Privacy policy

Scope

XP PLUS is based in the United States, and the Services are intended primarily for users located in the United States. If you access or use the Services from outside the United States, you understand that your personal information may be collected, processed, stored, and transferred in the United States and other jurisdictions where we or our service providers operate, subject to United States law.

This Privacy Policy applies to personal information that we collect through the services, when you create or use an XP PLUS account, when you communicate with us, including through support requests, email, forms, surveys, or social media, when you subscribe to communications, participate in promotions, or otherwise interact with us, and to personal information that we collect from service providers, business partners, or other sources as described in this Privacy Policy.

This Privacy Policy does not apply to information processed by our business customers or other third parties that independently determine the purposes and means of processing, or information about our employees, contractors, or job applicants, which is governed by separate notices where required.

The Services may contain links to third-party websites, applications, integrations, or services. Your interactions with third-party services are governed by their own terms and privacy notices. This Privacy Policy does not apply to information processed by third parties under their own privacy policies.

Personal Information Collected

The personal information we collect depends on how you interact with the Services, the features you use, and the choices you make.

When you access or use the Services, we or our service providers may automatically collect information about your device and use of the Services, including:

• Device, browser, operating system, and application information;
• Internet Protocol address and general location derived from that address;
• Log data, such as access dates and times, pages or features accessed, referring and exit pages, error logs, and activity within the Services;
• Online identifiers, such as cookie identifiers, device identifiers, or similar identifiers;
• Information about interactions with our emails or other communications, where permitted by law; and
• Analytics and diagnostic information used to operate, secure, improve, and understand the Services.

We may collect the following categories of personal information when you provide them to us:

• Identifiers and contact information, such as your name, email address, phone number, mailing address, or similar contact details;
• Account information, such as account credentials, authentication information, and account settings;
• Communications, such as the contents of messages, support requests, feedback, survey responses, and other communications you share with us;
• User content, such as information, files, images, or other materials that you upload or otherwise make available through the Services;
• Transaction and payment information, such as billing address, transaction history, and payment-related information;
• Any other information you choose to provide to us.

We may receive personal information from third parties, including:

• Authentication or identity-verification providers;
• Payment processors;
• Analytics, hosting, security, and communications providers;
• Business partners or referral sources;
• Publicly available sources; and
• Other users, where they provide your information in connection with the Services.

Use of Personal Information

We may use personal information for the following purposes:

• To provide, maintain, and improve the Services;
• To create and manage accounts and authenticate users;
• To process transactions, payments, refunds, and related customer-service requests;
• To communicate with you about the Services, including service notices, security notices, transactional messages, and support communications;
• To respond to inquiries, requests, feedback, or complaints;
• To personalize the Services and remember your preferences;
• To monitor, analyze, troubleshoot, and improve the performance, functionality, security, and user experience of the Services;
• To detect, investigate, prevent, and address fraud, security incidents, abuse, unlawful activity, or violations of our Terms of Use;
• To comply with legal obligations and protect our legal interests;
• To conduct internal business operations, including accounting, recordkeeping, and corporate governance;
• To send marketing communications where permitted by law and consistent with your preferences; and
• For other purposes disclosed to you at the time of collection or with your consent.

We may combine personal information collected through the Services with information received from other sources, subject to applicable law.

Disclosure of Personal Information

We may disclose personal information as follows:

• To vendors and service providers that perform services for us, such as hosting, data storage, payment processing, customer support, analytics, security, communications, professional services, and IT support, only as necessary to provide services to us, or as otherwise permitted by law and contract;
• To affiliates, subsidiaries, or other entities under common control, where appropriate for the purposes described in this Privacy Policy;
• To other businesses, in connection with a proposed or actual merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or other corporate transaction;
• To governmental agencies when we reasonably believe disclosure is necessary to comply with law, legal process, governmental requests, or regulatory requirements, or to protect the rights of XP PLUS, or users, or others;

XP PLUS may also disclose personal information with your consent, or if such personal information has been de-identified or aggregated so that it is not reasonably capable of identifying you, subject to applicable law.

