| Field | Detail |
|---|---|
| Controller | AIONIOS CAPITAL LLP |
| Trading as | metals-api.eu |
| Registered address | 27 Old Gloucester Street, London, WC1N 3AX, England and Wales |
| Company/VAT number | (insert company/VAT number) |
| UK representative | Brian Vilborg, AIONIOS CAPITAL LLP |
| Privacy contact | privacy@metals-api.eu |
| Data | Purpose | Legal basis |
|---|---|---|
| Full name | Identify account holder; address communications | Art. 6(1)(b) — contract |
| Business email | Deliver API keys; service notifications | Art. 6(1)(b) — contract |
| Company name | B2B invoicing; VAT compliance | Art. 6(1)(b)+(c) |
| Country | VAT rate; export compliance | Art. 6(1)(c) — legal obligation |
| VAT number (optional) | Reverse-charge invoicing | Art. 6(1)(c) — legal obligation |
| Data | Purpose | Legal basis |
|---|---|---|
| API key (pseudonymous) | Authenticate requests; enforce quota | Art. 6(1)(b) — contract |
| API call logs (endpoint, timestamp, anonymised IP) | Service health; abuse detection; quota enforcement | Art. 6(1)(f) — legitimate interest |
We do not store card numbers or payment credentials. Payment processing happens entirely within PayPal's and ComGate's own systems. We receive only a transaction reference and status.
Invoice amount, currency, subscription tier, and payment status are retained for VAT invoicing under Art. 6(1)(b)+(c).
We use only strictly necessary cookies by default — no consent required. We do not use Google Analytics or behavioural tracking without explicit opt-in.
| Cookie | Category | Purpose | Duration |
|---|---|---|---|
| session_id | Strictly necessary | Maintains authenticated portal session | Session |
| csrf_token | Strictly necessary | Prevents CSRF on portal forms | Session |
| cookie_prefs | Strictly necessary | Stores your consent choice | 12 months |
Raw IP addresses are truncated to /24 subnet within 24 hours of collection (last octet zeroed). Full IPs are never written to persistent storage.
We use personal data only for: delivering the API service, generating invoices, transactional emails (API key delivery, quota alerts, service notices), enforcing quotas, detecting abuse, maintaining accounting records, and responding to support requests. We never use your data for advertising or profiling.
| Processor | Role | DPA status |
|---|---|---|
| Hetzner Online GmbH | EU hosting (Germany) | DPA in place |
| PayPal (Europe) S.à r.l. | Payment processing | Independent controller; PayPal Privacy Statement applies |
| ComGate Payments, a.s. | Payment processing (CZ/SK) | Independent controller; ComGate Privacy Policy applies |
| Transactional email provider | API key delivery, invoices | DPA in place; EU-hosted or SCCs applied |
| Transfer | Destination | Safeguard |
|---|---|---|
| PayPal | USA | EU–US Data Privacy Framework (DPF), Commission Decision 2023/1795 |
| ComGate | Czech Republic (EU) | No transfer outside EEA |
| Email provider | EU or USA | EU: none required. US: SCCs under Decision 2021/914 |
| Data category | Retention | Reason |
|---|---|---|
| Account data | Duration + 3 years after closure | Contract dispute limitation period |
| API call logs | 90 days | Abuse detection; aggregated after |
| Invoice & payment records | 7 years from invoice date | Statutory accounting obligation |
| Support emails | 2 years from last contact | Legitimate interest |
| Server access logs | 30 days | Security monitoring |
| Cookie consent records | 3 years | ePrivacy compliance |
| Right | What it means | How to exercise |
|---|---|---|
| Art. 15 — Access | Request a copy of all data we hold about you | Email privacy@metals-api.eu — subject "Access Request" |
| Art. 16 — Rectification | Correct inaccurate data | Email or portal self-service |
| Art. 17 — Erasure | Delete your data (where no legal basis to retain) | Email — subject "Erasure Request" |
| Art. 18 — Restriction | Pause processing during a dispute | Email — subject "Restriction Request" |
| Art. 20 — Portability | Receive your data in JSON or CSV | Email — subject "Portability Request" |
| Art. 21 — Object | Object to legitimate-interest processing | Email — subject "Objection" |
| Art. 21(2) — No direct marketing | We do not send marketing. Opt out at any time at no cost if we ever do. | Unsubscribe link or email |
| Art. 22 — No automated decisions | Request human review of automated quota/suspension decisions | Email privacy@metals-api.eu |
Response time: 30 days (extendable by 60 days for complex requests, with notice).
