Terms of Service, Risk Disclosures and Privacy Policy

1. Agreement to these Terms

These Terms of Service (the “Terms”) are a binding contract between you and Auro Management LLC, a North Carolina limited liability company doing business as Prometheus (“Prometheus,” “we,” “us” or “our”). They govern your access to and use of prometheusportfolio.com, our web and mobile applications, our software agent, research assistant, APIs and all related services (together, the “Service”).

By creating an account, checking a box that references these Terms, connecting a brokerage account, or using the Service in any way, you confirm that you have read, understood and agree to these Terms, the Risk Disclosures, the Privacy Policy and any additional terms shown to you in the Service (all of which are incorporated by reference). If you do not agree, do not use the Service.

THESE TERMS CONTAIN A BINDING ARBITRATION AGREEMENT AND CLASS ACTION WAIVER (SECTION 21) THAT AFFECT HOW DISPUTES ARE RESOLVED, AND LIMITATIONS OF OUR LIABILITY (SECTIONS 17 AND 18). PLEASE READ THEM CAREFULLY.

2. Eligibility

You may use the Service only if you: (a) are at least 18 years old and have the legal capacity to enter into contracts; (b) are a resident of the United States; (c) are not located in, organized in, or ordinarily resident in a country or territory subject to comprehensive U.S. sanctions, and are not on any U.S. government restricted-party list; (d) are using the Service for your own personal account and not on behalf of any other person or entity, unless we agree otherwise in writing; and (e) have not previously been suspended or removed from the Service.

You represent that all information you provide to us is true, accurate, current and complete, and you will keep it updated.

3. What the Service is, and what it is not

Prometheus is a self-directed portfolio software tool. It applies rules, parameters and inputs that you choose or accept (including your selection of securities, your written thesis, your price scenarios, your confidence levels, position limits, cash targets, freshness periods, rebalancing bands, approval settings and overrides) to calculate position sizes and, if you enable it, to transmit orders to a brokerage account that you own and control.

• Prometheus does not select securities for you. Every security in your portfolio is one that you added.
• Prometheus does not provide personalized investment, financial, legal, tax or accounting advice, and nothing in the Service is a recommendation, solicitation or offer to buy or sell any security or to adopt any investment strategy.
• Prometheus is not a broker-dealer, investment adviser, commodity trading advisor, bank, custodian, fiduciary or financial planner. We do not hold, custody or have access to your money or securities, and we cannot move money into or out of your accounts.
• Default settings, templates, example values, sizing methods, research summaries and any content generated by the Service are provided as general-purpose tools for your consideration. You are solely responsible for deciding whether to use, change or reject them.
• Any reference in the Service to a method, framework, “institutional” practice or the practices of professional investors describes a general approach only. It is not an endorsement by, or affiliation with, any third party, and does not imply that the Service will produce results similar to any professional investor.

No fiduciary, advisory, agency, partnership or similar relationship is created between you and us by these Terms or your use of the Service. You agree that you are not relying on us for investment advice, and that you will consult your own licensed professionals before making any investment decision.

4. Your authorization of automated trading

If you connect a brokerage account and enable automated trading for any position, you expressly authorize and direct the Service, as your software agent acting on your instructions, to: (a) access and read information about your brokerage accounts, including balances, positions, orders and transactions; and (b) create, review, submit, modify and cancel orders in the specific trading account you designate (such as a Robinhood Agentic account), in amounts and at times determined by the rules and settings you have chosen or accepted, without asking for your separate approval of each order.

• Orders may be placed during regular market hours on any trading day and may be market orders, dollar-based orders and/or fractional-share orders. Market orders execute at the prevailing price, which may differ materially from the price displayed in the Service.
• You may at any time: require approval for any position; lock, freeze or exit any position; change any rule; pause all trading; or disconnect your brokerage account. Changes take effect for orders not yet transmitted. Orders already transmitted to your broker may not be stoppable.
• Approvals you give, rules you set and overrides you apply are your instructions. Orders placed in accordance with your instructions, settings or defaults you did not change are deemed authorized by you.
• You are solely responsible for monitoring your account, your positions and all orders, and for promptly reviewing confirmations and statements from your broker. You must notify your broker and us immediately of any order you believe was unauthorized or erroneous.

