Last updated: 6 October 2026
This policy explains what personal data Promethean collects, why, and what your rights are. The data controller is Whetstone Labs, Netherlands (KvK 42104845), reachable at whetstonelabsnl@gmail.com.
What we collect
Account data. Your email address, username and a one-way hash of your password (we cannot see your password). Optionally, your TradingView username if you choose to link it.
Exchange API keys. The API keys, secrets, passphrases or wallet credentials you add so the Service can trade on your behalf. These are encrypted before they are stored and are decrypted only at the moment an order is placed or your account is checked. We recommend keys without withdrawal permission.
Bot configuration and trading activity. Your bots and their settings, every signal received for your account (including the raw webhook payload), and the result of each execution: exchange, symbol, side, quantity, price, order identifiers, status and error messages. This is the activity log you see in the Service.
Payment data. If you buy Lifetime, Stripe processes the payment. We receive and store only the Stripe session and payment identifiers, the amount and currency, and the date. We never see or store your card number. Your name and billing address are collected by Stripe for tax purposes under Stripe's own privacy policy.
Technical data. When you use the Service our hosting provider records standard server logs (IP address, time, pages requested, browser type). We also hold IP addresses briefly in memory to limit the rate of login attempts and webhook calls; these are not written to our database.
Emails. Transactional emails only (for example a password-reset link). We do not send marketing email.
Cookies
The Service uses a single, essential session cookie that keeps you logged in. It is marked HttpOnly and Secure, and expires after 24 hours. We use no advertising or analytics cookies and no tracking pixels.
Why we process your data
- To provide the Service you asked for: your account, your bots, and the orders you configure (performance of a contract).
- To keep the Service secure: encrypted key storage, rate limiting, protection against unauthorised access (legitimate interest).
- To take payment and keep required financial records (contract and legal obligation).
- To respond when you contact us (legitimate interest).
Who else receives your data
We use a small number of service providers, each acting on our instructions:
- Render (render.com) hosts the Service and its database in Frankfurt, Germany (EU).
- Stripe processes payments and acts as merchant of record for Lifetime purchases. See Stripe's privacy policy for how it handles your payment and billing details.
- Resend delivers transactional emails such as password resets.
- The exchanges you connect (for example BingX, Blofin, Hyperliquid or MEXC) receive the orders the Service places on your account, using your own API keys, under their own terms and privacy policies.
- The Service loads fonts from Google Fonts and some scripts from public content delivery networks (Tailwind CSS, unpkg). Your browser's request to those services exposes your IP address to them.
We do not sell personal data and do not share it with advertisers.
International transfers
Your account data is stored in the EU. Some providers above (for example Stripe, Google and the CDNs) may process data outside the EU under their own safeguards, such as the EU standard contractual clauses.
How long we keep data
Your account data, bots, keys and activity logs are kept until you delete your account, which you can do at any time from your Profile page. Deletion removes them from our database promptly.
Payment records are kept for as long as Dutch tax and accounting law requires (currently 7 years), even after account deletion; they contain the payment identifiers and amount, not your card details. Server logs held by our hosting provider expire on its retention schedule.
Your rights
Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to processing, and you can withdraw consent where processing is based on it. Email whetstonelabsnl@gmail.com and we will respond within one month. You also have the right to complain to a supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from children.
Changes
We may update this policy; the date at the top shows the current version. Material changes will be announced by email or with a notice in the Service.