Privacy Policy

Information We Collect

We collect only what we need to run PetroOS for you.

• Account information: your name, business email, company, and job title when you sign up or contact us.
• Organization & operational data: wells, leases, batteries, tanks, run tickets, meter readings, purchaser statements, filings, contracts, and documents you and your team put into PetroOS.
• Contacts: working-interest owners, royalty owners, landowners, purchasers, and vendors you enter to run your operations.
• Location data: well and facility coordinates you enter or geocode.
• Billing information: handled by Stripe. Stripe stores card details; PetroOS receives only tokens, last-4, brand, expiration, and billing address.
• Device & log data: IP address, browser, timestamps, and error/audit logs used for security, debugging, and abuse prevention.
• Legal acceptance records: the version of any legal document you accepted, your IP, and the timestamp — kept as evidence of consent.

We do not knowingly collect information from anyone under 18, and the Service is not directed to consumers or personal use.

How We Use Your Information

We use your information to:

• Provide and maintain PetroOS for your organization.
• Process production data, generate reports and filings, and route revenue and JIB information.
• Authenticate users, enforce role-based access, and secure the Service.
• Bill your subscription and support tax handling through Stripe.
• Send transactional messages (verification, invoices, alerts, feature-critical notices) and, where permitted, product updates you can opt out of.
• Detect abuse, investigate incidents, and comply with legal obligations.
• Improve the Service, including aggregated, de-identified usage analytics. We do not use Your Data to train third-party AI models for other customers.

Storage & Security

We take security seriously and use the following controls:

• Encryption: data in transit is protected with TLS; data at rest is encrypted by our infrastructure provider.
• Row-level security: the database enforces per-organization isolation so users only see their own org's data.
• Role-based access: in-app roles (e.g., admin, operator, viewer, pumper) scope what users can see and do.
• Audit logs: privileged actions and admin access are logged.
• Backups: automated backups with point-in-time recovery via our infrastructure subprocessor.
• Code review: changes are reviewed before deployment; secrets are stored in a managed vault, not in the codebase.

No system is perfectly secure. If you have a specific security or compliance question, email hello@petroos.com.

Sharing

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share information only in these cases:

• Subprocessors: vendors that help us run PetroOS, bound by written data-protection terms. See the Subprocessors list below.
• At your direction: when you configure sharing inside the Service (JIB statements, division-order distributions, purchaser exports, etc.) or when you invite users.
• Legal requirements: to comply with valid subpoenas, court orders, or applicable law. We push back on overbroad requests where reasonable.
• Corporate events: in a merger, acquisition, or sale of assets, subject to this Privacy Policy remaining in force for your information.
• Safety and enforcement: to enforce our Terms, prevent fraud, or protect the rights and safety of PetroOS, you, or others.

Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information, subject to legal retention requirements.
• Export a copy of your data in a structured, machine-readable format.
• Opt out of non-essential marketing email at any time.

Most of these are self-service inside PetroOS. For anything else, email hello@petroos.com from the address on your account. If you are an employee or contact of a PetroOS customer, please contact that customer first — for their data they are the controller and we act on their instructions.

California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and non-discrimination for exercising those rights.

Retention

Cancelling does not delete anything on its own. Access narrows in stages, and your records stay intact so you can come back to them:

• Active (While subscribed). Full access. Everyone on the workspace can read and write.
• Read-only grace (90 days after cancellation). You can still sign in, view everything and export all of it. New entries are blocked. Nothing is deleted.
• Dormant (Up to 7 years). The workspace closes but your records are retained. Resubscribe to reopen it exactly as you left it, or ask us for an export at any time.
• Eligible for destruction (After the record clock runs out). Non-regulatory data is destroyed. Regulatory, tax and audit records are kept for seven years from the date of the record itself, not from the date you left.

How long each kind of record is held:

• Regulatory & production records — 7 years from record date. Run tickets, gauge sheets, PR filings, gas statements, well tests, meter readings.
• Tax & financial records — 7 years from record date. Revenue distributions, JIB and expense history, W-9 and 1099 data, invoices, payments.
• Operational records — Retained while dormant, destroyed on request. Work orders, routes, inspections, equipment history, uploaded documents.
• Personal information — Removed on request, without touching company records. Names, emails, phone numbers, logins, notification preferences.
• Legal acceptance evidence — Life of the relationship plus statutory periods. Terms version accepted, IP address, timestamp.

You may ask us to delete your data at any time from Settings → Organization → Privacy & data deletion. Requests are reviewed by our team: we confirm what can lawfully be destroyed, what is still under a regulatory or tax hold, and give you a written record of what was removed. We may retain minimal records needed for legal defense, fraud prevention, or to enforce our agreements. Encrypted backup copies age out on our normal backup rotation.

Cookies & Local Storage

Cookie disclosure version 2026-08-23

PetroOS uses essential cookies and local storage only, for sign-in, security, and payments. We do not use advertising cookies, cross-site tracking, or behavioral profiling.

What we do not use

• No advertising or retargeting cookies.
• No cross-site tracking pixels.
• No selling of browsing data to third parties.

Managing cookies

Because every cookie we set is essential to running PetroOS, we do not offer an in-app opt-out. You can clear or block cookies through your browser settings, but blocking essential cookies will prevent you from signing in or checking out.

Subprocessors

Subprocessors list version 2026-07-26

A subprocessor is a third-party service that processes customer data on our behalf to help us deliver PetroOS. Below is the current list, kept up to date as our stack changes. Customers processing personal data through PetroOS should also review our Data Processing Addendum.

Change policy

This section is our official notice mechanism for subprocessor changes. When we add or replace a subprocessor that processes customer personal data, we update this list and bump the version above. For material additions we also email organization admins within seven (7) days of the change.

Continued use of PetroOS after a change constitutes acceptance. If a subprocessor change is unacceptable to you, you may cancel your subscription and request data export under our Terms of Service.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.