Privacy Policy

This Privacy Policy describes how Black Gold Analytics LLC (“Black Gold Analytics,” “we,” “us,” or “our”) collects, uses, and protects information in connection with our web-based oil and gas well management and analytics platform (the “Service”). The Service is a business tool provided to organizations (our “Customers”) and their authorized users. By using the Service, you agree to the practices described in this policy.

1. Information We Collect

Account information

When an organization administrator creates a user account, we collect the user's name, email address, assigned role, and organization affiliation. We also store authentication credentials (passwords are stored only as salted cryptographic hashes) and login activity records (email, IP address, time, and outcome of sign-in attempts) for security auditing.

Business and financial data

Customers upload or import operational and financial records into the Service, including well information, production data, revenue and expense statements, ownership interests, organization income and expenses, and related documents (PDF, Excel, and CSV files). From these records the Service computes derived information for the Customer, such as well ownership history, statement validations, dashboards, and reports. This data belongs to the Customer; we process it solely to provide the Service.

Organization email inbox

Each organization can be given its own email address for forwarding statements. For email sent to that address, we receive and store the sender address, subject, body text, and any attachments in supported formats (PDF, Excel, CSV). The attachments are placed in the organization's File Inbox, and lines in the email body may be used to tag them (for example, with a company or report date).

Gmail data (optional integration)

Users may optionally connect a Gmail account to automatically import report attachments. If you connect Gmail:

• We access only messages that match import rules you define (sender, subject, keyword, and date filters).
• We retrieve matching messages' subject line, sender address, body text, and file attachments in supported formats (PDF, Excel, CSV).
• We store the attachment files you import, and a record of each processed message (subject and sender) so the same message is not imported twice.
• We store the OAuth refresh token needed to maintain the connection, encrypted at rest. It is never displayed to any user or administrator.
• If your rule enables it, we mark imported messages as read in your mailbox. We make no other changes to your mailbox, and we never send email on your behalf.
• You can disconnect Gmail at any time from your Settings page, which deletes the stored token. Your organization's administrator or our staff may also remove the connection (for example, when offboarding), which likewise revokes our access with Google.

QuickBooks Online (optional integration)

An organization administrator may connect a QuickBooks Online company so that the organization's own income and expenses flow into the Service. If you connect QuickBooks, we read accounting data from that company (such as accounts, items, transactions, and the names of vendors, customers, and employees used as payees) from the sync start date you choose. We do not write to your QuickBooks company. The OAuth tokens needed to keep the connection are encrypted at rest and are never displayed. Disconnecting QuickBooks deletes the stored tokens; entries already synced remain in your organization's workspace until deleted.

Payment information

Invoice payments are made through Stripe's hosted checkout. Card and bank details are entered directly with Stripe and are not received or stored by us. We keep a record of each payment (such as the amount, date, invoice, and Stripe payment reference).

Usage and technical information

We collect service telemetry needed to operate and bill for the Service, including counts of automated processing requests attributable to your organization, application logs and error reports, performance monitoring, and session cookies required for sign-in.

Website visits and analytics cookies

When you visit our public website (for example, the home, pricing, about, and free trial pages) without being signed in, we record which pages you open, when, whether you are on a phone, tablet, or computer, the website or link that brought you to us (for example, a search engine, a social media post, or a link with a campaign tag), and the first page you saw. We use two cookies for this: one holds a random visitor identifier for up to one year, so that repeat visits count as one visitor, and one remembers where you first came from for up to 30 days. If you start a free trial, where you first came from is saved with your sign-up. We do not record your IP address with these visits, and they do not include your name or email address. We use this information only to understand how people find us and how well our website works.

We also use Google Analytics, which sets its own cookies and collects information about your visit, including your IP address, on Google's behalf. You can learn how Google uses this information at How Google uses information from sites that use its services, and you can opt out with the Google Analytics opt-out browser add-on. We do not use advertising cookies, and we do not sell or share visit information for advertising.

2. How We Use Information

• To provide, maintain, secure, and improve the Service;
• To extract structured data from documents and emails you submit for import, and to provide the optional AI features described in Section 3;
• To compute derived information for your organization, such as ownership history, validations, dashboards, and reports;
• To authenticate users and protect against unauthorized access;
• To calculate usage for billing purposes;
• To communicate with you about your account (e.g., registration, notification, and digest emails);
• To process invoice payments;
• To comply with legal obligations.

We do not sell personal information, and we do not use your data for advertising.

3. Automated Processing (AI)

The Service uses OpenAI, our machine-learning service provider, for the features below. Per our service agreement with OpenAI, data submitted through its business API is not used to train OpenAI's models.

• Document extraction. To convert uploaded statements and imported email content into structured records, the Service sends the text of those documents and emails to OpenAI.
• Scanned pages (optional). If your organization turns on AI reading of scanned PDFs, an image of each page that has no text layer is sent to OpenAI to be transcribed.
• In-app assistant (Derrick). When you ask Derrick a question, your question, the conversation so far, and the records from your organization's workspace needed to answer it are sent to OpenAI. We do not store assistant conversations.
• Findings summary (optional). For organizations with Findings, figures the Service has already computed for the latest month (such as revenue, expense, and top wells) are sent to OpenAI to write a short plain-language summary.
• Error diagnosis. Our staff may send an application error report, which can include data involved in the failed request, to OpenAI to help diagnose it.

Imported records are shown for review before they are saved, unless your organization chooses to import files automatically when they match a saved import profile. Imported statements are also checked by the Service's validations. AI-generated text is labeled as such.

4. Service Providers (Subprocessors)

Each provider processes data only as needed to perform its function for us and is bound by contractual confidentiality and data protection obligations.

Some pages also load content directly from third parties in your browser: maps of well locations from HERE and OpenStreetMap, and web fonts from Google Fonts. Those requests include your IP address and, for maps, the area being shown; they do not include your account details.

5. Data Security

We use industry-standard safeguards, including encryption of data in transit (TLS), encryption of sensitive credentials at rest (including Gmail and QuickBooks OAuth tokens), hashed passwords, role-based access controls, tenant isolation between organizations, and audit logging of privileged administrative actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention and Deletion

We retain Customer data for as long as the Customer's account is active or as needed to provide the Service. Customers may delete records, files, and user accounts through the Service. When an organization's account is terminated, we delete or de-identify its data within a commercially reasonable period, except where retention is required for legal, billing, or security purposes. Disconnecting Gmail or QuickBooks immediately deletes the stored access tokens; previously imported files and synced entries remain in your organization's workspace until deleted. Details of individual website visits are kept for 90 days; after that, only daily totals (for example, the number of visitors to each page from each source) are kept.

7. Your Rights and Choices

Depending on your state of residence, you may have rights to access, correct, delete, or obtain a copy of your personal information. Because we process most data on behalf of our business Customers, requests from an organization's users may be fulfilled in coordination with that organization's administrator. To exercise any right, contact us at the address below. We will not discriminate against you for exercising your rights.

You can delete or block cookies in your browser's settings. Blocking our analytics cookies does not affect how our website works; we will still count your page views, but without a visitor identifier.

8. Children's Privacy

The Service is a business application not directed to children under 13, and we do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this policy from time to time. We will post the revised version here with an updated date and, for material changes, notify Customers through the Service or by email.

10. Contact Us

BlackGold Analytics LLC
2811 Lost Field Ln, Richmond, TX 77406
Email: admin@BlackGoldAnalytics.com

Read our Terms of Use →