You acknowledge that the Service is designed to trade automatically, that it may place many orders, and that the results of automated trading may be worse than if you had traded manually or not at all.

5. Your brokerage relationship

Brokerage, custody, execution, clearing and related services are provided solely by your broker (currently Robinhood Financial LLC and its affiliates, “Robinhood”) under your separate agreements with that broker. We are not affiliated with, endorsed by or acting on behalf of Robinhood or any broker.

• Your broker, not us, decides whether to accept, route, execute, reject or cancel any order; sets order types, trading hours, fees, margin, buying power and account restrictions; and is responsible for the custody of your assets and for providing your official confirmations, statements and tax documents.
• Robinhood has stated that it does not control, supervise or audit third-party agents, and that customers assume the risk of trades executed by AI agents and of third-party providers’ use of their data. You agree to and accept that allocation of risk.
• You are responsible for opening, funding and maintaining your brokerage account, and for all fees, commissions, interest, taxes and charges your broker imposes. The amount you choose to fund in the designated trading account is the amount exposed to automated trading. Do not fund that account with money you cannot afford to lose.
• Your broker’s records are the official record of your account. Information shown in the Service is for convenience only, may be delayed, incomplete or inaccurate, and does not replace your broker’s confirmations and statements.

Your broker may change, suspend or discontinue the access methods the Service relies on (including any API or agent connection) at any time, which may interrupt, degrade or end the Service’s ability to read your account or trade. We are not responsible for any such action or its consequences.

6. Your account and security

You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account, whether or not authorized by you. You agree to use a strong, unique password, to secure the email account associated with your login, and to notify us immediately at legal@prometheusportfolio.com of any unauthorized access. We are not liable for any loss resulting from unauthorized use of your credentials or devices.

If you share access to a portfolio with another person (as an editor, analyst or viewer), you are responsible for that person’s actions in the Service as if they were your own.

7. Research tools and AI-generated content

The Service includes a research assistant that uses third-party artificial-intelligence models (currently provided by Anthropic) to read material you provide and to suggest summaries, theses, price scenarios, sectors and other inputs. AI-generated content may be inaccurate, incomplete, outdated, biased or fabricated, even when it appears confident.

• You must review and confirm every input before it is used. Inputs you confirm, edit or accept are your inputs.
• Confidence levels are always your own judgment. The Service will not treat an AI suggestion as your confidence level unless you enter or accept it.
• Do not upload material you do not have the right to share, material containing material non-public information, or personal information about other people.

8. Market data and third-party content

Prices, volatility, liquidity, sector classifications, benchmark returns and other data in the Service come from third parties (including your broker and public market-data sources), may be delayed, estimated, interrupted or incorrect, and are provided “as is.” Calculations that depend on that data, including position sizes and orders, may therefore be wrong. We do not guarantee the accuracy, timeliness or completeness of any data, and we are not responsible for decisions or orders based on it.

Links to and integrations with third-party services are provided for convenience. We do not control and are not responsible for third-party services, and your use of them is governed by their terms.

9. Paper portfolios and performance information

Paper (simulated) portfolios do not involve real money. They assume orders fill at the last available price, generally ignore commissions, spreads, slippage, taxes, liquidity constraints, partial fills, rejections and market impact, and benefit from hindsight in their design. Simulated results have inherent limitations and are not indicative of future live results.

Any returns, charts, benchmarks or statistics shown in the Service are calculated from recorded values, may not reflect deposits, withdrawals, dividends, fees or corporate actions correctly, are not audited, and are not a guarantee or prediction of future performance. Past performance does not guarantee future results.

10. Plans, fees and billing

Access to the Service requires a paid plan unless we have waived fees for you. Current plans are: (a) $20 per month; (b) $99 per year; or (c) a usage-based software service fee equal to 0.1% of the notional value of each order the Service submits on your behalf (the “Worker Fee”), accrued per order and billed monthly in arrears. Prices may change on notice as described below.

