Back

Privacy Policy

Effective May 21, 2026

Xchange Alpha LLC ("Xchange Alpha", "we", "us", or "our") respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have over it.

This policy applies to xchangealpha.com, to our trading platform and its related applications, and to the other websites and services we operate that link to it. Together we refer to these as the "Services".

Not every part of this policy applies to every person who reads it. Browsing our public website involves far less information than opening and funding a trading account. Where a practice applies only to a particular activity — opening an account, completing identity verification, placing an order — we say so.

This policy does not cover information handled by third parties operating their own services, even where we link to them. Those organisations have their own privacy policies, and we encourage you to read them.

Information you give us

We collect information you provide directly. What we ask for depends on what you are doing:

  • Contact and marketing details — your email address if you ask to be notified about our launch or subscribe to updates.
  • Account registration details — your name, email address, postal address, date of birth, and telephone number when you open an account.
  • Identity verification information — government-issued identification, a taxpayer or national identification number, and any supporting documents we are required to obtain to verify who you are. We collect this to meet our legal obligations, not for marketing.
  • Financial and funding information — bank or payment account details, funding and withdrawal instructions, and the information needed to assess eligibility for the products you wish to trade.
  • Trading activity — the orders you place, positions you hold, and transactions we execute or settle for you.
  • Communications — the contents of messages you send us, including support requests, and records of our correspondence with you.
  • Preferences — settings you choose, such as whether you prefer the light or dark appearance of our site.

Information we collect automatically

When you visit or use the Services, some information is collected automatically by your browser or device:

  • Device and connection information — your IP address, browser type and version, operating system, device type, language, and time zone.
  • Usage information — the pages and screens you view, the links you select, the dates and times of your visits, and the site or source that referred you to us.
  • Performance information — aggregated measurements of how quickly pages load and render, which we use to find and fix performance problems.
  • Cookies and similar technologies — small files and browser storage used to keep you signed in, remember your preferences, and understand how the Services are used. See Cookies, analytics, and similar technologies below.

Some of this information is stored only in your own browser and never sent to us. Your light or dark appearance preference, for example, is saved locally on your device.

Information we receive from others

We also receive information about you from third parties, including:

  • Identity verification, sanctions screening, and fraud prevention providers, who confirm the information you give us and flag risks we are required to check for.
  • Payment providers and financial institutions, which confirm account ownership and the status of transfers.
  • Market data and statistics providers, which supply the underlying data our products reference. This data concerns athletes and events, not you.
  • Analytics and infrastructure providers acting on our behalf, as described below.

We use personal information to:

  • Provide, operate, and maintain the Services, including opening and administering your account.
  • Verify your identity and screen for eligibility, sanctions, and financial crime risk, as required of us by law and regulation.
  • Accept, route, execute, clear, and settle your orders and transactions, and keep accurate records of them.
  • Monitor trading for market abuse, manipulation, and other conduct we are obliged to surveil and report.
  • Detect, investigate, and prevent fraud, unauthorised access, and other security incidents.
  • Respond to your questions and provide customer support.
  • Understand how the Services are used so we can improve their reliability, usability, and performance.
  • Send you service and administrative messages, such as security alerts, changes to terms, and information about your account.
  • Send you marketing communications about our products, where you have asked for them or we are otherwise permitted to. You can opt out at any time.
  • Comply with our legal, regulatory, tax, reporting, and recordkeeping obligations, and respond to lawful requests from regulators, courts, and law enforcement.
  • Establish, exercise, or defend legal claims.

We do not use the contents of your identity verification documents, your financial account details, or your trading activity to target advertising to you.

If you are in the European Economic Area, the United Kingdom, or Switzerland, data protection law requires us to have a legal basis for each use of your personal information. We rely on the following:

  • Performance of a contract — to open your account, execute your instructions, and provide the Services you have asked for.
  • Compliance with a legal obligation — to verify your identity, screen for financial crime, keep required records, and make required reports.
  • Legitimate interests — to secure the Services, prevent fraud and abuse, improve our products, and communicate with you about them, where doing so does not override your rights.
  • Consent — for optional marketing communications and for any non-essential cookies, where consent is required. You may withdraw consent at any time, without affecting processing already carried out.
  • Establishing, exercising, or defending legal claims.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We disclose personal information in these circumstances:

  • Service providers — companies that host our infrastructure, verify identities, process payments, deliver email, monitor security, and provide analytics on our behalf. They may use the information only to perform services for us, under contract, and not for their own purposes.
  • Regulators and self-regulatory organisations — where we are required or permitted to report to, or respond to, the authorities that oversee our activities.
  • Law enforcement, courts, and other legal process — where we are compelled to disclose information, or where disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Professional advisers — our auditors, lawyers, accountants, and insurers, where they need the information to advise us.
  • Corporate transactions — a party to a merger, acquisition, financing, or sale of assets, in which case we will require the information to remain protected under terms consistent with this policy.
  • Affiliates — companies within our corporate group, for the purposes described in this policy.
  • At your direction — anyone you ask us to share information with, or where you have otherwise consented.

