Terrapin
Datasets
Government bonds Corporate bonds US agency bonds US municipal securities Yield curves
Platform Documentation
Company
Articles About us Support
Sign in / Register

Terrapin Finance Ltd Customer Privacy Notice

Last updated: 2026-10-29

This privacy notice tells you what to expect us to do with your personal information when you use our website, our platform, our API or our MCP server, including through an AI assistant you connect to them.

  • Contact details
  • Where we get personal information from
  • What information we collect, use, and why
  • Who we share it with
  • How long we keep information
  • Your controls
  • Platform analytics
  • Lawful bases and data protection rights
  • How to complain

Contact Details

Email:security@terrapinfinance.com

Where We Get Personal Information From

  • Directly from you, when you register, subscribe, use our website and platform, or contact us.
  • Through our API and MCP server, when you, or software you give one of your organization's API keys, sends us requests.
  • Through AI assistants you connect, such as Claude or ChatGPT. When an assistant needs our data to answer you, it calls one of our tools, and we receive that call's arguments: for example a search term, an ISIN or a date range, which the assistant takes from your conversation. Some assistants also attach metadata to each call: ChatGPT, for example, sends your approximate location, your language, details of the app you use, and anonymized IDs for you and your conversation. We don't use that metadata or keep it in our request records. We never receive your conversation, your other messages, or files you share with the assistant. How the assistant's provider handles your conversation, and the results our tools return, is governed by that provider's privacy policy.

What Information We Collect, Use, and Why

To Provide Services and Goods, Including Delivery:

  • Account information: your email address, the organizations you belong to and your role in them, your region, and the time and IP address of your last sign-in.
  • Purchase or account history.
  • Information relating to compliments or complaints.

For the Operation of Customer Accounts and Guarantees:

  • Purchase history and subscription details. Your payment card details are collected and held by our payment processor, not by us.
  • Account information, including registration details.
  • Information used for security purposes.
  • Marketing preferences.

To Authenticate API, MCP and AI Assistant Connections:

  • API keys: a hash of each key, the organization it belongs to, the user who created it and when.
  • Connection tokens: an AI assistant connection uses one of your organization's API keys, stored the same way.

To Run, Meter and Secure API and MCP Requests:

  • Request records: for each API request, including each tool call an AI assistant makes through our MCP server, the organization and API key it was made with, the endpoint, the full request body (for an assistant, the tool-call arguments described above), a request ID and the time.
  • Usage counts: which securities your organization has queried in each month, to apply your plan's quotas.
  • Server logs: for each request to our website, API and MCP server, the time, IP address, method, address requested, response status and browser or client details, plus the organization for API requests. Logs don't record request bodies.

We use request records and logs to provide the API, apply your plan's limits, monitor usage, keep our services secure, and investigate problems you report.

For Service Updates or Marketing Purposes:

  • Email address and marketing preferences.

For Dealing with Queries, Complaints, or Claims:

  • Account information.
  • Purchase or service history.
  • Relevant information from previous investigations.
  • Customer or client accounts and records.

Who We Share It With

We don't sell personal information. We share it only with service providers that process it for us, on our instructions, and where the law requires us to.

  • Hosting providers, in the United States, the United Kingdom and the EU, run our servers, databases and logs.
  • Stripe, our payment processor, handles subscriptions and payments, and holds your card details.
  • A transactional email provider sends account emails, service updates and marketing emails.
  • A bot-protection service protects our sign-in, registration and contact forms from bots. Its script loads on every page of our public website, so it receives your IP address and browser details when you visit one.
  • An error-monitoring service receives reports of errors in our services, which can include details of the request that caused them.
  • A website analytics provider, in the EU, measures visits to our public website without cookies. It uses your IP address and browser details only to produce anonymised statistics, and doesn't store them.
  • A platform analytics provider measures how our platform is used. See Platform Analytics below.

We store your personal information in the UK, the US and the EU. Some of these providers also process it in other countries.

