STX Privacy Policy

Effective: August 21, 2026

This privacy policy (the “Policy”) governs how XV Exchange, LLC and its parent, subsidiaries, or affiliates (including XV Clearing, LLC) (collectively “STX,” “XV Exchange,” “we,” “us,” or “our”), shall collect, use, disclose, transfer, store, retain or otherwise process your information when you access our website, www.stxapp.io, related mobile applications (collectively, the “Site”), when you view or interact with STX social media accounts or any social media accounts or content affiliated with us, when you use STX’s services as a Designated Contract Market (as defined below), and when you otherwise interact with us. The Site, any other features, tools, materials, or other services (including co-branded or affiliated services) offered from time to time by STX are referred to herein as the “Services.” By using our Services, you are agreeing to the terms of this Policy.

For purposes of this Policy, personal information means data that classifies as personal information, personal data, personally identifiable information, or similar terms under applicable data privacy and security laws and regulations. It does not include data excluded or exempted from those laws and regulations, such as aggregated, anonymized, or deidentified data. Nothing in this Policy will constitute an admission or evidence that any particular data privacy or information security law or regulation applies to STX generally or in any specific context.

This Policy expressly incorporates any privacy notices we may issue to supplement this Policy. Depending on your residency, a supplemental privacy notice may apply to you. For example, if you are a California resident, please view our California Privacy Notice below. Additionally, this Policy serves as our “Notice at Collection” under California law.

By continuing to interact with the Services, you confirm that you have read this Privacy Policy and the Terms of Use and are expressly consenting to the collection and use of your information (including personally identifiable information) by us as identified herein, in compliance with this Policy and Terms of Use for the Services. If you do not want us to collect, use, or share your information in the ways described in this Policy, please do not use the Services.

This Policy and the Terms of Use apply regardless of how the Services are accessed and will cover any technologies or devices by which we make the Services available to you. The Services covered under this Policy specifically apply to our business as a Commodity Futures Trading Commission-registered Designated Contract Market (“DCM”). If you use another service offered by STX, a different policy may apply. We may also provide you with additional privacy notices where we believe it is appropriate to do so. It is important that you read this Policy together with any other privacy notice or terms we may provide on specific occasions, so that you are fully aware of how and why we are using your data. This Policy supplements these other notices and is not intended to override them. If you have any questions regarding how we collect information, please contact us under “How to Contact STX” section below..

1. Types of Information We Collect We collect information you voluntarily provide directly to us, automatically when you interact with the Services, and from third parties. The categories of personal information that we collect and the purposes for which we collect that information are described below.

Account Information. If you make an account in relation to your use of the Services, we will collect information related to creating and maintaining your account. This may include your name, email address, postal mailing address, telephone number, date of birth, country of citizenship, country of residence, profile photo, username, and password. We may also collect identity verification information in connection with creating your account such as your Social Security Number, passport information, driver’s license information, other identity documents, and tax-related information. We may further collect certain employment and financial information for analyzing customer suitability, including employment status, estimated annual income, estimated net worth, and investment experience. We collect this information for the purposes of account creation and maintenance, advertising and marketing, analytics and research, customer service, providing the Services, and website security and maintenance.

Other Personal Information. You can visit the Site without submitting any personal information. However, to use certain features on the Site, such as the “Contact Us” feature or apply for a job with us, you will be required to provide personal information. Such information could include, for example, your name, email address, and any information on your job application.

Location Information. This includes information related to your IP address or GPS location. This information may be collected using analytics tools, or when you share location information with us. We collect this information when you allow it to verify your identity, to comply with applicable federal and state law, and to prevent and detect fraud.

Payment and Commercial Information. This includes name, address, phone number, third-party payment service provider-related information, debit or credit card information, purchase and participation history, or other payment processing information. We, or our service providers, collect this information for the purposes of account management, customer service, providing the Services, and website security and maintenance. Responses to Surveys and Questionnaires. This includes information you provide to us when you respond to marketing materials, promotions, contests, or other surveys. We collect this information for the purposes of advertising and marketing, analytics and research, and customer service.

User-Generated Content. If you post, upload, comment, or otherwise submit content on the Services, we may collect certain information about you such as your name and email address and products you may have purchased. Be aware that as a default, any information you post on the Services, including without limitation reviews, comments, and text, may be available to and searchable by all users of the Services. We collect this information for the purposes of advertising and marketing, and analytics and research.

Analytics Information. We collect certain analytics information automatically as you navigate our Services. This includes cookies, tracking pixels, tags or similar tools, which may collect information about your browser, device, geolocation, and interactions with the Services, Site, or emails. The data collected by these analytics tools may include such data as your IP address and domain name, the pages you visit on the Site, the date and time of your visit, the files that you download, the URLs from the websites you visit before and after navigating to the Site, your software and hardware attributes (including device IDs), your general geographic location (e.g., your city, state, or metropolitan region), and certain cookie information (see below). To obtain such information, we may use web logs or applications that recognize your computer and gather information about its online activity.

