Privacy Policy

1. Personal data we collect

A) Data you provide

• Account information: email address and password (stored only as a hash by our authentication provider), or the profile details Google shares when you sign in with Google.
• Organization details: the organization name you create, your role in it, and an optional contact email.
• Billing details: handled by Stripe. We store your Stripe customer and subscription identifiers and subscription status; we never see or store full card numbers.
• Communications: support requests and feedback you send us.

B) Data collected automatically

• API keys: we store a cryptographic hash of each key, its label, scopes, optional IP allowlist and last-used time. The key itself is shown once and never stored.
• Usage records: for every API or plugin request, the organization, the API key or signed-in user that made it, the route, timestamp, response status, duration, rows returned and bytes sent. These drive rate limits, the usage dashboard and billing.
• Technical logs: IP address, request identifiers, user agent, timestamps and error details, kept for security, abuse prevention and debugging.
• AI assistant connections: when you connect ChatGPT, Claude or another MCP client, we record the OAuth client you approved, the scopes granted and when, so you can review and revoke it.

C) Data from third parties

• Payment status and transaction events from Stripe.
• Sign-in identity from Google when you choose Google sign-in.

D) Personal data inside the dataset

The Mining Data API serves facts extracted from public filings and announcements of listed mining companies. Those documents can name directors, officers, geologists and other individuals in their professional capacity. We process such public-record data on the basis of our legitimate interest in providing a mining-intelligence dataset; the rights described in section 8 apply to it.

Children

The Services are not directed to children and are intended for business use. We do not knowingly collect personal data from anyone under 16 (or the higher age required by local law) and will delete such data if we learn of it.

2. Purposes and legal bases

• Provide the Services (accounts, organizations, API keys, data delivery, plugin sign-in, support): performance of a contract and legitimate interests.
• Meter, bill and enforce plan limits (usage records, rate limits, subscription status): performance of a contract and legal obligations (accounting and tax).
• Operate, secure and improve (monitoring, debugging, preventing fraud and abuse, capacity planning): legitimate interests and legal obligations.
• Communicate about your account, service changes, security and billing: performance of a contract. Marketing email only with your consent where required, with an unsubscribe link in every message.
• Comply and enforce (lawful requests, enforcing our terms, protecting rights and safety): legal obligations and legitimate interests.

Where we rely on consent you can withdraw it at any time. Where we rely on legitimate interests we balance them against your rights and expectations.

3. ChatGPT, Claude and other AI assistants

When you connect the Mining Data API to an AI assistant, you sign in to your Mining Data API account and approve the assistant on our consent screen. From then on, the assistant sends us only the tool requests it composes (search filters, record ids, tickers, and on Enterprise plans SQL text) and receives our responses. We do not receive your conversations, prompts or files, and we do not send the assistant anything beyond those responses.

The assistant provider (OpenAI for ChatGPT, Anthropic for Claude, or the operator of another MCP client) processes what you type and what we return under its own terms and privacy policy, which you should review. You can revoke an assistant at any time from the portal’s AI plugins section or from the assistant’s own settings; revocation ends its sessions immediately.

4. How we share personal data

We share personal data only as follows:

• Service providers under contract, listed in section 5.
• AI assistant providers you have chosen to connect, as described in section 3.
• Corporate transactions: a merger, acquisition, financing, reorganization or sale of assets, with appropriate safeguards.
• Legal and safety: to comply with law or lawful requests, or to protect the rights, property or safety of OreStocks, our customers or others.
• Aggregated or de-identified data that cannot reasonably identify you.

We do not sell personal data and we do not share it for cross-context behavioral advertising.

5. Service providers

Each provider is bound by a data processing agreement and may only use personal data to provide its service to us. We will update this list when providers change.

6. International transfers

We are based in Sweden and host the Services in the European Union. Where personal data from the EEA, UK or Switzerland is transferred outside those regions, for example to a provider’s US operations or to an AI assistant provider you connect, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (with the UK Addendum where applicable) together with technical and organizational measures.

7. Retention

• Account and organization data: for as long as your account exists, then deleted or de-identified within 90 days of closure unless we must keep it longer by law.
• Usage records: up to 24 months, for billing disputes, abuse investigation and capacity planning, then aggregated.
• Technical logs: typically 30 days; security incident records longer where needed.
• Billing records: as required by Swedish accounting law (currently seven years).
• API key hashes and assistant grants: until revoked, then kept in the audit log for up to 24 months.

8. Security

We use technical and organizational safeguards designed to protect personal data: encryption in transit, hashed credentials, least-privilege database roles, read-only data access for the API, audit logging, and access controls. No system is completely secure. Keep your API keys secret; a key is shown once and can be revoked at any time from the portal.

9. Cookies

The portal uses only strictly necessary cookies: your sign-in session and a token that protects forms against cross-site requests. We do not use analytics or advertising cookies on miningdataapi.com, so there is no cookie banner and nothing to opt out of. If that changes we will update this section and ask for consent where required. The API itself sets no cookies.

10. Your rights

Your rights depend on where you live. To exercise any of them, email support@miningdataapi.com from your account address. We may ask you to verify your identity, and we respond within the time required by law.

EEA, UK and Switzerland (GDPR)

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erasure, in the circumstances the law provides.
• Restrict processing in certain cases.
• Data portability for data you provided to us.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where processing is based on consent.

You may also lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY).

United States

Residents of California, Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy laws may have the right to know, access, correct and delete personal information, to opt out of sales, sharing for targeted advertising and certain profiling, and to appeal a denied request. We do not sell personal information and do not share it for targeted advertising. We do not use sensitive personal information to infer characteristics. We will not discriminate against you for exercising these rights.

Canada (PIPEDA)

You may access and correct your personal information, withdraw consent subject to legal or contractual restrictions, and challenge our compliance with PIPEDA principles. You may contact the Office of the Privacy Commissioner of Canada or your provincial commissioner.

Authorized agents may submit requests on your behalf where the law permits; we may require proof of authorization.

11. Marketing communications

You can opt out of marketing email at any time with the unsubscribe link in the message or by contacting us. We will still send transactional messages about your account, security, billing and service changes. We comply with CAN-SPAM (US) and CASL (Canada).

12. Automated processing

The dataset includes automated scores and classifications about mining companies and projects, for example drill-result scores, derived from public filings. These are about companies, not about you, and we make no automated decisions with legal or similarly significant effects about users.

13. Third-party links and services

The Services link to and integrate with third-party services (for example Stripe, Google sign-in and the AI assistants you connect). We are not responsible for their privacy practices; review their policies before sharing data with them.

14. Changes to this policy

We will post updates here with a new effective date and, for material changes, notify account holders by email or in the portal. Continued use of the Services after the effective date means you accept the updated policy.

15. Contact

OS Group International AB
Garverigränd 15, 131 60 Nacka, Sweden
support@miningdataapi.com

See also our Terms of Service.