Privacy Policy

Mineral Flow AI ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use our platform at mineralflowai.com (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Account information. When you create an account, we collect your email address and a hashed password. We do not store plain-text passwords.

Uploaded documents. When you upload a document (deed, lease, division order, royalty statement, or similar instrument), we store the file and the data extracted from it. This may include property descriptions, ownership information, financial figures, and other content appearing in the document.

Usage data. We collect standard server logs including IP address, browser type, pages visited, and timestamps. This helps us operate and improve the Service.

Billing information. Payment processing is handled entirely by Stripe. We do not store credit card numbers or full payment credentials. We receive and store a Stripe customer ID and subscription status.

Communications. If you contact us by email, we retain those communications to respond to you and improve the Service.

• To provide, operate, and maintain the Service.
• To process uploaded documents and generate AI-powered analysis and outputs.
• To manage your subscription and process payments via Stripe.
• To send transactional emails such as account confirmations, billing receipts, and lease expiration alerts you have opted into.
• To respond to your support requests and communications.
• To detect and prevent fraud, abuse, and security incidents.
• To improve our AI models and platform using aggregated, de-identified data. We do not use your identifiable documents to train models shared with or sold to third parties.
• To comply with legal obligations.

Documents you upload are processed to provide the Service to you. We treat uploaded documents and the data extracted from them as confidential. We do not sell, rent, or share your documents or their extracted contents with third parties except as necessary to operate the Service (e.g., passing document text to OpenAI's API for AI processing) or as required by law.

OpenAI processing. Document text is sent to OpenAI's API to perform AI extraction and analysis. OpenAI's use of this data is governed by OpenAI's API data usage policies. We use the API under agreements that restrict OpenAI from using your data to train its models.

We share limited data with the following categories of service providers to operate the Service:

• Stripe — payment processing. Receives your email and billing details to manage subscriptions.
• Supabase — cloud database and authentication. Stores account information, document records, and extracted data in secure, encrypted databases.
• OpenAI — AI document analysis. Receives document text for extraction and analysis. See Section 4.
• Vercel — hosting and CDN. Hosts the web application and processes server-side requests.
• State government APIs — publicly available well data APIs (Texas RRC, North Dakota NDIC, Oklahoma OCC, West Virginia DEP, Ohio DNR). Only county/location data is sent; no personal information is transmitted.

We do not sell your personal information to advertisers or data brokers.

We use cookies and similar technologies to maintain your authenticated session and store preferences. We do not use third-party advertising cookies or cross-site tracking cookies. Session cookies are necessary for the Service to function; you can disable them in your browser settings, but doing so will prevent you from using the Service.

We retain your account information and uploaded documents for as long as your account is active. If you delete your account, we will delete your personal data and documents within 30 days, except where retention is required by applicable law or to resolve disputes. Aggregated, de-identified usage statistics may be retained indefinitely.

We implement industry-standard technical and organizational measures to protect your data, including encrypted data storage, HTTPS for all data transmission, access controls, and regular security reviews. No system is completely secure; we cannot guarantee absolute security, but we take reasonable precautions to protect your information.

Depending on your location, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of inaccurate personal data.
• Deletion. Request deletion of your personal data, subject to legal retention requirements.
• Portability. Request an export of your data in a machine-readable format.
• Objection. Object to certain processing of your personal data.

To exercise any of these rights, contact us at cbosher@mineralflowai.com. We will respond within 30 days.

If you are a California resident, you have the right to know what personal information we collect and how it is used, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at cbosher@mineralflowai.com.

The Service is not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page and updating the effective date, or by email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions or concerns about this Privacy Policy? Contact us at cbosher@mineralflowai.com.

For questions about your subscription or billing, you can also visit your billing settings or contact Stripe directly.