Privacy Policy

Effective date: August 2026 — Reviewed for the WAVCO employee mobile application

1. Introduction

Wave Oil Wavco ("WAVCO", "we", "us", or "our") operates the WAVCO Management mobile application and supporting website at https://wave-oil-wavco.com. This policy explains what personal data we collect, how we use it, and the choices you have, including how to delete your account.

WAVCO is intended for use by authorized WAVCO employees and is not directed at children. Guest access to company news and operational manuals does not require an account.

2. Data We Collect

Account and identity information

Rig email address (used to create and authenticate your account).
Name, job title, department, customer ID, and phone number where provided by you or your administrator.
Account status, role, and administrative permissions.
Last login timestamp.

Authentication information

A securely hashed password and bearer authentication tokens used to access the API.

Operational submissions

Tool requests you submit, including well and rig details, required date or on-call status, tool descriptions, quantities, sizes, and connections.
Tool serial numbers assigned by authorized WAVCO administrators and displayed to the requester for delivery verification.
Original and signed tickets, certificates, and any other files uploaded in connection with a request.

Technical and usage data

Server and application logs, which may include your IP address, request timestamps, and endpoints accessed.
Administrative activity logs recording actions taken on your account by authorized administrators.
Expo push notification tokens, device platform, and application version when you enable notifications.

3. How We Use Your Data

To create, verify, approve, and authenticate your account.
To send one-time passwords, temporary passwords, and account notifications by email.
To process, track, and respond to your tool requests.
To provide company news and operational manuals.
To register your device and deliver operational push notifications when you enable notifications.
To secure the platform, prevent abuse, and support and troubleshoot your account.

We do not sell your data, and we do not use advertising, analytics, tracking, or location SDKs in the mobile application.

4. Legal Basis for Processing

We process your data to perform the services you or your employer have engaged us to provide, to satisfy our legitimate operational and security interests, and to comply with legal obligations.

5. How We Share Your Data

Authorized WAVCO personnel: administrators and support staff who manage accounts, approvals, and tool requests.
Email delivery provider: used to send OTP and account emails (Resend).
Push notification providers: Expo Push Service routes notifications to registered devices through Google Firebase Cloud Messaging on Android and Apple Push Notification service on iOS.
Hosting and infrastructure providers: used to operate the website and API.

We require any provider processing data on our behalf to apply appropriate confidentiality and security safeguards. We do not share data with third parties for their own marketing purposes.

6. Data Security

All production traffic is served over HTTPS.
Passwords are stored using strong, salted hashes and are never returned by the API.
Bearer tokens are stored in the platform's secure storage on your device (iOS Keychain / Android Keystore).
Access to administrative functions is restricted to authorized administrators and is logged.

7. Data Retention

We retain your data while your account remains active and for as long as needed to provide our services and meet legal obligations. Wave Oil Wavco will disclose any specific legal retention periods it applies to operational records in this policy before relying on them.

A registered push token is retained while that device remains registered for notifications. It is removed when the device is unregistered, when the provider reports that it is no longer valid, or when the associated account is deleted.

8. Account Deletion

You can delete your account and all associated data at any time. Deletion permanently removes your account, tool requests, OTP records, authentication tokens, and saved sessions. References to you in administrative activity logs are detached.

In the app: use the account deletion action in your profile.
On the web: visit the account deletion page and confirm your rig email and password.

9. Your Rights

Depending on applicable law, you may have the right to:

Access and receive a copy of the personal data we hold about you.
Correct inaccurate personal data.
Request deletion of your personal data.
Object to or restrict certain processing.
Data portability.

To exercise any of these rights, contact us using the details below.

10. Children's Privacy

WAVCO is not designed for, and is not directed at, children. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the effective date above and notify users through the application where appropriate.

12. Contact

If you have questions about this policy or your data, contact us at Ahmed.turky@waveoil.com.

You can also contact us by phone at 01064227102.