Privacy Policy

1. Introduction

Petrolyt ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service at https://petrolyt.app.

By using the Service, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Account Information

• Username and email address (provided during registration)
• Password (stored in hashed form; we cannot see your password)

2.2 Usage Data

• Calculations performed (type, model used, timestamp)
• Features accessed and frequency of use
• Subscription tier and plan history

2.3 Technical Data

• IP address
• Browser type and version
• Device information and operating system
• Pages visited and time spent

2.4 User-Uploaded Data

• CSV production data files you upload for analysis
• Calculation parameters and results you generate

2.5 Information We Do NOT Collect

• We do not collect payment card numbers (processed entirely by Stripe)
• We do not collect government IDs or social insurance numbers
• We do not collect location data beyond what IP addresses reveal

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Process your calculations and deliver results
• Manage your account and subscription
• Send transactional emails (account verification, password resets, billing receipts)
• Enforce usage limits based on your subscription tier
• Monitor for abuse, fraud, and security threats
• Understand usage patterns to improve features (aggregated, anonymized)

We do not use your data for:

• Targeted advertising
• Selling to data brokers or third parties
• Training machine learning models on your production data
• Profiling for non-service-related purposes

4. Payment Processing

All payment processing is handled by Stripe, Inc. When you subscribe to a paid plan, your payment information is collected and processed directly by Stripe. We receive only:

• Confirmation of successful/failed payment
• Your Stripe customer ID (for subscription management)
• Last four digits of your payment method (for display purposes)
• Billing country and postal code

We never have access to your full card number, CVV, or bank account details. Stripe's privacy policy governs their handling of your payment data: https://stripe.com/privacy

5. Data Sharing

We do not sell, rent, or trade your personal information. We share data only with:

We may also disclose information if required by law, court order, or governmental regulation, or to protect the rights, property, or safety of Petrolyt or others.

6. Cookies & Analytics

6.1 Essential Cookies. We use session cookies required for the Service to function (authentication, CSRF protection). These cannot be disabled while using the Service.

6.2 Analytics. We may use privacy-respecting analytics to understand aggregate usage patterns. We do not use invasive tracking tools like Google Analytics or Facebook Pixel.

6.3 No Third-Party Advertising. We do not serve ads and do not use advertising cookies or tracking pixels.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data transmitted over HTTPS/TLS encryption
• Passwords hashed using industry-standard algorithms (Django's PBKDF2)
• Database encrypted at rest (Railway PostgreSQL)
• Regular security updates to application dependencies
• DDoS protection via Cloudflare

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Data Retention

• Active accounts: Data retained for the lifetime of your account
• Deleted accounts: Personal data permanently deleted within 30 days
• Billing records: Retained for 7 years as required by tax law
• Server logs: Automatically purged after 90 days

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Export: Receive your data in a portable format
• Objection: Object to certain processing of your data
• Withdrawal of Consent: Withdraw consent at any time (does not affect prior processing)

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

11. International Data Transfers

The Service is hosted in North America. If you access the Service from outside Canada, your data may be transferred to and processed in Canada or the United States (where our hosting providers operate). By using the Service, you consent to this transfer.

We ensure that any data transfers comply with applicable data protection laws and that appropriate safeguards are in place.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via email where possible.

Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related inquiries or to exercise your data rights: