Privacy policy

Account details you give us (name, email, password — stored only as a cryptographic hash), your trading activity on Xterminal, payment references from our payment provider, and your payout wallet address.

For identity verification we hold the details you declare — your legal name, date of birth, country of residence, document type and the last four characters of the document number — together with the decision and who made it.

The verification document itself is reviewed by a person from the email you send it to and is deleted once the check is complete. It is never uploaded through the verification page, which is why that page has no upload box.

There is one exception, and it exists because a withdrawal cannot be undone. When you ask to withdraw, we email you a code and then ask for a photograph of you holding your identity document. That photograph is stored on our own servers, is never published, and is readable only by the staff who decide payouts — every time one of them opens it, who opened it and when is recorded. It is deleted on a schedule after the withdrawal is decided; the record that it was checked, by whom, outlives the image. We ask for it on every withdrawal rather than once, because an account is taken over at some point in its life and a check that only runs at the beginning is one an attacker waits out.

We also record the network address and browser description of each sign-in attempt, successful or not. This is kept for 90 days and then deleted automatically.

To operate your account and evaluate it against the trading rules, to send payouts, to meet anti-money-laundering obligations, and to keep the platform secure. We do not sell personal data.

Sign-in records are used for two things: to stop someone guessing their way into your account, and to detect one person running several evaluations at once. That second one matters to you as well as to us — a firm that funds results won by running ten accounts is a firm that eventually cannot pay the people who earned it honestly. Nothing is decided about an account by that check alone; a person reviews it.

Our payment provider and our hosting provider, each only with the data needed to perform that function. Identity verification is carried out by our own staff rather than a third party, so your identity details are not shared for that purpose. We disclose data to authorities only where legally required.

Account and transaction records are kept for as long as anti-money-laundering law requires after your last activity. You may request deletion of anything held beyond that period.

You can request a copy of your data, ask us to correct it, or ask us to delete it where we are not required to keep it. Email [email protected] and we will answer within 30 days.

We set a session cookie to keep you signed in. It is required for the dashboard to work and is not used for advertising or cross-site tracking.