• The Worker Fee is a fee for the use of software and computing resources. It is not a commission, markup, spread or transaction-based compensation for effecting securities transactions, and it is charged by us, not your broker, separately from any fees your broker charges. The Worker Fee accrues on orders submitted whether or not those orders are profitable.
• Subscriptions renew automatically at the end of each billing period at the then-current price until you cancel. You authorize us and our payment processor (Stripe) to charge your payment method for all fees when due. You may cancel at any time in Account; cancellation takes effect at the end of the current billing period.
• All fees are non-refundable and are not prorated, except where required by law. Fees exclude taxes, which you are responsible for.
• If a payment fails, we may suspend automated trading and other features until it is resolved. Accrued fees remain payable after cancellation or termination.
• We may change our prices or plans by giving you at least 30 days’ notice. Changes apply from your next billing period. If you do not agree, you may cancel before the change takes effect.

11. Access codes and early-access program

We may offer access codes, fee waivers, early-access or beta features at our discretion. Unless we state otherwise in writing, a waiver of fees applies only to our subscription and Worker Fees, does not apply to any broker or third-party fees, is personal and non-transferable, has no cash value, and may be modified or ended by us for misuse, for violation of these Terms, or if we discontinue the program, in which case we will give you reasonable notice before any fees apply. Beta and early-access features are experimental, may contain errors, and may be changed or withdrawn at any time.

12. Feedback

If you send us ideas, suggestions, bug reports or other feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free, fully paid, sublicensable and transferable license to use, modify, commercialize and otherwise exploit it for any purpose without compensation or attribution to you. You will not acquire any ownership interest in the Service or any part of it because of your feedback.

13. Your content

You retain ownership of the research, notes and files you upload (“Your Content”). You grant us a worldwide, non-exclusive, royalty-free license to host, store, process, transmit, display and analyze Your Content as needed to operate, secure, support and improve the Service, including sending it to our service providers (such as AI model providers) for processing. You represent that you have all rights needed to grant this license and that Your Content does not violate any law or third-party right.

We may use aggregated or de-identified information derived from use of the Service for any lawful purpose, including improving the Service and developing new features.

14. Acceptable use

You agree not to: (a) use the Service to manipulate any market, engage in wash trading, spoofing, layering, front-running or any other illegal or abusive trading practice; (b) trade on material non-public information; (c) use the Service for anyone else’s account or as part of a business offering investment services to others; (d) reverse engineer, scrape, copy, resell or create derivative works of the Service; (e) interfere with or circumvent the Service’s security, rate limits, guardrails or access controls; (f) upload malware or unlawful content; (g) use the Service in violation of your broker’s terms or any law or regulation; or (h) misrepresent your identity or eligibility.

15. Our intellectual property

The Service, including its software, algorithms, sizing logic, designs, text, graphics, logos and trademarks, is owned by Auro Management LLC or its licensors and is protected by intellectual-property laws. Subject to these Terms, we grant you a limited, revocable, non-exclusive, non-transferable, non-sublicensable license to use the Service for your own personal, non-commercial investing purposes. All rights not expressly granted are reserved.

16. Availability, changes and termination

The Service may be unavailable, delayed or interrupted, including during market hours, because of maintenance, outages, third-party failures, broker restrictions, internet or power failures, cyberattacks or other causes. The Service may fail to place, place late, place more than once, or place incorrect orders. We have no obligation to provide any particular feature, uptime or support level.

We may modify, suspend or discontinue any part of the Service, including automated trading, at any time, with or without notice. We may suspend or terminate your access, pause trading in your account, or disconnect your brokerage link at any time, including if we believe you have violated these Terms, if required by law or a regulator, or to protect you, us or others. You may stop using the Service and disconnect your broker at any time. Sections that by their nature should survive termination will survive, including Sections 3, 4, 5, 7 to 10, 12, 13, 15 and 17 to 24.

