Sign up

Legal

Privacy Policy

Version 2026-11-06 · effective November 6, 2026

This is the current version of the Privacy Policy. Earlier versions: 2026-10-13.

1. Data Controller

The data controller responsible for your personal data is:

Prometiam does not currently appoint a Data Protection Officer (DPO). For any data protection inquiries, please contact us at the email address above.

2. Information We Collect

2.1 Information You Provide

  • Account information — name, email address, company name, and password when you register for an API account.
  • Contact form submissions — any information you voluntarily provide through our contact or support forms.
  • Payment information — billing details processed securely through Stripe. We do not store credit card numbers on our servers.
  • Declared purposes — the purposes for which you say you will use the Service, chosen when you create your account or a key and kept up to date in your dashboard, with their history.

2.2 Information Collected Automatically

  • API usage data — API calls made, endpoints accessed, request timestamps, response metadata, and the IP address each call came from.
  • Acceptance record — which version of the Terms of Service, the Privacy Policy and the Data Processing Agreement you accepted, the date and time, your account and the IP address used.
  • Website analytics (only with your consent, see Section 9) — the pages you view and the buttons you click, your browser and operating-system family, your language, the site you came from, and your approximate location (country, region, city). The location is looked up from your IP address by ipwho.is at the time of your visit; the IP address itself is not stored. A random session ID, kept in your browser and deleted when you close the tab, links the events of one visit.
  • Campaign data (only with your consent, see Section 9) — the campaign tags (utm_source, utm_campaign and the like) of the link you arrived from and the page it led to, recorded once per visit. For sign-up attribution, your browser also keeps the first page you visit and the site you came from, for up to 90 days, and the campaign tags of the current visit; these are sent to us only if you create an account, and are then stored with that account so we know which page led to the sign-up. If you refuse or withdraw this consent, they are deleted from your browser. Without this consent nothing is kept in your browser, but when the sign-up page itself was opened from a tagged link (for example the link in our MCP server or SDK documentation), the tags in that page's address are sent with your sign-up and stored with the account.
  • Cookies and similar technologies — see Section 9 (Cookies) below.

2.3 Public Company Data, Officers and Owners

The Risk Intelligence API processes and serves publicly available company data sourced from official registers in the countries listed in the documentation. This data is published by public authorities for transparency and relates mostly to legal entities. Where a register publishes the officers, directors or beneficial owners (PSC) of a company, or the name of a sole proprietor where the register publishes it as the company record, those persons are in our data. The sanctions lists we screen against also name individuals, and for Spain our PEP screening uses public sources, so those persons are in our data too. We do not collect any of it from them: the source is always the official register or list, and this notice and our data-use statement are our Article 14 information to them. We do not write to each person: for data that a register publishes this would take disproportionate effort, and for most of them we hold no address, so we give the information publicly (Art. 14(5)(b)). Contact details of sole proprietors are not served for French sole proprietorships, and insolvency notices naming individuals are filtered before they are served.

What the data-use statement sets out. The sources by country, the fields we keep about people, who receives them, how long we keep them and how to object, ask for access, correction or erasure are in the data-use statement.

Why we may process it (Art. 6(1)(f)). The register's own legal duty to publish is the register's, not ours; our basis is legitimate interest. The interest is that of businesses, banks and professionals to verify the identity and standing of a counterparty, to meet anti-money-laundering and due-diligence duties, and to prevent fraud. It is necessary because the officer data is what identifies who controls a company. Balancing: the data is already public by law in the register, for the purpose of letting third parties check who stands behind a company; we add no private data and serve only the fields the register publishes; the use matches the register's purpose; people acting for a company can expect to be listed. Safeguards: no contact details for French sole proprietors; a privacy filter on insolvency notices; access only for authenticated business customers, who accept terms that allow only declared business purposes and never allow decisions on an individual's eligibility for credit, insurance, employment, housing or a public benefit, marketing to individuals, publication about individuals or profiling outside the business role (Terms of Service, section 5A); a duty on customers to apply removals and corrections within 10 working days (Terms of Service, section 7A); and objection and erasure handled as described in Section 8. This is a summary of our legitimate-interest assessment, which we revise when the data we serve, the sources or the law change.