XP PLUS does not sell your personal information for monetary consideration. XP PLUS does not share personal information for cross-context behavioral advertising. If our practices change, we will update this Privacy Policy and, where required, provide any additional notice or obtain consent.

Cookies and Similar Technologies

We and our service providers may use cookies, pixels, software development kits, local storage, and similar technologies to operate the Services, remember preferences, understand usage, maintain security, and improve functionality.

The categories of technologies we may use include:

• Strictly necessary technologies which are needed to provide core functionality, maintain security, authenticate users, and remember essential preferences;
• Functional technologies which help us remember nonessential preferences and improve usability;
• Analytics technologies which help us understand how users access and interact with the Services; and
• Advertising technologies which may be used if XP PLUS engages in advertising activities requiring their use.

You may be able to manage certain technologies through your browser or device settings. If you disable certain technologies, some portions of the Services may not function properly.

We honor applicable browser-based opt-out preference signals, including Global Privacy Control signals, where required by applicable law and where technically capable of recognizing the signal.

Your Rights

Depending on your state of residence and subject to applicable law, you may have certain rights regarding your personal information, e.g., request that we

• Confirm whether we process your personal information;
• Provide access to personal information we process about you;
• Correct inaccurate personal information;
• Delete personal information, subject to legal and operational exceptions;
• Provide a portable copy of certain personal information;
• Do not sale your personal information, use it for targeted advertising, or certain profiling activities; and
• Reassess decisions concerning your prior privacy requests, where applicable law provides a right to appeal.

XP PLUS voluntarily makes reasonable efforts to honor verified requests concerning access, correction, and deletion of personal information, even where a comprehensive state privacy law may not require us to do so. This voluntary practice does not expand rights beyond those required by applicable law.

To submit a request, contact us at support@xp.plus. Please include your name, relevant contact information, the nature of your request, and sufficient information for us to respond to your request. You may designate an authorized agent to make a request on your behalf where permitted by law. We may request information reasonably necessary to verify your identity and authority to make the request. We will use verification information provided by you in response only for verification and related security purposes.

We will respond to your requests within the period required by applicable law. Where no legally prescribed response period applies, we aim to respond within 45 days after receiving a verifiable request. If more time is reasonably necessary, we will notify you where required.

If we deny a request in whole or in part, we will explain the basis for that decision to the extent required by applicable law. To appeal a decision, provided a right to appeal exists under applicable law, contact us at support@xp.plus with the subject line “Privacy Request Appeal.” We will review and respond to an appeal within the time period required by applicable law.

Marketing Communications

You may opt out of promotional email communications by using the unsubscribe link in the message or contacting us at support@xp.plus.

Opting out of promotional communications will not prevent us from sending non-promotional communications, including account notices, transaction confirmations, security alerts, and responses to your requests.

Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to provide the Services, ensure account access, maintain business and financial records, resolve disputes, enforce agreements, comply with legal obligations, and protect our rights and interests.

The specific retention period depends on factors such as the nature and sensitivity of the information, the reason we collected and use the information, whether we need the information to provide a requested feature, applicable legal or regulatory retention obligations, the risk of harm from unauthorized use or disclosure, and whether the personal information can be securely deleted, anonymized, or de-identified.

When personal information is no longer needed, we will delete, anonymize, de-identify, or otherwise dispose of it in accordance with applicable law and internal practices and policies.

Security

Our Services use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. However, we cannot guarantee absolute security, as no system is completely secure.

You are responsible for protecting your account credentials and for promptly notifying us of any suspected unauthorized access.

Children’s Privacy

The Services are not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13 years of age without verifiable parental consent.

If you believe that a child under 13 years of age has provided personal information to us without appropriate parental consent, please contact us at support@xp.plus. We will take appropriate steps to delete the information.

Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, technology, or applicable law. We will post the updated version through the Services and revise the “Last Updated” date above.

If changes are material, we will provide additional notice or seek consent where required by applicable law. Your continued use of the Services after an updated Privacy Policy becomes effective is subject to the updated Privacy Policy, to the extent permitted by applicable law.