- The short version
- What we collect
- Why we hold it
- What we never do
- Who else touches it
- Public agency records
- The operator directory and outreach
- Photographs and document intelligence
- Cookies and tracking
- How long we keep things
- How it is protected
- Your rights over your data
- Children
- Where the data lives
- Changes to this policy
- Contact
The short version
The rest of this page is the detail behind that. It is written to be read rather than to be defensible, so if something here is unclear, that is a fault worth telling us about.
What we collect
| What | Where it comes from |
|---|---|
| Account details — your email address, organization name, agency operator number and state | You, when you sign up |
| Workspace contents — wells, leases, production volumes, documents, surveys, filing history and anything else you put in | You, as you work |
| Billing records — invoices we raised, what was paid, when, and by what method | Us, as we bill you |
| Sign-in records — when you signed in, from which IP address, and how many sessions are open | Automatically, to keep the account secure |
| Support correspondence — what you wrote to us and what we replied | You, when you contact us |
We do not collect payment card numbers. Card details are entered on our payment provider's own hosted page and never reach a WellSite server.
Why we hold it
Account details identify you and provision the right wells into your workspace. Workspace contents are the product. Billing records are how we invoice you and how we answer questions about what you were charged. Sign-in records let us show you every live session and end them if something looks wrong.
Where the law requires a legal basis, ours is the performance of our contract with you, and our legitimate interest in keeping the service secure and running.
What we never do
We do not sell your data, to anybody, in any form, aggregated or otherwise. We do not run advertising and we carry no advertising trackers. We do not use one customer's production figures, well records or filing history to inform what another customer sees, is shown, or is told. Nobody outside your organization sees your workspace unless you invite them into it.
Who else touches it
Running the service means a small number of suppliers necessarily handle some of it. We keep that list short and we keep it here.
| Supplier | What they handle |
|---|---|
| Cloudflare | Hosting, the network in front of it, and the storage the workspace lives in |
| Resend | Sending account confirmation, password reset and invoice mail |
| Anthropic | Document and image intelligence, where you use it — see below |
| Our payment provider | Card payments, on their own hosted page |
None of them is permitted to use your data for their own purposes.
Public agency records
WellSite holds public records published by state oil and gas agencies: operator registrations, lease and well listings, field designations and district assignments. That information is published by the agency, not by us, and it is public whether or not WellSite exists.
If your operator record in one of those datasets is wrong, the agency is the place to fix it, and correcting it there is what makes it correct everywhere. We can correct our own copy in the meantime — write to privacy@smeprotech.com.
The operator directory and outreach
We keep a directory of operators built from those public agency filings, and our own staff use it to work out who to talk to. Two things about it are worth stating plainly.
First, agency filings carry a business phone number and a business mailing address. They carry no email addresses. Any email address we hold for an operator was found by a person, in the ordinary course of business development, and is recorded against that company rather than against an individual.
Second, if you would rather we did not contact you, say so once and we will mark the record accordingly. Write to privacy@smeprotech.com. You do not need to be a customer to ask, and we do not require a reason.
Photographs and document intelligence
WellSite can read a gauge sheet, a run ticket or a well-site photograph and pull the figures off it. When you use that, the image is sent to our document intelligence supplier for processing and the result comes back to your workspace.
Take care what is in frame. If a photograph contains a person, a licence plate or a document that is not yours, it is processed along with everything else in the picture. The feature exists to read instruments and paperwork, and that is all we ask of it.
Cookies and tracking
WellSite sets no advertising cookies and carries no third-party analytics or tracking scripts. The application stores your session token in your own browser so you stay signed in, and keeps some of your working state locally so the workspace survives a refresh. That is storage on your machine for your benefit, and clearing it signs you out.
How long we keep things
| What | How long |
|---|---|
| Workspace contents | While your account is open, then 90 days after cancellation so you can retrieve it, then deleted |
| Account and billing records | Seven years after the last invoice, because tax and accounting rules require it |
| Sign-in records | Rolling, and pruned as they age out |
| Unused sign-in and reset tokens | Hours, then they expire on their own |
| Support correspondence | Two years |
You can ask for deletion sooner than any of these, and we will do it except where we are required to keep a record.
How it is protected
Everything travels over TLS. Passwords are stored salted and hashed, never in a form that can be read back, including by us. Every part of the application that touches customer data requires a live session, and access to another operator's workspace is refused at the server rather than hidden in the interface. Console access to customer records is separate from customer access, needs its own credential, and is restricted by role.
We take backups of the durable data so it can be restored, and we test that restoring works rather than assuming it does. Backups deliberately exclude live sessions and unused security tokens.
No system is perfect. If you find a weakness, tell us — we would much rather hear it from you.
Your rights over your data
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or ask us to stop contacting you. Export is built into the product and works at any time, including while an account is read only, so you do not need to ask us to get your own workspace out.
For anything else write to privacy@smeprotech.com. We answer within 30 days. We do not charge for it and we will not make it difficult.
Depending on where you are, you may have specific statutory rights beyond these. Nothing on this page limits them.
Children
WellSite is business software sold to companies. It is not directed at anyone under 18 and we do not knowingly collect anything from them.
Where the data lives
WellSite runs on Cloudflare's network, which is distributed across many countries, so your data may be processed outside the country you are in. Our suppliers are bound by contract to protect it to the standard described here wherever it is handled.
Changes to this policy
If we change something that materially affects how your data is handled, we will tell you by email before it takes effect rather than quietly editing this page. The date at the top always shows when it last changed.
Contact
SME Pro Technologies, LLC
[REGISTERED MAILING ADDRESS]
Privacy: privacy@smeprotech.com
Security: security@smeprotech.com
Everything else: support@smeprotech.com