Privacy Policy
Last updated: October 27, 2026.
This Privacy Policy explains what personal data MWD STD Inc., a company registered in Texas, United States ("MWD STD", "we", "us"), collects when you use the aide.lite web application, our website and our support channels (together, the "Services"), why we collect it, where it is processed and what rights you have. It applies alongside our Terms of Service. Questions and requests: [email protected].
1. Who we are and what this Policy covers
1.1 MWD STD is the controller of the personal data described in this Policy: the data of the people who register accounts, visit the website or write to us.
1.2 The well data you enter into the Services (projects, surveys, section designs, prices) is engineering data and normally contains no personal data. If you include personal data in a project, for example a person's name in a report title, we process it only as part of the calculations you request, or of a support request you send us, and on your instructions, as described in Section 2. For such processing our Data Processing Addendum applies automatically to organisations subject to the GDPR, the UK GDPR or Swiss law; a countersigned copy is available on request at [email protected].
2. What we collect
2.1 Account data. When you register we collect your first and last name, company, job title, country, email address and a password. We store only a hash of the password, never the password itself. We use these details to create and secure your account, to identify your organisation and country (including for tax and sanctions purposes) and to contact you about the Services.
2.2 Billing data. Payments for paid plans are processed by Stripe. Stripe collects your payment details directly; card numbers never reach MWD STD. We receive and keep what we need to invoice you and to account for taxes: your billing name and address, a tax identification number where you give one, the plan and the amounts paid, the payment status, and the last four digits and brand of the card.
2.3 Technical and log data. When your browser talks to our servers we record technical information about each request: your IP address, browser type and version, the date and time, the function called, the size and status of the request and any error message. The logs never include the contents of your requests or of your projects. We use these logs to keep the Services secure, to diagnose faults, to enforce rate limits and the restrictions in the Terms of Service, and to understand overall usage in aggregate. When our staff change your account, for example its email address, plan or access, or block a network address, we record which staff member did it, what was changed and when.
2.4 Calculation inputs. The data you send for a calculation is processed on our servers and answered without being stored. Two kinds of jobs run asynchronously, trajectory concepts and cost optimisation: their inputs and results are held in a job queue while the job runs and for a short time afterwards so that the application can collect the result, and are deleted within 24 hours of the job completing, failing or being cancelled, and in any case within 72 hours of submission. Error records, like all logs, contain the technical details of the failure but not the contents of the request.
2.5 Your projects stay in your browser. Projects are saved by the application in your browser (its IndexedDB database), not on our servers, and, apart from project files you choose to send to support (Section 2.6), we have no copy of them. Clearing your browser data or changing browsers or devices can lose a project; exporting projects regularly is the way to keep them.
2.6 Communications. If you email us, or we email you about your account or the Services, we keep the correspondence, including your name, email address, what was written and when, to handle your request and to keep a record of it. Project files or excerpts you send to support are Customer Personal Data under the Data Processing Addendum: we use them only for your request and delete them when it is closed, at the latest 90 days after receipt.
2.7 Marketing preference. Whether you have agreed to receive product news by email, and when you withdrew that consent.
2.8 What we do not collect. We do not collect precise location, biometric or other special categories of data, and we do not buy data about you from third parties. We do not sell personal data and we show no advertising.
3. Why we process your data and on what basis
| Purpose | Data | Legal basis (where one is required) |
|---|---|---|
| Creating and running your account, providing the Services | Account data, technical data, calculation inputs | Performance of our contract with you, where you contract with us yourself; where your employer or client holds the contract and you use the Services as its user, our legitimate interest in providing the Services to that organisation |
| Billing, invoicing, tax and accounting | Billing data, account data | Contract; legal obligation |
| Security, fraud and abuse prevention, enforcing the Terms, rate limiting | Technical and log data | Our legitimate interest in a secure and reliable service |
| Diagnosing faults and improving the Services | Log data; anonymised, aggregated usage statistics | Legitimate interest; the aggregated statistics identify no one |
| Sanctions and export-control screening | Account data (name, company, country) | Legal obligation; legitimate interest |
| Responding to your requests and support | Communications, account data | Contract; legitimate interest |
| Product news by email | Email address, marketing preference | Your consent, which you can withdraw at any time |
| Establishing, exercising or defending legal claims | Any of the above, as relevant | Legitimate interest |
Roles. For account, technical, billing and support data MWD STD decides how and why the data is processed and is therefore the controller, whether you contract with us yourself or use the Services through your employer's or client's account. Where an organisation transfers personal data to us under a data-processing agreement (Section 1.2), we act as its processor and follow its instructions.
We do not make decisions about you by automated means that have legal or similarly significant effects.
4. Cookies, local storage and analytics
4.1 The website and the application set no cookies and use no third-party trackers or advertising technology.
4.2 The application uses your browser's storage for its own operation: the session token that keeps you signed in is held in the browser tab's session storage and disappears when the tab closes; your settings (display units, workflow preferences) are held in the browser's local storage and your projects in its IndexedDB database. Projects are not synchronised with our servers automatically; when you run a calculation, the application sends the inputs that calculation needs (Section 2.4) together with the session token that authenticates the request.
4.3 We currently use no analytics tools. If we introduce usage analytics in future, it will be our own cookie-free measurement of how the application is used (for example which pages are opened, which calculations are run and how long they take), tied to your account rather than to a tracking cookie and never including the contents of your projects. We will update this Policy before doing so.
