Privacy Policy · Version 1.0 · effective 2026-08-15

Privacy Policy

This policy explains what personal information the AQSim platform collects, why, who else handles it, and what you can ask us to do about it. The version and effective date of this policy are shown above.

The Service is operated by App Integration Solutions, 262 West Main St, Westborough, MA 01581, United States. In this policy "we" and "us" mean that company.

1. Who This Policy Covers

The AQSim platform is a business tool. The people whose personal information we hold are the employees and contractors of our customers who use an account, the people our customers ask us to invite, and people who contact us through our website.

We are not a consumer service. We do not collect information from the general public beyond what someone chooses to send us.

2. What We Collect

Account information. Your name and email address, a securely hashed password, and — if you enable two-factor authentication — your authenticator secret and recovery codes. If you change your email address we hold the pending address until you confirm it.

Records of your acceptance of our Terms. When you accept the Terms of Service we record which user accepted, which version, the date and time, the IP address the acceptance came from, and your browser's user-agent string. We keep these as evidence of consent.

The work you do in the Service. Your rig configurations, brine chemistry, simulation inputs, results, projects and comparison batches. This is mostly technical rather than personal information, but a run records which user submitted it, and the name of the submitting user is printed on the cover of every report PDF.

Invitations. When we invite someone to an account we hold that person's name and email address from the moment the invitation is issued, including if they never accept it.

Inquiries. If you use the request-access form on our website we receive your name, company, work email address and whatever you write in the message. That goes to a staff mailbox; we do not store it in the application.

Technical information. We use IP addresses to rate-limit sign-in attempts and protect accounts from abuse. Our servers and our providers keep operational logs that can include IP addresses, and our administrative audit records can include the email addresses of people staff act on.

We never receive or store card numbers. Our billing record identifies your organization to our payment processor and may hold the card brand and last four digits it returns to us; we do not display or otherwise use them.

We do not collect health, biometric, government-identifier, demographic or other special-category information, and nothing in the Service asks for it.

3. How We Use It

We use personal information to:

• provide, operate and support the Service;
• authenticate you and keep accounts secure, including rate-limiting sign-in attempts;
• meter and bill simulation credits;
• send transactional email — invitations, email-address confirmations, security notices and similar;
• respond to your inquiries and provide support; and
• keep records we may need for legal or financial reasons, including consent and payment records.

We do not use your data to train, fit or improve any shared or cross-customer model unless you agree to that separately in writing.

4. Where Your Data Is Held

Your account and the work you do in the Service are held in a database of your own, not shared with other customers.

Some information is necessarily held centrally rather than in that database: invitations we have issued, our administrative audit records, the billing record that links your organization to our payment processor, and the calibration catalog described below.

Simulation results and report PDFs are held in object storage, not in a database. Calibration parameters fitted for your rigs and inhibitors are held in a central catalog, scoped to your account and never applied to another customer's simulations.

Your data is processed in the United States.

5. Who Else Processes It

We keep the list of third parties short:

• Stripe processes payments. When you buy credits you go to a checkout page hosted by Stripe and enter your details there under Stripe's own privacy notice. We send Stripe your organization's name and receive back a payment confirmation. Stripe collects the billing information its checkout requires.
• Amazon Web Services provides the cloud infrastructure — hosting, databases and object storage — that our production environment runs on, and delivers the email the Service sends. It therefore handles the recipient's name and email address and the content of those messages.
• Cloudflare provides network edge protection for our infrastructure.
• Have I Been Pwned receives a partial, irreversible fingerprint of a password at the moment one is set, so we can refuse passwords known to have been exposed in a breach. It never receives the password itself, your name, or your IP address.

The simulation engine and the report renderer run on our own private network. They are not third parties, and your data does not leave our environment to reach them.

We do not otherwise share personal information, except where the law requires it or to establish or defend a legal claim.

6. Cookies and Tracking

We set two cookies, both first-party and both strictly necessary: one that keeps you signed in, and one carrying a cross-site request forgery token that protects form submissions. Our network edge may set its own strictly necessary security cookie.

There is no analytics, tag manager, advertising or session-recording software anywhere in the Service or on our website. We host our own fonts, so no font provider sees your IP address. Your light or dark theme preference is stored in your browser, not in a cookie sent to us.

Because we set only strictly necessary cookies, there is no cookie banner and nothing to opt out of.

7. Access by Our Staff

Authorized staff can access customer accounts to provide support, investigate problems and administer the Service, and can sign in to an account on a user's behalf where support requires it. That access is recorded with a reason.

8. How We Protect It

Your account and your work are held in a database of your own rather than mixed with other customers'. Simulation input snapshots are encrypted by the application before storage, and our databases and object storage are encrypted at rest. Passwords are stored as bcrypt hashes and never in a readable form, and a password known to have been exposed in a breach is refused. Two-factor authentication is available. Accounts are created by invitation rather than open sign-up, so no anonymous person can create one. Card numbers never reach our servers.

No system is perfectly secure, and we do not claim any security certification. If a breach affects your personal information we will notify you as required by applicable law.

9. How Long We Keep It

We keep your data for as long as your account exists, and after that as set out below. We do not run a fixed retention schedule that erases data on a timer — deletion happens when an account is closed or when you ask us.

When an account is scheduled for deletion we suspend it and set a date at least 30 days out, so the decision can be reversed. After that date an operator deletes the account's database, which removes your users, rigs, inputs, results records, projects, credit ledger, and the records of your acceptance of our Terms.

Some things are held outside that database and survive its deletion, and you should know which:

• Simulation result files and report PDFs in object storage. These are not reached by account deletion today. See section 10 for what you can ask us to do about them.
• Payment and billing records, kept for financial and tax purposes and held in part by Stripe under its own retention rules.
• Administrative audit records, which can include email addresses.
• The calibration change history, an append-only record of parameter values and who changed them.
• Backups and operational logs, which age out on their own cycles — database backups are retained for a short rolling window after deletion.

10. Deletion, Access and Your Choices

You can see and correct your own name and email address in your account at any time.

You can ask us to delete your account, or a user on it, by writing to support@aqsim.com. We will confirm the request, close the account, and delete it as described in section 9 — no sooner than 30 days after the request, so the decision can be reversed. If you want the result files, report PDFs and calibration history described in section 9 removed as well, say so and we will remove them by hand.

You can ask us for a copy of the personal information we hold about you, and we will provide it.

Because our customer is your employer, we may need to confirm a request with the account's administrator before acting on it.

If you are in a state with its own privacy law, the rights that law gives you apply and you can exercise them at the address below.

11. Selling and Advertising

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We run no advertising and no third-party trackers.

12. Children

The Service is a business tool. Accounts are created only by invitation, so nobody can sign up anonymously, and we do not knowingly collect information from anyone under 16.

13. Automated Decision-Making

We do not make automated decisions about people. The simulation engine models the chemistry and physics of equipment, not individuals, and the only automation attached to a person is the counting of simulation credits.

14. Changes to This Policy

When this policy changes we publish a new version with a new effective date, shown at the top of this page. This policy is published for your information rather than separately accepted, so we will not ask you to click to accept it; please check back if you want to see what has changed.

15. Contact Us

Questions, requests or complaints about privacy: support@aqsim.com, or App Integration Solutions, 262 West Main St, Westborough, MA 01581, United States.