Privacy Policy

1. Introduction

IronClad Ops, Inc. ("IronClad," "we") provides operations and equipment management software for oil and gas operators, and runs IronClad Events, a free directory of oil and gas industry events. This Privacy Policy explains what we collect, why, and your rights. It applies to ironcladops.app, the in-app product and the directory at events.ironcladops.app. We are a US company; our service is primarily directed at US-based operators.

2. What we collect

• Account data: name, email, company, role, and a hashed password (via Supabase Auth).
• Product data: whatever you enter into IronClad: assets, work orders, inspections, customer records, personnel records. This is your operational data; we hold it on your behalf.
• Usage analytics: page views, feature clicks, session durations. Anonymous for demo visitors and directory visitors; linked to your account for trial and paid users.
• Demo session data: role selection, scenario progress, session expiry. Bound to a short-lived cookie; deleted 24 hours after the session ends.
• Form submissions: anything you send us via a contact form or support request.
• Technical metadata: IP address (hashed for rate limiting; never stored in clear), browser, operating system.

On the IronClad Events directory you don't need an account. Depending on what you do there, we collect:

• Event submissions: the event details you send, and your name, email address, company and role, plus your phone number if you give it.
• Demo requests: your name, work email address and company, your job title, phone number and note if you give them, and the listing you asked from.
• Follows: your email address, the events you follow and your email preferences, plus your name, company, job title, role, home region and the kinds of events that interest you, if you give them.
• Survey answers: whether you went, your ratings and comment, and whether you allow the host to see your comment or your name.
• Reports about a listing: what you tell us is wrong. We don't ask for your email address.
• Email records: when we sent or held back a confirmation code and why, the codes themselves in hashed form only, and the addresses that bounced, complained or asked us to stop.

3. How we use it

• Deliver the service (signing you in, showing your data, sending notifications you opted into).
• Improve the product by analyzing anonymous usage patterns. Never used for cross-organization insights.
• Respond to support requests and contact-form submissions.
• Detect and prevent abuse (bot checks, rate limiting, fraud signals).
• Comply with lawful orders. Never volunteered.

On the directory, we use what you give us to:

• Confirm an email address is yours with a 6-digit code, and send the receipts and decisions your requests trigger.
• Review, edit and publish event listings.
• Contact you about a demo you asked for. Asking for a demo is consent to that contact only.
• Email followers about changes to the events they follow, reminders before they go and a short survey after.
• Send IronClad product updates, but only to people who ticked the box for them.
• Plan our sales outreach by grouping, by company, the people who opted in to product updates or asked for a demo. People who only follow events are never included.
• Give an event's host an anonymous summary of survey answers. A figure appears only when at least 3 attendees answered it, and comments or names are shared only if you allow it.

We never: sell your data, sell usage analytics, run third-party ad targeting, benchmark one customer against another without explicit opt-in, or give event organizers or hosts your contact details.

4. Subprocessors

Companies that process data on our behalf. We update this list when we add or remove a subprocessor; material changes are emailed to account admins.

5. Data retention

• Demo sessions: 30 days, then purged.
• Trial and paid usage events: 90 days.
• Sessions archive: 180 days, then hot-deleted.
• Account data: for the life of your subscription plus 30 days. Exportable on request.
• Inactive trial organizations: soft-deleted 60 days after trial expiry if no paid subscription.
• Compliance records (inspections, signatures, work orders): retained per your subscription agreement, typically 7 years for OSHA-aligned records.

On the directory:

• Requests never confirmed with a code: submissions after 7 days, demo requests after 14 days.
• Follows never confirmed: after 24 hours. Email addresses never confirmed that nothing else uses: after 7 days.
• Confirmation codes: 8 days.
• Code-sending records for an address: 30 days if no code was ever sent, otherwise 13 months after the last code. We delete them sooner if you ask.
• Abuse-prevention logs: 30 days.
• Reports about a listing, with the hashed network address that sent them: 90 days after we close the report.
• Directory usage analytics: 30 days.
• Records that an address unsubscribed, bounced or asked us to stop: kept, so we keep honoring them.
• Confirmed contacts, demo requests, submitted listings and survey answers: until you ask us to delete them.

6. Your rights

Regardless of where you live, you can exercise the following rights. We respond within 30 days.

• Access: request a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: delete your account, or your directory contact record. Note: some records are retained for legal compliance (audit trails, financial records), and we keep a record that a directory address opted out, so we don't email it again.
• Portability: export in a machine-readable format.
• Objection or restriction: limit how we process your data.
• Email choices: every email about events you follow has a one-click unsubscribe link, and every code email has a link to stop codes to your address.
• CCPA "do not sell": not applicable. We do not sell personal information under any definition of "sell."

To exercise any of these rights, email privacy@ironcladops.app.

7. Cookies and tracking

Strictly necessary: authentication session cookie (sb-*), demo session cookie (ironclad_demo_session), and a first-touch marketing attribution cookie (ironclad_ft, 30-day lifespan). These cannot be disabled without breaking the service.

On the directory:

• __Host-ic_events_v (functional, up to 180 days): remembers an email address you confirmed in this browser, so you aren't asked for a new code each time. It's set only after you enter a code.
• __Host-ic_events_n (strictly necessary, 7 days): ties a follow you start to this browser, so only you can confirm it.
• The travel planner keeps your plan in this browser's local storage (ironclad-events-plan:v1). It isn't sent to us.

"Forget This Browser" on any directory form removes both cookies.

Analytics: first-party only. No Google Analytics, no third-party ad networks, no Facebook Pixel, no marketing pixels of any kind.

Marketing consent: IronClad product updates go only to people who tick the box for them on a directory form. The box is never ticked for you, and every update has an unsubscribe link.

8. Security

• Encryption at rest (Postgres encryption via Supabase).
• Encryption in transit (TLS 1.3).
• Row-Level Security on every table (per-organization isolation).
• Audit logs are append-only; tamper-evident signatures use hash chains.
• Security incidents disclosed within 72 hours per industry breach-notification norms.

9. Children's privacy

IronClad is not directed at users under 13. We do not knowingly collect data from children.

10. International users

If you use IronClad from outside the United States, your data is transferred to and processed in the US (Supabase US region, Vercel). EU and UK users may contact us to exercise GDPR rights.

11. Changes to this policy

Material changes are emailed to account administrators at least 14 days before taking effect. Minor edits (typos, subprocessor list hygiene) are reflected by bumping the revision date at the top of this page.

12. Contact

Privacy inquiries: privacy@ironcladops.app
General: hello@ironcladops.app
Mailing address: IronClad Events <hello@events.ironcladops.app>