Sign up

Legal

Privacy Policy

Version 2026-10-13 · effective October 13, 2026 · replaced on November 6, 2026

This is an earlier version of the Privacy Policy, kept for reference. The current version is 2026-11-06. All versions: 2026-11-06 (current).

1. Data Controller

The data controller responsible for your personal data is:

Prometiam does not currently appoint a Data Protection Officer (DPO). For any data protection inquiries, please contact us at the email address above.

2. Information We Collect

2.1 Information You Provide

  • Account information — name, email address, company name, and password when you register for an API account.
  • Contact form submissions — any information you voluntarily provide through our contact or support forms.
  • Payment information — billing details processed securely through Stripe. We do not store credit card numbers on our servers.

2.2 Information Collected Automatically

  • API usage data — API calls made, endpoints accessed, request timestamps, response metadata, and the IP address each call came from.
  • Website analytics (only with your consent, see Section 9) — the pages you view and the buttons you click, your browser and operating-system family, your language, the site you came from, and your approximate location (country, region, city). The location is looked up from your IP address by ipwho.is at the time of your visit; the IP address itself is not stored. A random session ID, kept in your browser and deleted when you close the tab, links the events of one visit.
  • Campaign data (only with your consent, see Section 9) — the campaign tags (utm_source, utm_campaign and the like) of the link you arrived from and the page it led to, recorded once per visit. For sign-up attribution, your browser also keeps the first page you visit and the site you came from, for up to 90 days, and the campaign tags of the current visit; these are sent to us only if you create an account, and are then stored with that account so we know which page led to the sign-up. If you refuse or withdraw this consent, they are deleted from your browser. Without this consent nothing is kept in your browser, but when the sign-up page itself was opened from a tagged link (for example the link in our MCP server or SDK documentation), the tags in that page's address are sent with your sign-up and stored with the account.
  • Cookies and similar technologies — see Section 9 (Cookies) below.

2.3 Public Company Data, Officers and Owners

The Risk Intelligence API processes and serves publicly available company data sourced from official registers in the countries listed in the Terms. This data is published by public authorities for transparency and relates mostly to legal entities. Where a register publishes the officers, directors or beneficial owners (PSC) of a company, or the name of a sole proprietor where the register publishes it as the company record, those persons are in our data. We do not collect it from them: the source is always the official register, and this notice is our Article 14 information to them. Contact details of sole proprietors are not served for French sole proprietorships, and insolvency notices naming individuals are filtered before they are served.

Why we may process it (Art. 6(1)(f)). The register's own legal duty to publish is the register's, not ours; our basis is legitimate interest. The interest is that of businesses, banks and professionals to verify the identity and standing of a counterparty, to meet anti-money-laundering and due-diligence duties, and to prevent fraud. It is necessary because the officer data is what identifies who controls a company. Balancing: the data is already public by law in the register, for the purpose of letting third parties check who stands behind a company; we add no private data and serve only the fields the register publishes; the use matches the register's purpose; people acting for a company can expect to be listed. Safeguards: no contact details for French sole proprietors, a privacy filter on insolvency notices, access only for authenticated business customers under terms that forbid discriminatory use, and objection and erasure handled as described in Section 8. The full assessment is kept on file and reviewed every year.

2.4 Business Contact Data Published on Company Websites

We additionally collect business contact details published on companies' own websites — typically role-based addresses and phone numbers (for example info@, ventas@,administracion@), company social-media profiles, and occasionally a named employee's work contact details where the company publishes them on a public contact or team page.

Where such details identify a natural person, they constitute personal data and we process them on the basis of legitimate interest (GDPR Art. 6(1)(f)) in providing business-to-business company intelligence, balanced against the limited privacy impact of business contact information that the data subject's employer has itself made public. As this data is not collected directly from the data subject, we rely on Art. 14: the source is always the company's own public website, and this notice serves as the required source disclosure.

You may object to this processing or request erasure at any time by contacting privacy@prometiam.com. Suppression is applied across our systems so the contact is not re-collected on subsequent updates.

3. Legal Basis for Processing (GDPR Art. 6)

We process personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)) — customer account data: to provide the API service, manage your account, and process payments.
  • Legitimate interest (Art. 6(1)(f)) — register data about officers and owners (Section 2.3), business contact data (Section 2.4), and, for our customers, security, fraud prevention and service communications.
  • Consent (Art. 6(1)(a)) — for website analytics, campaign tracking, marketing communications and any other non-essential cookies. You may withdraw consent at any time, for cookies under Cookie settings in the footer.
  • Legal obligation (Art. 6(1)(c)) — only for our own tax, accounting and regulatory duties, such as keeping invoices.