Quota enforcement: When you reach your plan limit, API requests are rejected automatically (HTTP 429). This is usage-based only — no profiling involved. You may request human review at any time.
Account suspension for abuse: Accounts matching abuse patterns may be suspended automatically. You are notified by email within 24 hours. A human reviews within 3 business days.
All traffic is TLS 1.2+ encrypted. API keys are hashed before storage. Databases and backups are encrypted at rest. IP addresses in logs are anonymised within 24 hours. Annual penetration testing is performed.
In the event of a personal data breach, we will notify the supervisory authority within 72 hours (Art. 33) and affected individuals without undue delay if high risk to rights and freedoms (Art. 34).
Privacy contact: privacy@metals-api.eu
You have the right to lodge a complaint with your national supervisory authority, or with the authority where we are established:
Information Commissioner's Office (ICO)
Website: ico.org.uk · Email: casework@ico.org.uk · Tel: 0303 123 1113
Full list of EU DPAs: edpb.europa.eu
Material changes will be communicated by email (30 days notice) and portal notice. Previous versions are available on request.
metals-api.eu — Privacy Policy v1.0 — Effective 2026-06-13 · Controller: AIONIOS CAPITAL LLP · privacy@metals-api.eu
Real-time and historical prices for gold, silver, copper and 600+ industrial metals. EUR-native pricing, GDPR-compliant, with the world's only native Odoo 19 integration.
# Fetch live gold price in EUR GET https://metals-api.eu/v1/latest ?access_key=YOUR_KEY &base=EUR &symbols=XAU,XAG,XCU ── Response 200 OK ────────────────── { "success": true, "timestamp": 1749811200, "base": "EUR", "rates": { "XAU": 0.000323, // €3,096/troy oz "XAG": 0.032811, // €30.48/troy oz "XCU": 0.234567 // €4.26/lb }, "unit": "per_troy_oz", "latency_ms": 42 }
Streaming prices updated every minute from LME, LBMA, and COMEX. All prices shown in USD per troy oz.
Every feature designed around what industrial buyers, traders, and ERP developers actually need — not a US-first API bolted onto Europe.
No FX risk. No hidden fees. Cancel anytime. Upgrade or downgrade instantly.
We built the API we wished existed. Here's how we stack up against the incumbents.
| Feature | metals-api.eu | Metals-API.com | MetalpriceAPI.com |
|---|---|---|---|
| Free Trial (no card) | ✅ 100 calls forever | ⚠️ Card required | ⚠️ Card required |
| EUR-Native Pricing | ✅ Fixed EUR, EU invoice | ❌ USD only | ❌ USD only |
| Correct Price Format | ✅ Price per troy oz / lb | ❌ Inverted (oz per unit) | ⚠️ Inconsistent units |
| GDPR Compliant | ✅ EU-hosted, DPA available | ❌ US-hosted | ❌ US-hosted |
| Never-Expiring Bundles | ✅ Prepaid, no expiry | ❌ Monthly reset | ❌ Monthly reset |
| Odoo 19 Native Module | ✅ Official App Store module | ❌ Not available | ❌ Not available |
| WebSocket Streaming | ✅ All paid plans | ❌ REST only | ❌ REST only |
| Webhooks | ✅ Crucible+ | ❌ Not supported | ⚠️ Enterprise only |
| LME + LBMA + COMEX | ✅ All three exchanges | ⚠️ Partial | ⚠️ Partial |
| 612+ Metal Symbols | ✅ 612 symbols | ⚠️ ~60 symbols | ⚠️ ~80 symbols |
| 1-Minute Real-Time Data | ✅ Titan plan | ⚠️ Enterprise only | ❌ 15-min minimum |
| Annual Discount | ✅ Up to 20% off | ⚠️ Partial | ⚠️ Partial |
Clean REST API with predictable JSON responses. SDKs for Python, JavaScript, and PHP. Full OpenAPI spec available.