independently of other platform features. Declining does not affect your ability to use LUMINA via text.

By clicking Talk to LUMINA and granting microphone access, you consent to the use of your browser's speech APIs as described above.

6. Data Sharing & Service Providers

We share data with the following categories of service providers only as necessary to operate the platform:

• Groq, Inc. — AI inference API for LUMINA and agent pipeline processing
• Railway — Cloud hosting and database infrastructure (United States)
• Seamless Chex — ACH payment processing for paid subscriptions
• Vercel — Frontend hosting and CDN for dashboard.inventimatrix.com

We do not sell, rent, or trade your personal data or invention content to any third party. Each service provider is bound by data processing agreements consistent with applicable law.

7. Distress Detection

LUMINA is constitutionally required to detect and respond to human distress signals. If LUMINA detects a potential crisis in your messages, the interaction is flagged and stored in a tamper-evident distress alert log visible only to platform administrators. This is a mandatory safety feature and cannot be disabled. If you are in crisis, please contact emergency services (911) or the 988 Suicide & Crisis Lifeline.

8. Data Storage & Security

• All data is stored on Railway infrastructure in the United States
• Passwords are hashed with bcrypt (12 rounds) and never stored in plaintext
• Authentication uses JWT tokens (HS256, 24-hour expiry)
• All connections use HTTPS/TLS encryption in transit
• Access to your data is scoped — you can only access your own blueprints, memories, and chat history
• Admin actions are logged with timestamps and IP addresses

9. Data Retention

Your data is retained for as long as your account is active. If you request account deletion, we will delete your personal data, chat history, blueprints, and memory palace entries within 30 days. Security audit logs and distress alert logs may be retained for up to 24 months for safety and compliance purposes. Anonymized aggregate analytics data may be retained indefinitely.

10. Your Privacy Rights (All U.S. Residents)

Depending on your state of residence, you may have the following rights:

To exercise any of these rights, submit a request through the platform's support channel or the contact information in Section 12. We will respond within 45 days (with one 45-day extension where reasonably necessary). We will not discriminate against you for exercising any privacy right.

11. Defense & Enterprise Accounts

Defense and enterprise tier users may be subject to additional data handling agreements including Data Processing Agreements (DPAs) and, where applicable, ITAR/EAR compliance provisions. Contact us to arrange appropriate agreements before submitting any export-controlled or classified information.

12. Changes to This Policy

We may update this Privacy Policy as the platform evolves. Material changes will be communicated via in-app notification or email to registered users at least 14 days before taking effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

13. Contact & Data Requests

For privacy inquiries, data access or deletion requests, or abuse reports, contact the Inventi Matrix team through the platform's support channel or via the email associated with your administrator account. Formal legal notices must be submitted in writing to Physis Defense, LLC.

California residents may also contact us with CCPA-specific requests by identifying yourself as a California resident in your inquiry.