Privacy Policy Last updated: 24/02/2026

We, referred to as “We,” “Us,” or “Our,” are committed to protecting your Personal Data and respecting your privacy.

This Privacy Policy explains how we collect, manage, store, and use the information you provide in connection with the website Xonata-AI (the “Website”).

We are guided by the following principles:

•To ensure transparency in the collection and processing of your Personal Data:

We strive to ensure you are fully informed so you can make considered decisions regarding the use of your Personal Data when using our Website or when being connected with third-party trading service providers. To achieve this, we use structured policies and communication practices to explain how your data is processed and ensure such information is delivered clearly and in a timely manner.

Where specific notices are required, we will provide them in the appropriate context and at the relevant time.

If you have questions or require clarification, you may contact us at: [email protected].

•To process your Personal Data exclusively for the purposes described in this Policy:

We may process your Personal Data for purposes including making the Website available to you, connecting you with third-party trading platforms (the “Services”), improving user experience, enhancing platform functionality, protecting our legal rights and interests, conducting operational and administrative activities, and complying with applicable legal and regulatory obligations, including those relevant in Singapore.

We may also process certain information to better understand user preferences and optimize the performance of our services.

•To allocate appropriate resources to uphold your rights regarding your Personal Data:

We take reasonable steps to enable you to exercise your rights as a data subject. Subject to applicable law, you may request access to your Personal Data, correction, deletion, restriction of processing, or data portability. We will respond in accordance with relevant data protection legislation.

•To safeguard Personal Data about you:

While no system can guarantee absolute security, we implement technical, administrative, and organizational safeguards designed to protect your Personal Data against unauthorized access, misuse, or disclosure.

Comprehensive Privacy Policy

1. Scope

This Policy outlines the categories of Personal Data we collect, how it is obtained, how it is used, shared with third parties, protected, and otherwise processed.

“Personal Data” refers to any information relating to an identified or identifiable individual. An identifiable individual is one who can be identified directly or indirectly, including by reference to additional data we possess or may reasonably access.

“Processing” means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure, or destruction.

Our Services are intended for individuals aged 18 and above. We do not knowingly collect Personal Data from persons under 18. If we become aware that such data has been collected, we will take reasonable steps to delete it.

2. When Do We Collect Personal Data?

We collect Personal Data when you use the Services, interact with our communication channels, or visit the Website. In some cases, you provide the data directly (for example, through registration forms). In other cases, we collect data automatically through your interaction with the Website or receive information from authorized third-party partners.

3. No Obligation to Provide Personal Data and Possible Implications

You are not legally required to provide Personal Data. However, in certain situations, failure to provide requested information may prevent us from offering access to the Services, may limit Website functionality, or may restrict our ability to connect you with relevant third-party providers.

4. Categories of Personal Data Collected When You Visit the Website:

This information may include online activity records, traffic data (such as IP address, date and time of access, pages visited, language preferences, crash reports, and browser type), as well as details about the device used to access the Website. Certain elements of this information may not directly identify you and therefore may not qualify as Personal Data.

Personal Data received directly from you: Any Personal Data you voluntarily provide when interacting with us or when being connected to third-party trading service providers through our Website.

Personal Data submitted for transfer to third-party platforms for trading purposes: This may include your full name, telephone number, and email address.

5. Purposes for Processing Personal Data and Legal Bases

Xonata-AI processes your Personal Data for one or more of the purposes described below, each supported by an appropriate legal basis under applicable data protection laws.

Xonata-AI will only process Personal Data where a lawful basis applies. Such legal bases may include:

Your consent for one or more specific purposes, for example, when you voluntarily submit your information via the Website for connection with a third-party trading provider.
Processing necessary for legitimate interests pursued by Xonata-AI or a third party, such as improving services, preventing misuse, or defending legal claims.
Processing required to comply with a legal or regulatory obligation.

For further clarification regarding how our legitimate interests apply to the processing of your Personal Data, you may contact us at: [email protected] .