Cookies and Other Tracking Technologies. Cookies are small files created by websites, including our Services, that reside on your computer’s hard drive and that store information about your use of a particular website. We may send one or more cookies to your computer or other device. We may also use other similar technologies such as tracking pixels, software development kits, tags, or similar tools when you visit our Services. These technologies can collect data regarding your operating system, browser type, device type, screen resolution, IP address, and other technical information, as well as navigation events and session information as you interact with our Services. This information allows us to understand how you use the Services.

2. Why We Collect Information We use the information that we collect for a variety of purposes, including to:

Setting up your Account, verifying your identity, and providing you with the Services.
Completing or processing transactions for you and sending you confirmations and receipts.
Verifying whether you are eligible/permitted to use the Services.
Complying with our legal or regulatory obligations, protecting our legal rights, and addressing existing or anticipated disputes.
Recognizing or identifying you when you return to the Site.
Aggregating and deidentifying information;
Evaluating your interest in and the quality of our products, Services, and customer and
technical support.
Informing you about updates to your account and the Services.
Answering questions and responding to your customer service requests.
Monitoring the usage and performance of the Site and the Services and determining aggregate information and usage patterns.
Making the Site and the Services easier to use, helping diagnose problems with the Site or the Services, or enhancing the Site and the Services for optimal user experience.
Helping us deliver relevant information to you.
Identifying and fixing bugs, providing other technical support, and improving and optimizing the performance of the Site, Applications, and the Services.
Advertising and marketing of the Services (and those of our partners) to you, for example, to present targeted advertisements on the Site and other third-party websites, in email marketing, and in direct mail marketing.
Analyzing the effectiveness of our advertisements and determining whether you would be interested in new features or services we may offer.
Improving our artificial intelligence and machine learning.
Creating new products and Services.
Managing our business.

We may link information gathered through the Site with information that we collect in other contexts. But in that event, we will handle the combined information in a manner consistent with this Policy.

3. How We Share Information We may share any of the information described in “Types of Information We Collect,” above, with the following entities and for the following purposes:

Parties You Share With. When you use the Site or the Services, the personal information you openly provide with others will be shared with parties you allow to receive such information.

Internally Within STX. Your personal information may be accessed by or disclosed to employees of STX who have a need to know such information. Such employees may include members of our sales, marketing, customer support, compliance, engineering, information technology, and human resources teams, depending upon the information they each require in order to perform their job duties and responsibilities.

Service Providers. We use service providers to perform various functions on our behalf, including to verify your identity in relation to the Services. Such service providers will be under contractual obligations to safeguard your personal information and only process it in accordance with our instructions, or as otherwise permitted by applicable laws. We may also receive personal information from service providers. Please note that we may change or add service providers at any time, in our sole discretion. You should review the privacy policies of any websites that you submit your personal information to, and we encourage you to regularly review this Policy to obtain updated information about our service providers.

Business Partners. We may collect personal information from and share personal information with our business partners, including legal advisors and financial advisors, co-branded partners, and leaderboards. We may combine that information with other information we collect about you, but we will always use the information as described in this Policy.

Specifically, we may share your personal information, including your employment history, financial information, and Social Security number, with third-party entities we have partnered with, such as Aristotle, Inc. (“Aristotle”), for purposes of account creation and facilitating transactions in relation to the Services, including CFTC-registered designated contract markets and derivatives clearing organizations, as applicable. In these scenarios, your personal information will also be subject to the privacy policies of Aristotle (available at https://www.aristotle.com/privacy/), as well as any other applicable third-party entity.

So Others Can Market to You. We may share information such as your username, region, first deposit amount, and whether you are an active user with third parties to be used in their marketing efforts. In those instances, your personal information may be used for third parties to serve unsolicited information, services, or products to you.

Analytics. We use a number of service providers, such as Google Analytics, to help analyze how people use the Services (“Analytics Companies”). Analytics Companies use cookies and similar technologies to collect information pertaining to how people use our Site, what pages they visit, and what other sites they may have used prior to using our Services. We use the information we get from Analytics Companies to improve and optimize the Site and the Services.

Interest-based Advertising. The Site also enables third-party tracking mechanisms to collect information about you and your computing devices for use in online interest-based advertising. For example, third parties may use the fact that you visited our Site to target online ads to you. In addition, our third-party advertising networks might use information about your use of our Site to help target advertisements based on your online activity in general. For information about interest-based advertising practices, including privacy and confidentiality, visit the Network Advertising Initiative website or the Digital Advertising Alliance website.