5. Who receives your data
5.1 We share personal data only with the service providers that help us run the Services, each bound by contract to protect it and to use it only for the service it provides to us. They act as our processors (and, where we ourselves act as a processor under a data-processing agreement, as our sub-processors), except that Stripe also acts as an independent controller for its own purposes — choosing the banks and payment networks that carry a payment, preventing fraud, loss and security risks, meeting anti-money-laundering, know-your-customer and other legal obligations, and improving its services, including for payments made with Link — under Stripe's privacy policy, and Cloudflare uses what it learns from traffic, such as an IP address's threat score, as a controller to secure its network, under Cloudflare's privacy policy:
| Provider | Service | Where |
|---|---|---|
| OVH US LLC (OVHcloud) | Servers that host the application and the calculation services | A United States company; our servers are in its data centre in the United States, and OVH group companies may access them remotely for support, as OVH's data processing agreement lists |
| Cloudflare, Inc. | Network security, denial-of-service protection and content delivery in front of our servers; handles all traffic, including IP addresses, at its data centres worldwide and keeps security and traffic logs for limited periods | Worldwide at its network edge; logs mainly in the United States and the European Economic Area |
| Stripe, LLC | Payment processing and invoicing for paid plans | United States, with Stripe's own worldwide infrastructure |
| Google LLC (Google Workspace) | Email for support, notices and account correspondence | United States and Google's worldwide infrastructure |
5.2 We may disclose personal data where the law requires it, to protect our rights or the safety of others, to comply with sanctions or export-control obligations, and, if MWD STD is involved in a merger, acquisition or sale of assets, to the party that takes over the Services, which will be bound by this Policy.
5.3 We do not sell personal data, and we do not share it with advertisers.
6. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account exists and for 30 days after it is closed, then deleted |
| Billing records (invoices, payment records, tax data) | 7 years after the transaction, as tax and accounting rules require |
| Technical and log data, including the record of changes our staff make to accounts | Up to 180 days, then deleted |
| Asynchronous job inputs and results (the queue) | While the job runs and for up to 24 hours after it completes, fails or is cancelled; a job that never completes is deleted within 72 hours of submission |
| Backups of the account database | Up to 30 days, after which the backup is overwritten. An account deleted from the live database therefore remains in backups for up to 30 days; backups are used only to restore the whole database, never to reinstate a closed account |
| Correspondence, including the notices and messages we send you | Up to 3 years after the last message on the matter |
| Project files or excerpts sent to support | Until the request is closed, at the latest 90 days after receipt (Data Processing Addendum, Section 7) |
| Marketing consent and its withdrawal | Consent: until withdrawn. The record of a withdrawal (your email address and the date) is kept as a suppression record for as long as we send marketing emails at all, so that we do not contact you again |
| Data needed for a specific dispute, claim or investigation | Until the matter is closed, after which the normal period for that data applies |
Data that has been anonymised and aggregated so that it no longer identifies anyone may be kept without limit.
7. Where your data is processed and international transfers
7.1 MWD STD is based in the United States. Our own servers are in the United States; the providers in Section 5 process data in the locations listed there — Cloudflare at its data centres worldwide, with its logs mainly in the United States and the European Economic Area, Stripe and Google on their own worldwide infrastructure.
7.2 If you are in the European Economic Area, the United Kingdom or Switzerland, your data is processed outside those areas, first of all by MWD STD itself in the United States. We collect it directly from you under our contract with you and this Policy, and we apply the safeguards in this Policy to it wherever it is processed. When we pass data to a provider, the mechanism depends on the recipient, not on where a server stands. All our providers — OVH US LLC, Cloudflare, Inc., Stripe, LLC and Google LLC — are United States companies, so for each of them we rely on its certification under the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, as the transfer requires, where it is certified for that data, and otherwise on the European Commission's standard contractual clauses, with the UK addendum where applicable, in our contract with that provider. Where your organisation transfers personal data to us as its processor, our Data Processing Addendum sets out the transfer terms for that transfer.
8. Security
8.1 We protect personal data with technical and organisational measures appropriate to the risk: encrypted connections (TLS) between your browser and our servers, only password hashes stored, never the passwords themselves, session tokens that live only in your browser tab, access to the servers and to the administration console restricted to authorised MWD STD staff and enforced on the server, network protection in front of our servers, logging and monitoring, and the retention limits in Section 6.
8.2 No system is perfectly secure. If a breach of security affects your personal data, we will inform you and the competent authorities without undue delay where the law requires it.
9. Your rights
9.1 Depending on where you live, you may have the right to ask us for access to the personal data we hold about you, to correct or delete it, to restrict or object to its processing, to receive it in a portable format, to withdraw a consent you have given, and not to be treated differently for exercising your rights. Because we do not sell personal data, use it for targeted advertising or profile you, there is nothing to opt out of in those respects.
9.2 You can ask us to update your account details, change your marketing preference at any time (every marketing email carries an unsubscribe link), and close your account, after which Section 6 applies.
9.3 To exercise a right, email [email protected] from the address registered to your account, or tell us how we can verify that the request comes from you. We answer within one month, or within the shorter period your local law sets, and we may extend that period where the law allows for complex requests, telling you why.
9.4 If you are in the EEA, the United Kingdom or Switzerland, you may also complain to your data-protection authority. If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada. If you are in a US state with a privacy law, you may appeal a decision we make on your request by replying to it, and we will respond within the time the law sets. If you are in Brazil, you have the rights set out in the LGPD and may complain to the ANPD.
10. Children
The Services are for professionals and are not directed to anyone under 18. We do not knowingly collect personal data from minors; if you believe a minor has registered, tell us and we will delete the account.
11. Changes to this Policy
We may update this Policy. We will announce material changes in the application or by email at least 30 days before they take effect, except where a change is required by law. The date of the current version is shown at the top.
12. Contact
MWD STD Inc., 1330 Blackthorne Dr, Houston, TX 77094, United States. Email: [email protected].