Below is an overview of the primary processing purposes and their corresponding legal justifications:

	Purpose	Legal Basis
1	To transfer your details to third parties at your request in order to facilitate digital asset and trading activities. We may collect and forward your Personal Data when you explicitly request connection with a third-party service provider.	Your consent for the processing of your Personal Data for one or more specified purposes.
2	To respond to your inquiries, requests, or concerns Processing is necessary to provide assistance and respond to communications relating to your use of our Services.	Legitimate interests pursued by the Company or a third party.
3	To comply with legal obligations or official directives We process Personal Data to meet applicable legal, regulatory, or administrative requirements.	Compliance with a legal obligation.
4	To improve and optimize our Services This may include analyzing system performance, technical errors, crash reports, and usage patterns.	Legitimate interests pursued by the Company or a third party.
5	To prevent fraud, abuse, or misuse of the Services	Legitimate interests pursued by the Company or a third party.
6	To conduct operational and business activities that support service delivery Including internal administration, strategic planning, oversight, and business development.	Legitimate interests pursued by the Company or a third party.
7	To perform analytical and statistical evaluations We may apply analytical methods to enhance decision making and improve platform functionality.	Legitimate interests pursued by the Company or a third party.
8	To protect our rights, interests, and assets, or those of third parties Including the establishment, exercise, or defense of legal claims and enforcement of our terms and policies.	Legitimate interests pursued by the Company or a third party.

6. Transfer of Personal Data to Third Parties

Xonata-AI may disclose your Personal Data to trusted third-party service providers that support our operations, including hosting services, cloud storage providers, analytics platforms, IP address processing services, user experience analysis tools, and other technical or diagnostic partners.

Where you expressly request to be connected with a third-party trading platform, we may transmit the Personal Data you submit for that purpose. In such cases, the respective third parties will process your Personal Data in accordance with their own privacy policies. We may collaborate with multiple third-party trading providers.

Xonata-AI may also share your Personal Data with affiliated entities and strategic partners who assist in improving and expanding the services and resources available to users.

We may disclose Personal Data to governmental, regulatory, or supervisory authorities where required by applicable law, or where necessary to protect our rights, interests, or assets, as well as those of third parties, including in connection with the establishment, exercise, or defense of legal claims.

Additionally, Personal Data may be disclosed to prospective investors, purchasers, or lenders of Xonata-AI, or in connection with a merger, acquisition, restructuring, asset sale, consolidation, or insolvency proceeding involving our business or affiliated entities.

7. Cookies and Third-Party Services

We may use third-party services, such as analytics providers or advertising partners, on our Website. These third parties may utilize cookies or similar tracking technologies. Their data practices are governed by their respective privacy policies.

A cookie is a small text file stored on your device when you access the Website. Cookies enable the collection of information about your browsing activity to enhance user experience, remember preferences, and support analytics and performance measurement.

Session cookies are temporary and remain active only while your browser is open. Persistent cookies remain on your device until they expire or are manually deleted, allowing the Website to recognize returning users.

Types of Cookies:

We may use the following categories of cookies:

Type of Cookie	Purpose	Additional Information
Strictly Necessary Cookies	These cookies are essential for enabling navigation of the Website and access to requested features. They ensure proper delivery of content and services. Without these cookies, certain functions of the Website may not operate correctly.	May include session identifiers and login-related information. Typically removed once the browser session ends.
Functionality Cookies	These cookies allow the Website to remember your preferences and settings when you return.	May remain stored on your device until their predefined expiration date.
Performance Cookies	These cookies collect aggregated statistical data about Website usage to improve performance and user experience.	Data collected is generally anonymized and does not directly identify individual users. Some are session-based, while others may persist for a defined period.

Blocking and Removing Cookies

You may configure your browser settings to block or delete some or all cookies. Instructions for managing cookies are typically available in the settings section of commonly used browsers, including:

Mozilla Firefox
Microsoft Edge
Google Chrome
Safari

Please note that disabling cookies may affect certain features and functionality of the Website.

ONLINE TRACKING NOTICE

At this time, this Website does not respond to “Do Not Track” (DNT) signals.

8. Retention of Personal Data

Xonata-AI retains Personal Data only for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable laws and regulatory obligations.

Where your details are shared with third-party trading service providers at your request, such sharing may occur for up to 12 months and may be extended subject to your consent and applicable legal requirements.

We periodically review stored data to ensure that Personal Data is not retained longer than necessary.

9. Transfers of Personal Data to Other Jurisdictions or International Organizations

Your Personal Data may be transferred to and processed in jurisdictions outside your country of residence. In such cases, Xonata-AI implements appropriate safeguards to ensure adequate data protection standards and enforceable rights.

Where applicable under European data protection laws, transfers may rely on adequacy decisions, binding agreements between authorities, or standard contractual clauses approved by competent regulatory bodies.