The use of online tracking mechanisms by third parties is subject to those third-parties’ privacy policies, and not this Policy. If you prefer to prevent third parties from setting and accessing cookies on your computer or other device, you may set your browser to block cookies. Additionally, you may remove yourself from the targeted advertising of companies within the Network Advertising Initiative by opting out here, or of companies participating in the Digital Advertising Alliance by opting out here. Our Site does not currently respond to “do not track” browser headers.

Corporate Transaction. Personal information may be disclosed or transferred as part of, or during negotiations of any purchase, sale, lease, merger, amalgamation, or any other type of acquisition, disposal, securitization, or financing involving STX.

Bankruptcy or Insolvency. In the event of bankruptcy, insolvency, or dissolution proceedings, we may share your personal information with third parties as part of the sale or reorganization process.

For Legal Purposes. We reserve the right to cooperate with local, provincial, state, federal and international officials in any investigation requiring either personal information or reports about lawful or unlawful user activity on the Site. We also reserve the right to share your personal information to establish, exercise, or defend our legal and property rights, including providing information to others for the purposes of fraud prevention. We may also share your personal information with any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal information. Please note that we are in a highly regulated industry, and we therefore may need to provide your information to regulators, agencies, or other groups that have applicable oversight. We may also use your information to fulfill our obligations under applicable laws, regulations, or standards, including relating to threat detection and to determine whether we can provide Services to you.

Aggregated, Anonymized or De-identified Data. We may also share aggregated, anonymized, or de-identified information, which cannot reasonably be used to identify you. We will maintain and use such information in deidentified form and not attempt to reidentify the information, except where reidentification is allowed by law for particular purposes. In those situations, we will use the re-identified data in a manner consistent with this policy and applicable law.

Affiliates. We may share your personal information with our affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control).

4. Your Privacy Rights If you want to learn more about the personal information that STX has about you, or you would like to update, change, or delete that information, please contact us by email at [X]. If at any time you would like to unsubscribe from receiving future marketing emails, you can email us at contactus@stxapp.io or follow the instructions at the bottom of each applicable email, and we will promptly remove you from those marketing correspondences that you choose to no longer receive. Please note, however, that we may still need to contact you regarding other matters. If you are a resident of a jurisdiction with an applicable data privacy law, you may have certain rights available to you in relation to your personal information. These rights may include:

The right to access your personal information (including a data portability request);
The right to correct or amend any personal information we have on file about you;
The right to delete your personal information;
The right to limit the use of your “sensitive” personal information;
The right to opt-out of the sale or “sharing” of your personal information;
The right to opt-out of the use of your personal information for targeted advertising purposes;
The right to restrict or opt-out of the use of your personal information for certain automated decision-making (including profiling in furtherance of decisions that produce legal or similarly significant effects);
The right to revoke your consent (to the extent applicable);
The right to confirm whether personal information about you is being processed;
The right to obtain a list of specific third parties (or categories of third parties) to which we have disclosed your personal information or any personal information.

To exercise any of the rights listed above, please contact us via email [X]. We also recognize Global Privacy Control. Your browser must be able to support Global Privacy Control for us to recognize your opt-out preference signal.

We will respond to access, deletion, correction, and portability requests, if applicable, within 45 days of receipt of the request (unless a shorter time period is required by law) and without undue delay. If we need to extend this period, we will notify you of the delay and explain the reasonably necessary justifications for our delay. We will provide responses to your requests free of charge unless certain exclusions apply, depending on the state in which you reside.

Sensitive Data We will process “Sensitive Data” (as the term or its equivalent is defined by applicable privacy laws) in accordance with applicable privacy laws. In some instances, that means we will not collect Sensitive Data without first obtaining your consent or providing you with the right to opt-out of this collection.

If we process Sensitive Data as defined by California law, we will only do so for the purposes specifically authorized by California law and in a manner that is necessary and proportionate for those purposes. As such, we do not perform any processing for which a Right to Limit request is available.

Verification and Authorized Agents If necessary, we may request additional information reasonably necessary to authenticate you and your request. Specifically, we may use your name, email address, and other information associated with your account to verify your identity.

In certain circumstances, you may make a request on behalf of another such as if you are an authorized agent or the parent or guardian of a child on behalf of whom you wish to exercise their rights. To designate an agent, please provide a written and signed document by both you and the agent that authorizes the agent to act on your behalf. You may also use a power of attorney. We will still require you to provide information to allow us to reasonably verify that you are the person about whom we collected personal information.

