Skip to main content
Back to Home

Privacy Policy

Last updated: September 10, 2026

Introduction

Petrolytx ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-assisted capital decision platform for unconventional oil & gas. This policy covers the Petrolytx website and its iPhone and iPad companion app.

Data We Collect

Account Information

  • Email address
  • Display name
  • Profile photo (if provided)
  • Company name (optional)

Data You Provide

  • Well data (API numbers, names, locations, operators)
  • Production data (oil, gas, water volumes)
  • Decline curve forecasts and parameters
  • Economic scenarios and assumptions
  • Project names and descriptions

Usage Information

  • Features accessed and actions taken
  • Session duration and frequency
  • Device type and browser information
  • Error logs for troubleshooting

Payment Information

Payment processing is handled by Stripe. We do not store your credit card numbers. We receive only transaction confirmations and subscription status from Stripe.

iPhone and iPad Companion

The companion uses your Petrolytx account to retrieve saved analyses and synchronize your saved list and private notes. Account information can include your name, email address, account identifiers, and profile-image URL supplied by your sign-in provider. Apple and Google process sign-in information under their own privacy policies.

Downloaded briefs and notes are encrypted on your device. This local store is excluded from device backups, so unsent drafts cannot be restored on another device. Sample notes stay on your device. Notes for your account are sent to Petrolytx when they synchronize. Signing out removes downloaded content; you can choose to keep encrypted unsent drafts for the same account. Synchronize pending notes before requesting an account export.

Firebase and Google Sign-In process account, request, device, usage, and diagnostic information to provide sign-in, protect the service, and evaluate their SDKs. Google Sign-In's SDK disclosures include account and device identifiers, name, email address, phone number, approximate location, and other usage and service data. Google may estimate approximate location from an IP address for fraud prevention. Firebase App Check uses Apple App Attest evidence to verify requests, and backend services process request metadata including IP addresses. Operational logs can include account identifiers and request or error details for security and troubleshooting. If a request is malformed, error logs may include its submitted data. These service and SDK operations are separate from the website's optional Google Analytics and cookie preferences.

The companion does not display advertising or use data for cross-app advertising tracking. It does not request device location, camera, microphone, or contacts access. Keyboard dictation supplies text through your keyboard; Listen to brief uses system speech output.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and similar privacy laws, you have the following rights:

Right to Access

You can download the registered Petrolytx account archive from Settings > Data & Export.

Right to Rectification

Update your information anytime in Settings > Profile.

Right to Erasure

Delete your account and Petrolytx account data from Settings > Security. Payment providers may retain records where financial or legal obligations require it.

Right to Portability

Download account data as a ZIP containing JSON and stored files, or export wells as CSV.

In the companion, open Account and settings > Delete account to request account deletion. Export your account data opens the web export controls. After the service confirms deletion, the app removes local records and drafts on the device making the request. Other devices that are offline may retain downloaded copies. A server export does not include unsynchronized local drafts.

Data Retention

We retain your data while your account is active. Upon account deletion:

  • We remove your account, saved analyses, notes, and other account content from the active Petrolytx service. Other copies under our direct control are removed within 30 days, except backups and retained records described below.
  • Backups under our direct control are purged within 90 days. Service providers may use different schedules: Firebase Authentication states that removal from its live and backup systems can take up to 180 days after account deletion is initiated.
  • Limited account identifiers, deletion records, and security logs may remain to prevent deleted accounts or data from being restored, investigate abuse, or meet legal obligations. Operational logs are normally retained for 30 days; provider audit records can be retained longer.
  • Anonymized analytics may be retained indefinitely
  • Billing records are retained as required by law

Account deletion revokes access to the service. Export any data you need before confirming deletion; a retention period does not extend account access after a deletion request.

Data Security

We implement industry-standard security measures to protect your data:

  • Network communications are protected using HTTPS/TLS
  • Data at rest is encrypted using AES-256
  • The companion encrypts downloaded briefs and local notes with AES-256-GCM and device-only Keychain keys
  • Access to production systems is restricted and audited
  • Built on Google Cloud infrastructure

Third-Party Services

We use the following third-party services to operate Petrolytx:

Google Firebase - Authentication, database, hosting, backend functions, and App Check
Apple and Google Sign-In - Account authentication; Apple App Attest also helps verify requests from the companion
Stripe - Web payment processing and subscription management
Google Analytics - Optional website usage analytics, separate from native service and SDK diagnostics
Google Vertex AI (Gemini) - Writes the cited Capital Dossier narrative requested on the web; case data is sent only for that request
Formspree - Processes messages submitted through our contact form

Cookies

The website uses cookies and similar technologies for:

  • Essential: Authentication and session management
  • Functional: Remembering your preferences
  • Analytics: Understanding how the platform is used (with consent)

You can manage cookie preferences through the cookie consent banner or your browser settings.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: support@petrolytx.com

Subject: Privacy Inquiry

Policy Updates

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or by posting a notice on our platform. Your continued use of Petrolytx after such modifications constitutes your acknowledgment and agreement to the updated policy.