Privacy Policy

XUACO Limited ("XUACO", "we", "us", "our") is the data controller responsible for your personal information. We operate the XUACO platform at xuaco.com, an automated forex arbitrage investment platform.

This Privacy Policy applies to all personal data we collect when you visit our website, create an account, use our services, or communicate with us.

We collect the following categories of personal data:

Category	Examples	When Collected
Identity Data	Full name, username, date of birth	Account registration
Contact Data	Email address, phone number (optional)	Account registration
Financial Data	USDT wallet addresses, deposit amounts, withdrawal history, transaction records	When making deposits or withdrawals
Technical Data	IP address, browser type, device information, login timestamps	Automatically on platform use
Usage Data	Pages visited, features used, session duration	Automatically on platform use
Communications Data	Support messages, feedback, survey responses	When you contact us
Referral Data	Referral codes used, affiliate network structure	When using the affiliate program

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data.

We use your personal data for the following purposes:

• Account management: To create, maintain, and secure your account
• Service delivery: To process deposits, calculate and credit profits, and process withdrawals
• Affiliate program: To track referrals and calculate commission payments
• Communications: To send transaction confirmations, profit notifications, and important platform updates
• Security: To detect fraud, unauthorised access, and other suspicious activity
• Legal compliance: To comply with applicable laws and regulations including anti-money laundering (AML) requirements
• Platform improvement: To analyse usage patterns and improve the platform experience
• Support: To respond to your questions and resolve issues

We will only use your data for the purposes listed above. We will not use your data for automated decision-making that produces legal or similarly significant effects without your consent.

We process your personal data on the following legal bases:

• Contract performance: Processing necessary to deliver the services you have signed up for
• Legal obligation: Processing required to comply with applicable laws (e.g. AML, record-keeping requirements)
• Legitimate interests: Processing for fraud prevention, security, and platform improvement, where these interests are not overridden by your rights
• Consent: Processing for optional communications such as promotional emails, which you may withdraw at any time

We do not sell your personal data. We may share your data with the following categories of recipients only where necessary:

• Service providers: Companies that help us operate the platform (email delivery, hosting, analytics) under strict data processing agreements
• Legal authorities: Where required by law, court order, or regulatory requirement
• Fraud prevention: With security services to detect and prevent fraudulent activity
• Business transfers: In the event of a merger, acquisition, or sale of XUACO's business assets, your data may be transferred as part of that transaction with prior notice to you

All third-party service providers are contractually required to handle your data securely and only for the specific purposes we define. They may not use your data for their own marketing or commercial purposes.

We retain your personal data only for as long as necessary for the purposes it was collected, or as required by law:

• Account data: Retained for the duration of your account and up to 7 years after account closure for legal and compliance purposes
• Transaction records: Retained for a minimum of 7 years as required by financial regulations
• Technical and usage data: Retained for up to 2 years
• Support communications: Retained for up to 3 years

When data is no longer needed, we securely delete or anonymise it.

We take the security of your personal data seriously and implement appropriate technical and organisational measures including:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Two-Factor Authentication: Available and recommended for all user accounts
• Access controls: Strict internal controls limiting who can access personal data
• Regular security audits: Ongoing monitoring and testing of our systems
• Secure password storage: Passwords are hashed and never stored in plain text

While we take every reasonable precaution, no system is completely secure. In the event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

We use cookies and similar tracking technologies to improve your experience on the Platform. We use the following types of cookies:

• Essential cookies: Required for the platform to function — session management, security tokens. These cannot be disabled.
• Analytics cookies: Help us understand how users interact with the platform so we can improve it. These are anonymised where possible.
• Preference cookies: Remember your settings and preferences across sessions.

We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect your ability to use the platform.

Depending on your location, you may have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data where there is no compelling legal reason to retain it
• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for optional processing at any time

Note that some rights may be limited where we are required to retain data for legal or regulatory reasons (e.g. transaction records).

XUACO is registered in Australia and primarily processes data within Australia. Some of our service providers may be located in other countries. Where we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by relevant data protection authorities
• Transfers to countries with equivalent data protection laws
• Contractual obligations on recipients to protect your data to our standards

The XUACO platform is strictly intended for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.

If we discover that we have inadvertently collected data from a minor, we will promptly delete that data and close the associated account. If you believe a minor has registered on our platform, please contact us immediately at privacy@xuaco.com.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send a notification to your registered email address
• Post a prominent notice on the Platform for at least 14 days

We encourage you to review this policy periodically. Your continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

We take all privacy enquiries seriously and aim to respond within 5 business days. For urgent matters, please also reach out via our official Telegram support channel.