2.4 Business Contact Data Published on Company Websites

We additionally collect business contact details published on companies' own websites — typically role-based addresses and phone numbers (for example info@, ventas@,administracion@), company social-media profiles, and occasionally a named employee's work contact details where the company publishes them on a public contact or team page.

Where such details identify a natural person, they constitute personal data and we process them on the basis of legitimate interest (GDPR Art. 6(1)(f)) in providing business-to-business company intelligence, balanced against the limited privacy impact of business contact information that the data subject's employer has itself made public. As this data is not collected directly from the data subject, we rely on Art. 14: the source is always the company's own public website, and this notice serves as the required source disclosure.

You may object to this processing or request erasure at any time by contacting privacy@prometiam.com. Suppression is applied across our systems so the contact is not re-collected on subsequent updates.

3. Legal Basis for Processing (GDPR Art. 6)

We process personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)) — customer account data: to provide the API service, manage your account, and process payments.
  • Legitimate interest (Art. 6(1)(f)) — register data about officers and owners (Section 2.3), business contact data (Section 2.4), and, for our customers, security, fraud prevention, service communications and the records that show who accepted our terms and for which purposes (proof of the contract and of compliant use).
  • Consent (Art. 6(1)(a)) — for website analytics, campaign tracking, marketing communications and any other non-essential cookies. You may withdraw consent at any time, for cookies under Cookie settings in the footer.
  • Legal obligation (Art. 6(1)(c)) — only for our own tax, accounting and regulatory duties, such as keeping invoices.

4. How We Use Your Data

  • Provide, operate, and maintain the Prometiam API
  • Authenticate API requests and enforce rate limits
  • Process transactions and send billing information
  • Respond to inquiries and provide customer support
  • Send product updates, security alerts, and administrative notices
  • Keep the record of who accepted which version of our terms and for which purposes, and check how the Service is used (Terms of Service, section 7B)
  • Tell customers which register data they must remove or correct (Section 8)
  • Analyze usage patterns to improve our platform and services
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations, and answer registers, data-protection authorities and courts

5. Data Sharing & Third Parties

We do not sell your personal data. The processors that handle personal data for us (Supabase, OVHcloud, Cloudflare, Stripe, Zoho, Anthropic, Telegram, Better Stack, the language-model providers behind the website assistant, and ipwho.is for consented analytics) are listed with their purpose and location on the sub-processors page. We give customers 30 days' notice of changes. We may also share information:

  • Customers — register data about officers and owners is returned to our business customers for the purposes they declare, on terms that limit what they may do with it and oblige them to apply removals and corrections (Terms of Service, sections 5, 5A and 7A). The data-use statement describes who receives it.
  • Registers and authorities — if a register, a data-protection authority, a court or another public body asks how data from the Service is used, we may tell it which account received which data, when, and for which declared purpose (Terms of Service, section 7B).
  • Legal requirements — when required by law, regulation, or valid legal process.
  • Business transfers — in connection with a merger, acquisition, or sale of assets, or when the contract moves to the company that takes over the Service (Terms of Service, section 17.3).

6. Data Retention

  • Account data: retained for the duration of your active subscription plus 30 days (as in the Terms), then deleted except what the law requires us to keep.
  • Acceptance records and declared purposes: kept while the account exists and for five years after it ends, the period within which a claim under the contract can be brought.
  • Register data about officers and owners: kept while the register publishes it and removed when the register removes it, at the next update.
  • Requests under Section 8: the request and our answer are kept for three years as proof of compliance.
  • API usage logs: retained for 12 months for security and billing purposes and, for the same 12 months, to tell customers that received a record which must be removed or corrected (Section 8).
  • Payment records: retained for 7 years as required by tax regulations.
  • Website analytics and campaign data: contain no name, email address or IP address, and may be retained indefinitely.
  • Business contact data (Section 2.4): re-verified against the company's public website at least every 24 months; contacts that can no longer be confirmed from a public source are deleted. Suppression requests are honoured permanently.