We may also publish or share information that has been aggregated or de-identified so that it can no longer reasonably be linked to you.

We use cookies and comparable browser storage for a small number of purposes:

  • Strictly necessary — to keep you signed in, secure your session, and protect against fraudulent requests. The Services will not work correctly without these.
  • Preferences — to remember choices you make, such as your light or dark appearance setting. This is stored in your browser.
  • Analytics and performance — to count visits and measure how quickly pages load, so we can find and fix problems. We use privacy-oriented analytics that measure traffic in aggregate and do not build advertising profiles about you.

We do not use advertising or cross-site tracking cookies. Most browsers let you block or delete cookies and clear local storage through their settings; blocking strictly necessary cookies will prevent parts of the Services from functioning. Where the law requires your consent before we set non-essential storage, we will ask for it.

Some browsers send a "Do Not Track" or Global Privacy Control signal. We honour Global Privacy Control signals where they are legally recognised as an opt-out.

We keep personal information for as long as we need it for the purposes described in this policy, and then for as long as we are required to keep it.

Our retention periods are driven mainly by the recordkeeping obligations that apply to regulated financial activity. Records of accounts, identity verification, orders, transactions, and communications relating to them must be retained for the minimum periods set by applicable law and regulation, which in most cases extend for years after an account is closed. We cannot delete these records earlier, even at your request, though we can restrict how they are used.

Information we hold for optional purposes is kept for shorter periods. If you ask us to stop contacting you, we keep only the minimum needed to honour that request. Analytics data is retained in aggregate form.

When information is no longer needed for any of these purposes, we delete it or de-identify it so that it can no longer be linked to you.

We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, and unauthorised access, disclosure, or alteration. These include encryption of data in transit, restricting access to those who need it for their role, authentication controls, logging and monitoring, and regular review of our security practices. Where a public Trust Center is available for your environment, we publish information about our security and compliance programme there.

No system is completely secure, and we cannot guarantee absolute security. Please protect your own account by using a strong, unique password, keeping your credentials confidential, and telling us promptly if you believe your account has been compromised.

We are based in the United States, and the Services are operated from the United States. If you access the Services from elsewhere, your information will be transferred to, stored in, and processed in the United States and in other countries where we or our service providers operate. Data protection laws in those countries may differ from those in your own.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards recognised under applicable law, such as the European Commission’s standard contractual clauses together with any additional measures required. You may contact us for more information about the safeguards we use.

Choices available to everyone

  • Marketing — you can opt out of marketing emails at any time by contacting us, or by using the unsubscribe link in any message that carries one. We will still send you the messages we need to send about your account.
  • Account information — if you hold an account, you can review and update much of your information directly in the Services.
  • Cookies and browser storage — you can manage these through your browser settings, as described above.

Access, correction, and deletion

Subject to the law that applies to you, you may ask us to give you a copy of the personal information we hold about you, correct it if it is inaccurate, delete it, restrict or object to how we use it, or provide it in a portable format. Where processing is based on your consent, you may withdraw that consent.

These rights have limits. We may be unable to delete or stop processing information we are legally required to retain — records of your identity verification, orders, and transactions are the most common example — and we may need to keep information to establish or defend legal claims. If we cannot act on a request, we will explain why.

California residents

If you are a California resident, you have the right to know what personal information we collect, use, and disclose about you and to receive a copy of it; to correct inaccurate personal information; to delete personal information, subject to exceptions including our legal recordkeeping obligations; to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. As stated above, we do not sell personal information or share it for cross-context behavioral advertising, and we use sensitive personal information only for the purposes permitted without a separate right to limit — chiefly verifying your identity and meeting our legal obligations.

We will not discriminate against you for exercising these rights. You may use an authorised agent to submit a request on your behalf, in which case we will need to verify both your identity and the agent’s authority.

European Economic Area, United Kingdom, and Switzerland

In addition to the rights described above, you have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concerns first, so please consider contacting us before doing so.

How to make a request

Write to us at contact@xchangealpha.com, or by post at the address in Contact us below. Tell us what you would like us to do. We will need to verify your identity before we act, and we will respond within the time the applicable law allows. There is no charge for making a request.

The Services are intended for adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. Trading accounts are available only to individuals who are of legal age in their jurisdiction and who meet our eligibility requirements.

If you believe a child has given us personal information, contact us at contact@xchangealpha.com and we will delete it.

The Services link to websites and resources operated by others, such as the sites of our service providers. We do not control those organisations, and this policy does not apply to them. Review their privacy policies before giving them your information.

We update this policy as our Services and our legal obligations change. When we do, we revise the effective date at the top of the page and post the new version here.

If a change materially affects how we use information we already hold about you, we will give you notice — by email or through the Services — before it takes effect, and obtain your consent where the law requires it. Please check back from time to time.

If you have questions about this policy, want to exercise a privacy right, or wish to make a complaint about how we handle personal information, please get in touch:

  • Email: contact@xchangealpha.com
  • Post: Xchange Alpha LLC, 6929 Hayden Road, C4-467, Scottsdale, AZ 85250, United States

We take privacy complaints seriously and will acknowledge yours promptly.