Privacy Policy

1. Information we collect

Account information

When you create an account we collect your email address and a password, and optionally your name. Passwords are stored only as a salted hash. You can change your details in the dashboard at any time.

API keys

API keys are stored only as a cryptographic hash, together with a short prefix and the last characters so you can recognise them in the dashboard. We cannot recover a key once it has been created. If you restrict a key to certain domains, we store that list of domains.

API request logs

For every API request we log:

• the time of the request, the endpoint and its query parameters (with the API key removed),
• the response status, error code and response time,
• the IP address, the user agent and the country the request came from.

We use these logs to secure the Service, detect and prevent abuse, enforce plan limits, troubleshoot problems and show you usage statistics in your dashboard.

Billing information

If you subscribe to a paid plan, we store your plan, subscription status, Stripe customer identifier and billing history. Card details are handled by Stripe and never reach our servers (see section 5).

Price alerts, webhooks and widgets

If you create price alerts, we store the symbol, condition, threshold, optional note and the delivery channel you choose: your account email address, or a webhook URL that you provide. We also keep a record of each triggered alert and whether it was delivered. Widget settings you create are stored with your account.

Messages to us

When you contact us through the contact form, we store your name, email address, subject and message so we can reply, and the IP address it was sent from to fight spam.

2. How we use your information

• To create and run your account and provide the API, widgets and price alerts.
• To authenticate API requests, enforce rate limits and monthly quotas and show your usage.
• To process payments and manage subscriptions.
• To send emails you need, such as account confirmation, password reset, billing notices and the price alert emails you set up.
• To protect the Service, prevent fraud and abuse, and investigate security incidents.
• To answer support requests and tell you about important changes to the Service or these policies.
• To understand aggregate usage, such as which endpoints are popular, so we can improve the Service.

We do not use your data for advertising, we do not build advertising profiles and we do not sell or rent personal data to anyone.

3. Legal bases

Where the EU or UK General Data Protection Regulation (GDPR) applies, we process personal data on these bases:

• Performance of a contract: running your account, providing the API, alerts and billing.
• Legitimate interests: securing the Service, preventing abuse, keeping request logs and improving the Service.
• Legal obligations: keeping invoices and accounting records as required by tax law.
• Consent: where we ask for it. You can withdraw consent at any time.

4. Cookies

We use only cookies and browser storage that the Service needs to work:

• Authentication session: keeps you signed in to the dashboard. It is set when you sign in and removed when you sign out.
• Theme preference: remembers whether you chose the light or dark theme.

We do not use analytics, advertising or third-party tracking cookies. You can block cookies in your browser, but you will not be able to sign in to the dashboard without the session cookie.

5. Payments

Payments are processed by Stripe. When you subscribe, you enter your card or other payment details directly in Stripe’s checkout and customer portal. We never see or store your full card number; we only receive information such as your Stripe customer identifier, subscription status and invoices. Stripe processes payment data under its own privacy policy and is certified to the PCI DSS standard.

6. Hosting and service providers

The Service and its databases run on our own server, rented from Hetzner Online GmbH in Germany. Your account data, API keys, request logs and alerts are stored there.

All traffic to metalapi.com passes through Cloudflare, which provides encryption (TLS), protection against denial-of-service attacks and a web application firewall. To do this, Cloudflare processes request data such as IP addresses and may do so in data centres outside the European Economic Area.

We share personal data only with providers that help us run the Service:

• Hetzner Online GmbH (Germany): server hosting.
• Cloudflare, Inc.: network security and content delivery.
• Stripe: payment processing and subscription billing.
• Our email delivery provider: sending account, billing and price alert emails.

These providers may only use the data to provide their services to us. Where data is transferred outside the European Economic Area, the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses. If you configure a webhook, alert data is sent to the URL you choose; that recipient is under your control.

We may also disclose information if required by law, or where necessary to protect the rights, property or safety of MetalAPI, our users or the public.

7. How long we keep data

• API request logs are kept for 180 days and then deleted automatically. Daily and monthly request counters, which contain no IP addresses or user agents, are kept while your account exists.
• Account data, API keys, alerts, widgets and usage counters are kept while your account exists and are deleted when you delete your account, together with any request logs linked to it.
• Invoices and payment records are kept for as long as tax and accounting law requires, even after your account is deleted.
• Support messages are kept as long as needed to handle your request and any follow-up.

8. Security

All connections use HTTPS. Passwords and API keys are stored only as hashes, database access is restricted to the application, and administrative access is limited and logged. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password and API keys confidential and tell us straight away if you suspect they have been compromised.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy,
• have inaccurate data corrected,
• have your data deleted,
• restrict or object to certain processing, including processing based on legitimate interests,
• receive your data in a portable format,
• withdraw consent you have given, and
• lodge a complaint with a data protection supervisory authority.

Deleting your account: you can delete your account at any time from the settings page of your dashboard. This permanently removes your account, API keys, alerts, widgets and the request logs linked to your account. Only records we must keep by law, such as invoices, are retained.

To exercise any other right, contact us through our contact page. We may need to verify your identity before acting on a request.

10. Children

The Service is intended for developers and businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date above. If the changes are significant, we will also notify you by email or in the dashboard before they take effect.

12. Contact us

If you have questions about this policy or how we handle your data, please reach out through our contact page or email [email protected].