Privacy Policy

At Xora, your privacy is fundamental to how we build and operate. This policy explains what data we collect, why, and how we protect it.

1. Information We Collect

When you create an account and use Xora, we may collect the following:

• Account information: name, email address, and authentication credentials (managed via Clerk)
• Financial information: linked bank account details when bank rails are enabled (via Plaid), transaction history, and XRP/TRX deposit and withdrawal records
• Blockchain data: XRP Ledger wallet addresses, TRON addresses, destination tags when required, and on-chain transaction hashes
• AML review information: legal name, date of birth, nationality, country of residence, contact email, passport image or PDF, one EVM address, one XRP Ledger address, public on-chain activity, and cryptographic wallet-ownership proofs
• Device and session data: IP address, approximate location (country, region, city from your IP), browser user-agent, referrer URL, preferred language, and the timestamp of each signup, login, withdrawal, and administrative action on your account. Captured automatically on the events listed above and retained as an audit trail for fraud prevention, account security investigations, and regulatory compliance. We do not use this data for ad targeting.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Xora platform
• Process XRP/TRX deposits, yield calculations, and withdrawals
• Facilitate bank account linking or ACH transfers only when those rails are enabled for the account
• Detect and prevent fraud, unauthorized access, account takeover, and multi-account abuse, including correlating session IP and device-fingerprint data across accounts when suspicious activity is observed
• Communicate important updates about your account or our services
• Conduct identity, wallet-ownership, sanctions, fraud, and anti-money-laundering reviews
• Comply with legal and regulatory obligations (including responding to lawful requests from authorities)

3. Data Storage and Retention

Your data is stored using industry-standard encrypted databases. We retain your personal information for as long as your account is active or as needed to provide you services. Financial records may be retained longer to comply with regulatory requirements.

For the invite-only AML review, draft information is retained for no more than seven days from invitation creation. After submission, the encrypted review record and uploaded passport are retained for seven days from submission to complete the investigation, then scheduled for deletion. A limited deletion record may remain only while an unsuccessful deletion is retried. Public blockchain activity remains visible on its underlying network and is outside Xora's control.

We do not store your bank account login credentials. All banking connections are handled securely through Plaid's tokenized infrastructure.

4. Third-Party Services

Xora integrates with the following third-party services, each with their own privacy practices:

• Clerk: authentication and identity management
• XRP Ledger (XRPL): blockchain transactions are publicly visible on the decentralized ledger
• Tron mainnet: native TRX deposit and withdrawal transactions are publicly visible on Tron explorers such as Tronscan; see the TRX guide
• Plaid: secure bank account verification and linking when bank rails are enabled
• Dwolla: ACH payment processing for fiat transfers when ACH rails are enabled
• Vercel and managed data-store providers: encrypted application records and private passport-file storage for invite-only AML reviews
• Xaman: off-ledger sign-in requests used to prove control of an XRP Ledger wallet without sending a transaction
• EVM and XRP Ledger infrastructure providers: public address activity and account status checks used during AML review

We share only the minimum data necessary for these services to function. We do not sell your personal information to any third party.

5. Cookies and Tracking

Xora uses essential cookies to maintain your session and authentication state. We may use analytics tools to understand aggregate usage patterns. We do not use advertising trackers or sell data to ad networks.

6. Security

We implement multiple layers of security to protect your data, including:

• TLS encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Secure authentication via Clerk with multi-factor support
• Regular security audits and monitoring
• Principle of least privilege for internal access controls

While we take security seriously, no system is completely immune to risk. We encourage you to use strong passwords and enable all available security features on your account.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent for optional data processing
• Export your data in a portable format

To exercise any of these rights, contact us at privacy@xora.finance.

8. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated through the platform or via email. Continued use of Xora after changes constitutes acceptance of the updated policy.

9. Contact

For questions or concerns about this privacy policy or your data, reach us at:

privacy@xora.finance