4. How We Use Your Data

  • Provide, operate, and maintain the Prometiam API
  • Authenticate API requests and enforce rate limits
  • Process transactions and send billing information
  • Respond to inquiries and provide customer support
  • Send product updates, security alerts, and administrative notices
  • Analyze usage patterns to improve our platform and services
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations

5. Data Sharing & Third Parties

We do not sell your personal data. The processors that handle personal data for us (Supabase, OVHcloud, Cloudflare, Stripe, Zoho, Anthropic, Telegram, Better Stack, the language-model providers behind the website assistant, and ipwho.is for consented analytics) are listed with their purpose and location on the sub-processors page. We give customers 30 days' notice of changes. We may also share information:

  • Legal requirements — when required by law, regulation, or valid legal process.
  • Business transfers — in connection with a merger, acquisition, or sale of assets.

6. Data Retention

  • Account data: retained for the duration of your active subscription plus 30 days (as in the Terms), then deleted except what the law requires us to keep.
  • Register data about officers and owners: kept while the register publishes it and removed when the register removes it, at the next update.
  • Requests under Section 8: the request and our answer are kept for three years as proof of compliance.
  • API usage logs: retained for 12 months for security and billing purposes.
  • Payment records: retained for 7 years as required by tax regulations.
  • Website analytics and campaign data: contain no name, email address or IP address, and may be retained indefinitely.
  • Business contact data (Section 2.4): re-verified against the company's public website at least every 24 months; contacts that can no longer be confirmed from a public source are deleted. Suppression requests are honoured permanently.

7. Data Security

We apply security measures including encryption in transit (TLS), API keys stored only as hashes, row-level access controls on customer data, emailed login codes with lockout, logged administrative actions, and reviews as the Service changes (see the trust page). However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Under GDPR and applicable data protection laws, you have the following rights:

  • Access (Art. 15) — request a copy of the personal data we hold about you.
  • Rectification (Art. 16) — request correction of inaccurate or incomplete data.
  • Erasure (Art. 17) — request deletion of your personal data ("right to be forgotten").
  • Portability (Art. 20) — receive your data in a structured, machine-readable format.
  • Restriction (Art. 18) — request that we limit processing of your data.
  • Objection (Art. 21) — object to processing based on legitimate interests or direct marketing.
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, write to support@prometiam.com (privacy@prometiam.com reaches the same place), saying which right and, for register data, which company you appear in. We may ask you to prove who you are. We keep a log of requests, respond without undue delay and in any event within one month, and tell you what we did. This period may be extended by two further months for complex requests, in which case we will inform you.

Register data. You may object to us serving your details as an officer or owner. We assess each objection against your particular situation (Art. 21): where there is a compelling reason, for instance a protected person, we suppress the details in our service. The register itself still publishes them, and corrections to the data must be made at the source register to persist.

Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority. For Spain, this is the Agencia Espanola de Proteccion de Datos (AEPD) at www.aepd.es.

9. Cookies

We ask before storing anything that is not essential. The cookie banner offers three categories; nothing optional is switched on until you choose it, and rejecting is as easy as accepting.

  • Essential (always on) — your sign-in, language, theme and your cookie choice, kept in your browser. The site cannot work without them.
  • Analytics (off until you switch it on) — the website analytics described in Section 2.2. Never used for advertising and never sold.
  • Campaigns (off until you switch it on) — the campaign data described in Section 2.2. Never used for advertising and never sold.

We use no advertising cookies.

You can change or withdraw your choice at any time under "Cookie settings" in the footer of any page.

10. Automated Decision-Making

The Risk Intelligence API provides company risk data, credit indicators, and insolvency records sourced from public registries. This data is informational and does not constitute automated decision-making or profiling as defined under GDPR Art. 22. Any decisions made based on data retrieved through the API are the sole responsibility of the API customer.

11. International Transfers

Our primary infrastructure is in the EU: Supabase in Frankfurt, and OVHcloud in Germany for the company-data database. Some processors, such as Cloudflare, Anthropic, Telegram and the language-model providers, process data outside the EEA. In those cases the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses.

12. Children's Privacy

Our platform is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our website at least 30 days before changes take effect. The "Last updated" date at the top reflects the most recent revision.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: