Privacy Policy

• Account data — name, email address, and password (stored hashed, never in plain text).
• Billing data — card and wallet payments are handled by our merchant of record, Lemon Squeezy, which is the seller of record for those transactions and processes your payment details directly. Bank transfers and cryptocurrency transfers are verified manually by us. We never store full card numbers, bank credentials, or wallet keys.
• Usage data — log-in activity, dashboard interactions, and risk-monitoring alert history needed to operate the Service.
• Communications — messages you send to support, and waitlist sign-up emails.

We use this information to provide and secure the Service, process payments, send service-related communications (such as account or billing notices), and respond to support requests. We do not sell your personal information.

We share information only with service providers who help us operate the platform — Lemon Squeezy as our merchant of record for card and wallet billing, our cloud infrastructure provider for hosting, our email provider for transactional mail, and Telegram where you choose to connect it for alerts and support — and only to the extent necessary for them to perform that function. Bank and cryptocurrency transfers are reconciled by us, not by a third party. We do not share your data with Prop Firms unless you direct us to as part of using the Service.

We use essential cookies (such as a session/authentication cookie) required for the dashboard and login to function. If analytics tracking is enabled, it is used in aggregate to understand product usage and is not used to sell your data. See our Cookie Policy for the full list of cookies we use and how to manage them.

We retain account and billing data for as long as your account is active and as needed to comply with legal, tax, and accounting obligations. You may request deletion of your account data as described below.

We apply reasonable technical and organizational measures — including password hashing, encrypted transport (HTTPS/TLS), and access controls — to protect your information. No system is completely secure, and we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the right to access, correct, or request deletion of your personal data, or to object to certain processing. To exercise these rights, contact us at privacy@xpfirm.com.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from minors.

We may update this Policy from time to time. Material changes will be reflected by updating the date above.

Questions about this Policy can be sent to privacy@xpfirm.com.