Privacy Policy & GDPR Notice

Xvest was developed under XVEST LTD (Company No. ), a UK private limited company incorporated in England.

The Xvest platform (xvest.tech) acts as the Data Controller under applicable data protection legislation, including the European Union General Data Protection Regulation (EU GDPR). Official Companies House details are available at the Companies House record.

Xvest is strictly intended for users who are at least 18 years of age (or the age of legal majority in their jurisdiction). We do not knowingly collect or process personal data from individuals under 18. If we become aware that a user under the age of 18 has created an account or provided personal information, we will take immediate steps to terminate the account and erase the associated data.

We adhere to strict data minimization principles, collecting only the information strictly necessary to provide personalized financial intelligence, conversational analytics, and signal processing:

• Authentication & Profile Data (via Google OAuth): Google User ID, primary email address, full name, and profile picture URL. Essential OAuth tokens required for identity verification and continuous secure session management.
• Conversational & Contextual Interaction Data: User chat inputs, prompts, conversation history, and system responses. Generated market signals, custom watchlist parameters, and user-defined financial preferences saved to deliver a personalized experience.
• Technical & Infrastructure Metadata: IP address and coarse geographic region derived from IP (used for security, latency routing, and regional compliance). System diagnostics, browser specifications, operating system details, and interaction timestamps.
• Notification Preferences: User configuration settings regarding alerts, market news updates, and push/email notifications, which can be enabled or disabled at any time via account settings.

Xvest utilizes a layered intelligence architecture combining proprietary prediction models and third-party Large Language Model (LLM) routing engines:

• Proprietary Market Models & MCP Engines: Our proprietary prediction models evaluate quantitative market data, order book dynamics, and technical indicators via Model Context Protocol (MCP) interfaces. These models run on our dedicated infrastructure and process anonymized financial data.
• LLM Orchestration via OpenRouter: Conversational AI capabilities are routed through OpenRouter, leveraging upstream LLM providers, including Google Gemini and OpenAI.
• Data Privacy in AI Processing: Prompts sent to external LLM providers contain the contextual data necessary for natural language reasoning. Personal user identifiers (such as Google account IDs) are stripped or anonymized prior to routing through AI models. Upstream AI providers process data strictly as data processors and are prohibited from using your personal chat inputs to train public foundational models.

• Essential Session Storage: We use essential cookies and browser Local Storage strictly necessary for maintaining your authentication state, security tokens, and user preferences (e.g., UI theme).
• Anonymized Analytics (Google Analytics): We use Google Analytics to measure aggregate platform metrics, feature usage, and traffic performance. All analytics data is collected using IP anonymization and aggregated privacy techniques. We do not correlate Google Analytics data with your Google OAuth identity or private chat history.

If you reside in the European Economic Area (EEA), the United Kingdom, or applicable jurisdictions, we process your personal data under the following legal grounds:

1. Performance of a Contract: Providing access to the Xvest conversational interface, market signal engine, user history synchronization, and personalized financial analytics.
2. Legitimate Interests: Securing our platform against abuse, monitoring system performance, debugging backend faults, and optimizing user experience.
3. Consent: User-initiated authentication via Google OAuth and optional notification settings (e.g., market alerts and news updates).

Your data is stored and processed on secure servers located primarily within the European Union (Germany) to ensure strict adherence to EU data protection laws:

• Primary Database & Hosting Infrastructure: Dedicated self-hosted databases and compute infrastructure hosted on Hetzner Online GmbH (Germany).
• Current & Future Third-Party Infrastructure Processors: To ensure platform availability, error tracking, and scaling, Xvest utilizes (or reserves the right to utilize) the following cloud and data infrastructure service providers:
  • Google Cloud Platform (GCP) & Amazon Web Services (AWS): For cloud compute, object storage, and global infrastructure routing.
  • Sentry: For operational error logging, real-time bug tracking, and performance diagnostics.
  • Neon DB: For cloud-native serverless PostgreSQL database operations.
  • OpenRouter / Google / OpenAI: For large language model inference and conversational AI processing.
  • Google Analytics: For anonymized user interface analytics and usage statistics.

We do not sell, rent, or trade your personal data to third parties under any circumstances.

• Free Tier Service: Xvest offers access to its core conversational intelligence and basic market signal features free of charge.
• Cryptocurrency Payments: For premium tiers or future Pro features, payments may be processed via non-custodial cryptocurrency gateways or digital voucher providers.
• Strict Non-Refundable Policy: Because Xvest grants immediate access to real-time computational models, proprietary signals, and server infrastructure upon activation, all payments made to Xvest are non-refundable. No full, partial, or prorated refunds will be issued once payment is completed. See our Refund Policy and Terms of Service.
• Service Availability: The platform is provided on an “as-is” and “as-available” basis. Technical interruptions or infrastructure updates do not entitle users to monetary refunds.

• Retention Period: We retain your account data and chat history for as long as your account remains active or as required to maintain service continuity.
• User Rights: Under GDPR and international privacy frameworks, you hold the following rights:
  • Right to Access: Request a copy of the personal data stored in your account.
  • Right to Rectification: Request correction of inaccurate account data.
  • Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your Google account association, chat history, and stored preferences.
  • Right to Restrict Processing: Request restrictions on how your data is processed.
• Exercising Your Rights: To request account deletion or data exports, please submit an official request to our legal team. Email legal@xvest.tech to request deletion.

Xvest is an AI-native market intelligence and research platform. Xvest does not provide regulated financial advice, investment advisory services, or legal counsel. Market predictions, model outputs, and conversational responses are generated for informational and analytical purposes only. Users bear sole responsibility for their trading decisions and financial risk management.

For privacy inquiries, GDPR data requests, or legal notices, please contact:

• Legal & Privacy Team: legal@xvest.tech
• Official Documentation Repository: github.com/xvest-sbs/xvest-legal-docs