Appealing Our Decision If we deny or fail to take action on your request to exercise your applicable consumer privacy rights, you may appeal our decision by resubmitting your request. We will inform you in writing within 45 days of any action taken or not taken in response to the appeal (unless a shorter response is required by law). We will also provide a written explanation of the reasons for our decisions regarding your request(s).

Right to Non-discrimination You have the right not to receive discriminatory treatment for exercising the privacy rights conferred by law. We will not discriminate against you because you exercised any of your privacy rights, including, but not limited to, by: denying goods or services to you; charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; providing a different level or quality of goods or services to you; or suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Additional California Disclosures (“California Privacy Notice”) In the preceding 12 months, we have collected personal information from the categories identified in Section 2, which are described using the terms identified under the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et se. as amended by the California Privacy Rights Act and implementing regulations (collectively “CCPA”): identifiers, personal information, protected classification characteristics, commercial information, internet or similar network activity, geolocation data, inferences information, sensitive personal information. Your personal information will not be kept for longer than is necessary for fulfilling the purposes listed in this Policy.

We disclose personal information in the following categories: identifiers, personal information, commercial information, internet or other similar network activity, geolocation data, sensitive information, and inferences with service providers. We may disclose content posted on our social media platforms (e.g., if a consumer “comments” on a story) with other consumers, but the content depends on the individual posts. Such posts may include information in the category of personal information and identifiers, but the content depends on the individual posts. In the preceding 12 months, we have shared for cross-contextual behavioral advertising personal information in the following categories: personal information, identifiers, commercial information, and internet or similar networking activity.

In the preceding 12 months, we have not sold the personal information of any consumer for monetary consideration. However, our use of cookies and other tracking technologies may be considered a sale of personal information under the CCPA. Categories of personal information that we have sold under the CCPA include the following: identifiers, personal information, commercial information, internet or similar network activities, and inferences. Categories of third parties to whom personal information is sold under the CCPA include data analytics providers and advertising and marketing providers. Categories of third parties to whom personal information is sold under the CCPA include data analytics providers and advertising and marketing providers.

In the preceding 12 months, we have not knowingly collected or processed personal information pertaining to children under the age of 16.

5. Data Retention We will retain your personal information until the personal information is no longer necessary to accomplish the purpose for which it was provided. We may retain your personal information for longer periods for specific purposes to the extent that we are obliged to do so in accordance with applicable laws and regulations, to protect you, other people, and us from fraud, abuse, unauthorized access, as necessary to protect our legal rights, or for certain business requirements.

We will delete your personal information when it is no longer necessary for the purpose for which it was collected, or upon your request, subject to exceptions as discussed in this Policy or under applicable law, contract, or regulation. You may also request to delete your information following the instructions in Section 5 of the Policy. 6. How We Secure Personal Information The security of your information is important to us. We use reasonable administrative, technical, and physical procedures, practices, and safeguards designed to protect personal information we collect from unauthorized access, use, alteration, exfiltration, or destruction. Additionally, we will keep your information for only as long as it is needed to achieve its purpose or meet our legal obligations. We make concerted, good faith efforts to maintain the security of your personal information. Although we work hard to ensure the integrity and security of our systems, it must be recognized that no information system is 100% secure and, therefore, we cannot guarantee the security of such information.

Your information may be stored and processed in any country where we or our affiliates have facilities or in which we engage service providers and, by using the Site or Services, you consent to the transfer of information to countries outside of the United States.

8. Third-party Links STX’s Services may contain links to third-party websites. When we provide links, we do so only as a convenience and we are not responsible for any content of any third-party website or any links contained within. It is important to note that this Statement only applies to STX’s Services. We are not responsible and assume no responsibility for any personal information collected, stored, or used by any third-party as a result of you visiting third-party websites. We also advise that you carefully read the privacy notice of any third-party websites you choose to visit.

9. Privacy of Children Services are not intended for or directed to individuals under 18 years of age, and we do not knowingly collect personal information from children under 18. We do not allow account creation for individuals under 18 years of age and implement identity verification processes to exclude individuals under the age of 18. If we discover that we have collected such information, we will promptly delete it, subject to any legal and contractual restrictions. If you have reason to believe that we may have accidentally received personal information from a child or an individual under 18 years of age, please contact us immediately at contactus@stxapp.io.

10. Policy Changes This Policy may change from time to time. If we need to change this Policy at some point in the future, we will post any changes on this page. If we make a significant or material change to this Policy, we will notify you via email or in-app notification. You should check this Policy when you use the Site. Your continued use of the Site constitutes acceptance of the most current version of this Policy. 11. How to Contact STX If you have any questions about this Privacy Policy, please contact us by email at contactus@stxapp.io; by mail at XV Exchange, LLC; 2700 Patriot Blvd Ste. 140; Glenview, IL USA 60026.

Download PDF