How Long We Keep Information

  • Account information: for as long as your account exists.
  • Billing records: for as long as your account exists, then for as long as tax and accounting law requires.
  • API keys: until you delete them, or until the organization they belong to is deleted.
  • API and MCP request records and usage counts: for as long as the organization whose key made the request has an account with us. They are deleted with it.
  • Server logs: 90 days.
  • Platform analytics data: for as long as your account exists. We delete it when we delete your account.
  • Marketing preferences: until you change them or delete your account.

Users may request deletion of their data at any time.

Your Controls

  • Disconnect an AI assistant by deleting the API key it uses under API Keys in your account settings. The key stops working at once, and the assistant's next request is refused. Removing our connector in the assistant stops it calling us, but doesn't delete the key.
  • Stop service updates and marketing emails in your account settings, or with the unsubscribe link in any of them.
  • Turn platform analytics on or off under Cookie preferences in your account settings. While it's off, we don't load the analytics provider.
  • Delete your account by emailing us at the address at the top of this notice. We delete your account and all the personal information we hold about you, except what the law requires us to keep, such as billing records.
  • Request a copy of your data, or its correction or deletion, using the same address. See your data protection rights below.

Platform Analytics

This section applies only to our platform, the pages under https://terrapinfinance.com/platform. It doesn't apply to our public website, your account settings, our API or our MCP server.

We use an analytics provider, in the United States, to understand how our platform is used and improve it. When you use the platform, we may send it:

  • An identifier for you within your current organization.
  • Your email address, and your organization's name and plan.
  • Your IP address.
  • Technical information about your browser and device, such as browser type and version, operating system and screen resolution.
  • Usage data, such as the pages you visit, the buttons you click and how you interact with the platform.

The provider stores identifiers in your browser's local storage to recognise your browser and measure how you use the platform. You can turn analytics off at any time: see Your Controls.

Lawful Bases and Data Protection Rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. You can find more about lawful bases on the ICO’s website.

Your Data Protection Rights

  • Your right of access You have the right to ask us for copies of your personal information and other details, such as its sources or recipients.

  • Your right to rectification You have the right to ask us to correct or delete inaccurate or incomplete personal information.

  • Your right to erasure You have the right to ask us to delete your personal information.

  • Your right to restriction of processing You can ask us to limit how we use your personal information.

  • Your right to object to processing You can object to the processing of your personal data.

  • Your right to data portability You can ask us to transfer your personal information to another organisation or to you.

  • Your right to withdraw consent If we rely on consent as our lawful basis, you can withdraw your consent at any time.

We will respond to requests within one month. To make a data protection rights request, contact us using the details at the top of this notice.

Our Lawful Bases for Collecting and Using Personal Information

To Provide Services and Goods:

Lawful Basis: Contract We must collect or use the information to enter into or carry out a contract with you. All data protection rights may apply except the right to object.

For the Operation of Customer Accounts and Guarantees:

Lawful Basis: Contract We must collect or use the information to enter into or carry out a contract with you. All data protection rights may apply except the right to object.

To Authenticate and Run API, MCP and AI Assistant Connections:

Lawful Basis: Contract We must collect or use the information to enter into or carry out a contract with you. All data protection rights may apply except the right to object.

To Secure Our Services and Investigate Problems:

Lawful Basis: Legitimate interests We use request records and server logs to keep our services secure and working, which is in our and our customers' interest. All data protection rights may apply except the right to data portability.

For Website Analytics:

Lawful Basis: Legitimate interests We use anonymised statistics about visits to our public website to understand how it's used and improve it, which is in our interest. All data protection rights may apply except the right to data portability.

For Platform Analytics:

Lawful Basis: Legitimate interests, or consent where the law requires it We use analytics to understand how our platform is used and improve it, which is in our and our customers' interest. All data protection rights may apply.

For Service Updates or Marketing Purposes:

Lawful Basis: Contract We must collect or use the information to enter into or carry out a contract with you. All data protection rights may apply except the right to object.

For Dealing with Queries, Complaints, or Claims:

Lawful Basis: Contract We must collect or use the information to enter into or carry out a contract with you. All data protection rights may apply except the right to object.

How to Complain

If you have concerns about how we use your personal data, you can complain to us using the contact details at the top of this notice.

If you remain unhappy after raising a complaint, you can also complain to the ICO:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline number: 0303 123 1113 Website: www.ico.org.uk/make-a-complaint