17. Disclaimer of warranties

TO THE FULLEST EXTENT PERMITTED BY LAW, THE SERVICE AND ALL CONTENT, DATA, CALCULATIONS, AI OUTPUTS, ORDERS AND DEFAULT SETTINGS ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITH ALL FAULTS AND WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE OR ERROR-FREE, THAT ORDERS WILL BE PLACED OR EXECUTED AS INTENDED, THAT ANY STRATEGY OR SETTING WILL ACHIEVE ANY RESULT, OR THAT YOU WILL NOT LOSE MONEY. YOU USE THE SERVICE AT YOUR SOLE RISK.

18. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW: (A) IN NO EVENT WILL AURO MANAGEMENT LLC OR ITS MEMBERS, MANAGERS, OFFICERS, EMPLOYEES, CONTRACTORS, AGENTS, LICENSORS OR SERVICE PROVIDERS (THE “PROMETHEUS PARTIES”) BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY TRADING LOSSES, LOST PROFITS, LOST OPPORTUNITIES, DIMINUTION IN VALUE, LOSS OF DATA OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS, WHETHER BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR ANY OTHER THEORY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) THE TOTAL AGGREGATE LIABILITY OF THE PROMETHEUS PARTIES FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE GREATER OF (i) THE FEES YOU ACTUALLY PAID US IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (ii) ONE HUNDRED U.S. DOLLARS (US$100).

Without limiting the above, the Prometheus Parties are not liable for: orders placed, not placed, delayed, duplicated or executed at unfavorable prices; errors in data, calculations or AI outputs; your settings, approvals, overrides or failure to monitor your account; acts or omissions of your broker or any third party; unauthorized access to your account resulting from your credentials or devices; or events beyond our reasonable control.

These limitations are an essential basis of the bargain between you and us, and apply even if a limited remedy fails of its essential purpose. Some jurisdictions do not allow certain exclusions or limitations; in those jurisdictions our liability is limited to the smallest extent permitted by law.

19. Indemnification

You will defend, indemnify and hold harmless the Prometheus Parties from and against all claims, demands, losses, liabilities, damages, judgments, penalties, fines, costs and expenses (including reasonable attorneys’ fees) arising out of or relating to: (a) your use of the Service; (b) orders placed in your accounts; (c) Your Content; (d) your violation of these Terms, your broker’s terms or any law; or (e) any dispute between you and your broker or any third party. We may assume exclusive control of the defense of any matter subject to indemnification, and you will cooperate with us.

20. Non-waivable rights

Nothing in these Terms waives or limits any right or remedy that cannot be waived or limited under applicable law, including any non-waivable rights under federal or state securities laws, and nothing in these Terms limits liability for our fraud or willful misconduct to the extent such limitation is prohibited by law. If any provision is unenforceable as applied to you, it will be enforced to the maximum extent permitted and the remaining provisions will remain in full force.

21. Dispute resolution: binding arbitration and class action waiver

Informal resolution. Before starting any formal proceeding, you agree to contact us at legal@prometheusportfolio.com with a written description of your claim and to try in good faith to resolve it for at least 60 days.

Agreement to arbitrate. Except for the exclusions below, you and we agree that any dispute, claim or controversy arising out of or relating to the Service, these Terms, or the relationship between you and us (including the formation, scope, validity or enforceability of this arbitration agreement) will be resolved exclusively by final and binding individual arbitration administered by the American Arbitration Association (“AAA”) under its Consumer Arbitration Rules then in effect, before a single arbitrator. The Federal Arbitration Act governs this Section. Judgment on the award may be entered in any court of competent jurisdiction.

