Privacy Policy

MineralFlow AI ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use our platform at mineralflowai.com (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Account information. When you create an account, we collect your email address and a hashed password. We do not store plain-text passwords.

Search inputs and reports. When you submit a well API number, lease number, operator name, or legal description to run a due diligence report, we store that input along with the public regulatory records we retrieve and the report we generate from them.

Usage data. We collect standard server logs including IP address, browser type, pages visited, and timestamps. This helps us operate and improve the Service.

Billing information. Payment processing is handled entirely by Stripe. We do not store credit card numbers or full payment credentials. We receive and store a Stripe customer ID and subscription status.

Communications. If you contact us by email, we retain those communications to respond to you and improve the Service.

• To provide, operate, and maintain the Service.
• To retrieve public regulatory records and generate AI-powered due diligence reports.
• To manage your subscription and process payments via Stripe.
• To send transactional emails such as account confirmations and billing receipts.
• To respond to your support requests and communications.
• To detect and prevent fraud, abuse, and security incidents.
• To improve our AI models and platform using aggregated, de-identified data. We do not use your identifiable reports or search inputs to train models shared with or sold to third parties.
• To comply with legal obligations.

Your search inputs and the public regulatory records we retrieve on your behalf are processed to generate your due diligence report. We treat your reports and search history as confidential. We do not sell, rent, or share them with third parties except as necessary to operate the Service (e.g., passing search inputs and retrieved records to Anthropic's API for AI processing) or as required by law.

Anthropic processing. Your search inputs and the public regulatory records retrieved for your report are sent to Anthropic's Claude API to generate the report's analysis and narrative content. Anthropic's use of this data is governed by Anthropic's commercial terms. We use the API under agreements that restrict Anthropic from using your data to train its models.

We share limited data with the following categories of service providers to operate the Service:

• Stripe — payment processing. Receives your email and billing details to manage subscriptions.
• Supabase — cloud database and authentication. Stores account information, search history, and generated reports in secure, encrypted databases.
• Anthropic — AI report generation. Receives search inputs and public regulatory records for analysis. See Section 4.
• Vercel — hosting and CDN. Hosts the web application and processes server-side requests.
• Texas Railroad Commission (TRRC) — the source of the public regulatory records our reports are built from. We query TRRC's public well, lease, and operator databases using the identifiers you submit; no account or personal information is sent to TRRC.

We do not sell your personal information to advertisers or data brokers.

We use cookies and similar technologies to maintain your authenticated session and store preferences. We do not use third-party advertising cookies or cross-site tracking cookies. Session cookies are necessary for the Service to function; you can disable them in your browser settings, but doing so will prevent you from using the Service.

We retain your account information, search history, and generated reports for as long as your account is active. If you delete your account, we will delete your personal data and reports within 30 days, except where retention is required by applicable law or to resolve disputes. Aggregated, de-identified usage statistics may be retained indefinitely.

We implement industry-standard technical and organizational measures to protect your data, including encrypted data storage, HTTPS for all data transmission, access controls, and regular security reviews. No system is completely secure; we cannot guarantee absolute security, but we take reasonable precautions to protect your information.

Depending on your location, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of inaccurate personal data.
• Deletion. Request deletion of your personal data, subject to legal retention requirements.
• Portability. Request an export of your data in a machine-readable format.
• Objection. Object to certain processing of your personal data.

To exercise any of these rights, contact us at cbosher@mineralflowai.com. We will respond within 30 days.

If you are a California resident, you have the right to know what personal information we collect and how it is used, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at cbosher@mineralflowai.com.

The Service is not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page and updating the effective date, or by email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions or concerns about this Privacy Policy? Contact us at cbosher@mineralflowai.com.

For questions about your subscription or billing, you can also visit your billing settings or contact Stripe directly.