Privacy Policy

• Account data — name, email address, and password (stored hashed, never in plain text).
• Billing data — PromptPay and bank transfer references, USDT transaction details you submit for verification, and subscription billing metadata needed to activate your plan. We do not store bank login credentials, private wallet keys, or full payment account numbers.
• Usage data — log-in activity, dashboard interactions, and risk-monitoring alert history needed to operate the Service.
• Communications — messages you send to support, and waitlist sign-up emails.

We use this information to provide and secure the Service, process payments, send service-related communications (such as account or billing notices), and respond to support requests. We do not sell your personal information.

We share information only with service providers who help us operate the platform — our cloud infrastructure provider for hosting, our email provider for transactional mail, and Telegram where you choose to connect it for alerts and support — and only to the extent necessary for them to perform that function. PromptPay, bank transfer, and USDT payments are reconciled by us. We do not share your data with Prop Firms unless you direct us to as part of using the Service.

We use essential cookies (such as a session/authentication cookie) required for the dashboard and login to function. If analytics tracking is enabled, it is used in aggregate to understand product usage and is not used to sell your data. See our Cookie Policy for the full list of cookies we use and how to manage them.

We retain account and billing data for as long as your account is active and as needed to comply with legal, tax, and accounting obligations. You may request deletion of your account data as described below.

We apply reasonable technical and organizational measures — including password hashing, encrypted transport (HTTPS/TLS), and access controls — to protect your information. No system is completely secure, and we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the right to access, correct, or request deletion of your personal data, or to object to certain processing. To exercise these rights, contact us at privacy@xpfirm.com.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from minors.

Under the Thailand Personal Data Protection Act B.E. 2562 (2019), data subjects have the right to access, port, or request erasure of their personal data. XpFirm provides self-service data export via the account management API (/api/accounts/export-data) and manual request processing via privacy@xpfirm.com.

We may update this Policy from time to time. Material changes will be reflected by updating the date above.

Questions about this Policy can be sent to privacy@xpfirm.com.