• Exclusions. Either party may (a) bring an individual claim in small-claims court if it qualifies, and (b) seek injunctive or equitable relief in court to protect intellectual property or prevent unauthorized use of the Service.
• Location and fees. Arbitration will take place in Mecklenburg County, North Carolina, or by video or written submission. Payment of AAA filing and arbitrator fees will be governed by the AAA Consumer Rules.
• CLASS ACTION WAIVER. YOU AND WE EACH AGREE THAT CLAIMS MAY BE BROUGHT ONLY IN AN INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED OR REPRESENTATIVE PROCEEDING, AND THE ARBITRATOR MAY NOT CONSOLIDATE CLAIMS OR AWARD RELIEF TO ANYONE BUT THE INDIVIDUAL PARTY. YOU WAIVE ANY RIGHT TO A JURY TRIAL.
• Mass filings. If 25 or more similar demands are filed by or with the assistance of the same counsel or coordinated group, they will be administered in batches under the AAA’s mass-arbitration procedures, and the parties will cooperate to resolve them efficiently.
• 30-day right to opt out. You may opt out of this arbitration agreement by emailing legal@prometheusportfolio.com within 30 days after you first accept these Terms, with your name, account email and a clear statement that you opt out of arbitration. Opting out does not affect any other part of these Terms.
• Time limit. To the extent permitted by law, any claim must be brought within one (1) year after it arises, or it is permanently barred.
• If the class action waiver is found unenforceable for any claim, that claim will be severed and heard in court, and the rest of this Section will still apply to all other claims.

22. Governing law and venue

These Terms are governed by the laws of the State of North Carolina, without regard to its conflict-of-laws rules, and by applicable federal law. For any claim not subject to arbitration, you and we consent to the exclusive jurisdiction and venue of the state and federal courts located in Mecklenburg County, North Carolina.

23. Changes to these Terms

We may update these Terms from time to time. If we make material changes, we will notify you by email, in the Service, or both, at least 15 days before they take effect, except that changes required by law or to address security or legal risk may take effect immediately. Your continued use of the Service after changes take effect constitutes acceptance. If you do not agree, you must stop using the Service and may cancel your plan. Changes to Section 21 will not apply to any dispute of which we had actual notice before the change.

24. General

• Electronic communications. You consent to receive all agreements, notices, disclosures and other communications from us electronically, by email or in the Service, and agree that they satisfy any legal requirement that they be in writing. You may withdraw consent by closing your account.
• Force majeure. We are not liable for any delay or failure caused by events beyond our reasonable control, including market disruptions, exchange or broker outages, trading halts, internet or power failures, cyberattacks, acts of government, war, terrorism, pandemic or natural disaster.
• Assignment. You may not assign these Terms without our written consent. We may assign them, including in connection with a merger, acquisition or sale of assets.
• Entire agreement; no waiver; severability. These Terms and the documents they incorporate are the entire agreement between you and us about the Service and supersede all prior agreements. Our failure to enforce any provision is not a waiver. If any provision is held unenforceable, the rest remains in effect.
• No third-party beneficiaries, except the Prometheus Parties under Sections 17 to 19.
• Contact. Auro Management LLC, Charlotte, North Carolina. legal@prometheusportfolio.com.

A. Investing involves risk of loss

All investing involves risk, including the possible loss of all money you invest. The value of securities can fall quickly and by large amounts. Diversification and position limits do not ensure a profit or protect against loss. You should only fund your trading account with money you can afford to lose entirely.

B. Automated and algorithmic trading risks

• Orders are placed by software without your review of each order unless you require approval. Software, data and network failures can cause orders to be missed, delayed, duplicated, sized incorrectly, placed in the wrong security or direction, or placed at unfavorable times.
• Rules that seem sensible can behave badly in unusual markets, after large price moves, around earnings or corporate actions, during halts or when data is stale. A rule may sell a position you wanted to keep (for example, when research expires) or buy into a falling price.
• Market and dollar-based orders execute at the prevailing price and may fill far from the last displayed price, especially in volatile, thinly traded or low-priced securities. Fractional-share orders may be subject to additional limitations set by your broker.
• Frequent rebalancing can increase trading costs, taxes (including short-term capital gains and wash-sale consequences) and, under a usage plan, Worker Fees.
• If your designated account permits margin or has pattern-day-trader or settlement restrictions, automated orders may trigger margin calls, restrictions, good-faith violations or forced liquidations under your broker’s rules.