7. Data Security

We apply security measures including encryption in transit (TLS), API keys stored only as hashes, row-level access controls on customer data, emailed login codes with lockout, logged administrative actions, and reviews as the Service changes (see the trust page). However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Under GDPR and applicable data protection laws, you have the following rights:

  • Access (Art. 15) — request a copy of the personal data we hold about you.
  • Rectification (Art. 16) — request correction of inaccurate or incomplete data.
  • Erasure (Art. 17) — request deletion of your personal data ("right to be forgotten").
  • Portability (Art. 20) — receive your data in a structured, machine-readable format.
  • Restriction (Art. 18) — request that we limit processing of your data.
  • Objection (Art. 21) — object to processing based on legitimate interests or direct marketing.
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, write to support@prometiam.com (privacy@prometiam.com reaches the same place), saying which right and, for register data, which company you appear in. We may ask you to prove who you are. We keep a log of requests, respond without undue delay and in any event within one month, and tell you what we did. This period may be extended by two further months for complex requests, in which case we will inform you.

Register data. You may object to us serving your details as an officer or owner. We assess each objection against your particular situation (Art. 21(1)): we suppress your details in our service unless we can show compelling legitimate grounds that override your interests, rights and freedoms, and an objection by or for a minor or a protected person (for instance a victim of violence or a person under a confidentiality order) is always granted. The register itself still publishes them, and corrections to the data must be made at the source register to persist. When we erase, correct or suppress details, we tell the customers that received them, as Article 19 requires unless that is impossible or involves disproportionate effort, and under the Terms of Service (section 7A) they must apply it within 10 working days. On request we tell you who those recipients are.

Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority. For Spain, this is the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

9. Cookies

We ask before storing anything that is not essential. The cookie banner offers three categories; nothing optional is switched on until you choose it, and rejecting is as easy as accepting.

  • Essential (always on) — your sign-in, language, theme and your cookie choice, kept in your browser. The site cannot work without them.
  • Analytics (off until you switch it on) — the website analytics described in Section 2.2. Never used for advertising and never sold.
  • Campaigns (off until you switch it on) — the campaign data described in Section 2.2. Never used for advertising and never sold.

We use no advertising cookies.

You can change or withdraw your choice at any time under "Cookie settings" in the footer of any page.

10. Automated Decision-Making and Profiling

Prometiam takes no decision about any individual and returns no credit score, rating or prediction about an individual. The Service returns facts that registers and lists publish, and signals derived from them by fixed rules, such as a change of status, a match against a sanctions list or the number of companies in which a person holds an appointment. They are for a business's own review.

Some of these facts concern a person: a sole proprietor is the business, and an officer is named in the register. A customer that uses them to decide about an individual takes that decision itself and is responsible for it, including under Article 22 GDPR. The Terms of Service forbid using Register Data to decide an individual's eligibility for consumer credit, insurance, employment, housing or a public benefit, or to score or profile an individual other than in their role in a business the customer assesses (section 5A.1). If you think that a customer has done so with data from the Service, write to us (Section 8) and we will act on it under the Terms of Service.

11. International Transfers

Our primary infrastructure is in the EU: Supabase in Frankfurt, and OVHcloud in Germany for the company-data database. Some processors, such as Cloudflare, Anthropic, Telegram and the language-model providers, process data outside the EEA. In those cases the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses.

12. Children's Privacy

Our platform is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect, as the Terms of Service provide (section 17). The version and its date are at the top of the page, and earlier versions stay published at their own addresses.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: