Privacy Policy

Last updated: December 19, 2025

XP Interactive, LLC (the "Company", "we", "us", or "our") is dedicated to maintaining your privacy and the protection of your personal data. This Privacy Policy describes the information we collect when you use our website, applications, and services (collectively, "Services"), and our practices with respect to this information.

Information We Collect

We collect two main categories of information about you when you use our Services:

"Personal Information" refers to information that can directly or indirectly identify you as an individual. This includes your name, email address, and account credentials. We collect this information when you create an account or communicate with us.

"Usage Data" encompasses information about how you interact with our Services. This includes your IP address, browser type and version, device information, operating system, internet service provider, access times and duration, pages visited, and other diagnostic data. We collect this information automatically when you access our Services through cookies, web beacons, and similar tracking technologies.

How We Use Your Information

We process the information we collect about you for the following purposes:

• Account Management and Service Operations: We use your information to create and administer your account, process payments, provide customer support and communications, and ensure the proper functioning of our Services.
• Analytics and Service Improvement: We analyze user behavior to enhance our Services, develop new features, and optimize user experience. This analysis is conducted using industry-standard analytics tools, such as Google Analytics.
• Legal Compliance and Risk Management: We process your information to comply with applicable laws, regulations, and legal obligations. We also use your information to detect and prevent fraud, unauthorized access, and other prohibited activities.

If you are located in the European Economic Area (EEA) or United Kingdom (UK), we process your information based on the following legal grounds:

• Contract Performance: Where necessary to create and administer your account and provide you with Services.
• Legitimate Interests: Where necessary for our legitimate interests, including fraud prevention, and security and optimization of our Services, and where these interests are not overridden by your data protection rights.
• Legal Obligation: Where necessary to comply with applicable laws, regulations, or legal requests.
• Consent: Where you have provided consent for specific activities, such as receiving marketing communications. You may withdraw consent at any time.

Information Sharing and Disclosure

We may share your information in the following circumstances:

• With third-party service providers who help us operate, maintain, and enhance our Services, including payment processors, cloud computing providers, analytics services, and customer support services. These service providers are contractually obligated to protect your information and use it only for the specific services they provide to us.
• When required by law, regulation, or legal process, including to respond to court orders, subpoenas, or government requests. We may also share information when we believe disclosure is necessary to protect our rights, investigate fraud, or enforce our Terms of Service.
• In connection with a merger, acquisition, bankruptcy, reorganization, or similar event. Should such a transaction occur, we will make reasonable efforts to notify you of any change in ownership or uses of your personal information.

We do not sell, rent, or lease, or otherwise transfer your personal information to third parties for their marketing purposes. Any third parties who receive your information are prohibited from using it for any purpose other than providing services on our behalf.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services.

Following account termination, suspension, or deletion request, we retain personal data for a period of one (1) year. This retention is necessary for the establishment, exercise, or defense of legal claims pursuant to GDPR Article 17(3)(e), including but not limited to:

• Fraud detection and prevention
• Security and abuse mitigation
• Defense against chargebacks and disputes
• Enforcement of our Terms of Service
• Compliance with legal obligations

After this retention period, your personal data will be anonymized. Specifically, we remove personally identifiable information including your name, email address, and IP address from our records. We retain anonymized, non-personally identifiable data such as aggregated completion records and timestamps for the purposes of maintaining database integrity, generating aggregate analytics, and improving our services. This anonymized data cannot be used to identify you.

Security

We implement reasonable administrative, technical, and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

International Data Transfers

The Company and its service providers may use servers and other resources located in various jurisdictions to transfer, store, and process your personal data. By using our Services, you acknowledge and consent that your personal information may be transferred to and processed in countries that may have different data protection rules than your country of residence.

For transfers of personal data to countries outside the European Economic Area (EEA), we implement appropriate safeguards and mechanisms to ensure adequate protection of your personal information. These safeguards include entering into Standard Contractual Clauses approved by the European Commission with our service providers and partners.

Your Rights

Depending on where you live, you may have certain statutory rights in relation to your personal data. For example, you may have the right to:

• Access your personal data and request details about how we process it.
• Request correction of inaccurate personal data.
• Request deletion of your personal data, subject to certain exceptions.
• Restrict how we process your personal data.
• Transfer your personal data to a third party (right to data portability).
• Object to how we process your personal data based on legitimate interests.
• Withdraw consent at any time where processing of personal data is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, please submit your request using the contact information provided in the last section of this Privacy Policy. We will respond to all legitimate requests within thirty (30) days. We may need to verify your identity before processing your request.

There may be situations where we cannot fully grant your request, including:

• Where doing so would undermine our legitimate use of data for fraud prevention and security purposes.
• Where the request involves an account under investigation for fraud or Terms of Service violations.
• Where we are legally obligated to retain the information.
• Where the request is unreasonably repetitive and vexatious, requires disproportionate technical effort, jeopardizes the privacy of others, is extremely impractical, or for which access is not otherwise required by local law.

Children's Privacy

We are in compliance with the Children's Online Privacy Protection Act (COPPA). Our Services are not directed to, or intended for, children under 16 years of age. We do not knowingly collect any personal information from children under 16. If you are under 16, you should not use our Services or provide any information about yourself.

If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

Changes to Our Privacy Policy

We reserve the right to change, update, or modify this Privacy Policy at any time. Any changes will be effective immediately upon posting the updated Privacy Policy on this page with a new "last updated" date. For material changes that significantly affect how we use your personal information, we will make reasonable efforts to notify you, such as by posting a prominent notice via our Services or sending an email to the email address associated with your account.

Your continued use of our Services after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

Contacting Us

If you have any questions, concerns, or requests related to your personal information or this Privacy Policy, please contact us at [email protected].