C. Model, sizing and input risks

• Position sizes depend on inputs that are uncertain: your price scenarios and probabilities, your confidence, historical volatility and liquidity. Historical volatility and liquidity do not predict the future. Small changes in inputs can produce large changes in position sizes.
• Default parameters are generic starting points and are not tailored to your finances, goals, tax situation or risk tolerance.
• Concentration and sector limits, where shown, are informational flags unless you configure them otherwise, and do not prevent concentrated or correlated positions.

D. Artificial-intelligence risks

The research assistant may misread documents, invent facts, misstate numbers or reflect bias. It does not know your full financial situation and does not perform due diligence. Never rely on it without checking the underlying sources yourself.

E. Broker, data and third-party risks

• The Service depends on your broker’s systems and agent connection, market-data providers, cloud hosting, payment processing and AI providers. Any of them can fail, change terms, restrict access or shut down, which may stop the Service from reading your account or managing your positions, possibly leaving positions unmanaged.
• Your broker does not supervise third-party agents. Disputes about executions, account restrictions or your assets are between you and your broker.

F. Security and privacy risks

No system is completely secure. Despite our safeguards, unauthorized access to your account, our systems or a third party’s systems could result in unauthorized orders, disclosure of information or loss. Protect your password and your email account, and review your broker activity regularly.

G. Regulatory status

Prometheus provides self-directed software and has not registered with the U.S. Securities and Exchange Commission, FINRA or any state securities regulator as a broker-dealer or investment adviser. You therefore will not receive the protections that may apply to clients of a registered firm, including fiduciary duties, suitability or best-interest obligations, or regulatory examinations of us. Laws and regulatory interpretations concerning software agents and automated trading are evolving and could require us to change, restrict or discontinue the Service.

Prometheus accounts are not bank accounts and are not insured by the FDIC or protected by SIPC. Any SIPC or other protection that applies to your brokerage account is provided through your broker, not us, and does not protect against market losses.

H. Performance information

Simulated, back-tested and paper results have material limitations and do not reflect actual trading. Actual results may differ substantially. Nothing in the Service is a promise or guarantee of any return.

What we collect

• Account information: name, email address, password (stored only as a cryptographic hash by our authentication provider), plan and billing status.
• Brokerage information: with your authorization, account identifiers (stored encrypted), balances, positions, orders and transactions from your broker, and encrypted access tokens. We never receive your broker password.
• Your Content: research, notes, files, theses, scenarios and settings you provide, and the AI outputs generated from them.
• Payment information: processed by Stripe. We do not receive or store full card numbers.
• Usage and device information: log data, IP address, browser and device type, and actions in the Service, including the audit trail of trades, approvals and changes.

How we use it

To provide, secure and support the Service; to calculate position sizes and place orders you authorized; to bill you; to communicate with you about your account and the Service; to detect fraud and abuse; to comply with law; and to improve the Service, including through aggregated or de-identified analysis.

How we share it

We do not sell your personal information and do not share it for cross-context behavioral advertising. We share information only with: your broker, as needed to operate your authorized connection; service providers that process data for us under confidentiality obligations (such as hosting and database providers, Stripe for payments, and Anthropic for AI processing of content you submit); people you choose to share a portfolio with; a successor in a merger, acquisition or asset sale; and authorities when required by law or to protect rights, safety and security.

Security and retention

We use measures such as encryption in transit, AES-256-GCM encryption of brokerage tokens and account numbers at rest, row-level access controls and an append-only, hash-chained audit trail. We keep information for as long as your account is active and afterward as needed for legal, tax, audit, dispute-resolution and security purposes. Audit and trade records may be retained even after you delete a portfolio where required for these purposes.

Your choices and rights

You can update account details in Account, disconnect your broker at any time, and request access to or deletion of your personal information by emailing legal@prometheusportfolio.com. Depending on your state of residence, you may have additional rights, which we will honor as required by law. We may need to verify your identity before acting on a request, and we may retain information as permitted by law.