Last updated: 13 October 2026
This policy explains what personal data MetalRates (metalrates.cloud and api.metalrates.cloud) collects, why, and what you can ask us to do with it. MetalRates is run by Devstrom Solutions, Lahore, Pakistan, which is the data controller. Questions go to info@devstrom.net.
What we collect
- Forms. When you request an API key or contact us, we collect your name and email, and anything else you choose to fill in: company, website or app URL, the data you need, expected request volume and your message.
- API requests. When you call the API we process your API key, the endpoint, the time, the response status and your IP address. We need these to authenticate you, apply rate limits and plan quotas, prevent abuse and answer support questions.
- Website analytics. We use Google Analytics to see which pages are visited and how people find us. It uses cookies and collects data such as pages viewed, approximate location, device and browser.
- Security logs. Our firewall and web server record IP addresses, browser user agents and requested URLs to block attacks and keep the service running.
We do not ask for payment card details on this website, and we do not collect sensitive personal data.
How we use it
- To create and manage your API key and reply to your requests (to take steps you asked for before a contract, and to perform it).
- To run, secure and improve the website and API (our legitimate interest in a safe and reliable service).
- To understand how the website is used (with your consent where the law requires it).
- To meet legal, tax and accounting obligations.
We email you about your key, your plan and important service changes. We do not send newsletters unless you ask for them, and we never sell your personal data.
Who we share it with
We share data only with providers that help us run the service, under their own data protection terms:
- Hostinger, which hosts our servers.
- Google, for Google Analytics.
- Professional advisers or authorities, when the law requires it.
Our servers and some providers are outside your country. Where data leaves the UK, EEA or your home country, we rely on the safeguards those providers offer, such as standard contractual clauses.
How long we keep it
- Form submissions and account details: for as long as you use the API, and up to 24 months after our last contact.
- API request and security logs: as long as needed for security, rate limiting and billing, normally no longer than 12 months.
- Analytics data: according to the retention settings in Google Analytics, at most 14 months.
- Billing records: as long as tax law requires.
Cookies
Visitors who are not logged in get only Google Analytics cookies. Our firewall may set a short-lived cookie to tell people and bots apart. Logged-in administrators also get standard WordPress login cookies. You can block or delete cookies in your browser settings; the website still works without them.
Your rights
Depending on where you live, including under the GDPR, UK GDPR, the Saudi Personal Data Protection Law and UAE data protection law, you can ask to access, correct or delete your personal data, object to or restrict how we use it, take a copy with you, or withdraw consent. Email info@devstrom.net and we will reply within 30 days. You can also complain to your local data protection authority.
Security
We use HTTPS everywhere, store API keys only as one-way hashes on our side, keep a firewall in front of the website and limit who can reach our servers. No system is perfectly secure, so please keep your API key private and tell us at once if you think it has leaked.
Children
The service is meant for businesses and developers. It is not aimed at children under 16, and we do not knowingly collect their data.
Changes to this policy
If we change this policy, we update the date at the top. If a change is significant, we email active API users before it takes effect.
Contact
Devstrom Solutions, Lahore, Pakistan. Email info@devstrom.net, phone +92 300 6616434.