For further information regarding safeguards applied to cross-border transfers, you may contact us at: [email protected] .

10. Protection of Your Personal Data

We implement appropriate technical and organizational measures to maintain a high level of security for Personal Data, considering the risks associated with processing, including accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

While we take reasonable steps to protect Personal Data, no method of transmission over the internet or electronic storage is entirely secure. We disclaim liability for indirect, incidental, or consequential damages arising from unauthorized access or events beyond our reasonable control.

In certain circumstances, legal obligations may require us to disclose Personal Data to public authorities or other entities. In such cases, our control over how those parties protect your data may be limited.

Transmission of information over the internet cannot be fully guaranteed as secure. Accordingly, Xonata-AI cannot guarantee the absolute security of data transmitted online.

11. Links to Third-Party Websites

The Website may contain links to third-party websites or applications. Xonata-AI does not control these external platforms or their data processing practices and assumes no responsibility for their privacy policies or activities.

We recommend reviewing the privacy policies of any third-party websites or applications before providing Personal Data.

12. Your Rights Regarding Your Personal Data

Subject to applicable law, you may have the right to request confirmation of whether we process Personal Data about you, access such data, request correction of inaccuracies, request deletion where appropriate, restrict processing, or object to certain types of processing.

If you are located in the European Economic Area (EEA), please review the following section:

You have the following rights regarding your Personal Data. To exercise any of these rights, you may submit a request by contacting us at: [email protected].

Right of Access

You have the right to obtain confirmation from Xonata-AI as to whether your Personal Data is being processed and, if so, to access that Personal Data together with the following information:

The purposes of the processing;
The categories of Personal Data concerned;
The recipients or categories of recipients to whom the Personal Data has been or will be disclosed, in particular recipients in third countries or international organizations;
Where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
The existence of the right to request rectification or erasure of Personal Data, restriction of processing, or to object to such processing;
The right to lodge a complaint with a supervisory authority;
Where the Personal Data is not collected directly from you, any available information as to its source;
The existence of automated decision-making, including profiling, where applicable;
Where Personal Data is transferred outside the EEA, information about the appropriate safeguards relating to the transfer.

Xonata-AI will provide a copy of the Personal Data undergoing processing. Additional copies may be subject to a reasonable administrative fee. If the request is submitted electronically, the information will be provided in a commonly used electronic format, unless otherwise requested.

The right to obtain a copy must not adversely affect the rights and freedoms of others. Where such rights are impacted, we may limit or refuse the request, in accordance with applicable law.

Right to Rectification

You have the right to request correction of inaccurate Personal Data concerning you. Taking into account the purposes of processing, you also have the right to have incomplete Personal Data completed.

Right to Erasure ("Right to be Forgotten")

You may request erasure of your Personal Data where one of the following grounds applies:

The Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed;
You withdraw your consent and there is no other legal basis for the processing;
You object to the processing based on legitimate interests and there are no overriding legitimate grounds;
You object to processing for direct marketing purposes;
The Personal Data has been unlawfully processed;
Erasure is required to comply with a legal obligation under applicable EU or Member State law.

This right does not apply where processing is necessary to comply with a legal obligation or for the establishment, exercise, or defense of legal claims.

Right to Restrict Processing

You have the right to request restriction of processing where:

You contest the accuracy of the Personal Data, for a period enabling us to verify it;
The processing is unlawful and you oppose erasure and request restriction instead;
We no longer need the data for processing purposes, but you require it for legal claims;
You have objected to processing based on legitimate interests, pending verification of overriding grounds.

Where processing is restricted, such data will, with the exception of storage, only be processed with your consent or for legal claims, protection of another person’s rights, or important public interest reasons.

Right to Data Portability

You have the right to receive Personal Data you have provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where processing is based on your consent or a contract and carried out by automated means.

Where technically feasible, you may request direct transfer of your data to another organization. This right does not affect the rights and freedoms of others.

Right to Withdraw Consent

You may withdraw your consent to the processing of your Personal Data at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Right to Object

You have the right to object at any time to processing of your Personal Data based on legitimate interests, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or for legal claims.

You also have the right to object at any time to the processing of your Personal Data for direct marketing purposes, including profiling related to such marketing.

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority in a Member State of the European Union if you believe that the processing of your Personal Data infringes applicable data protection laws.

Your rights concerning your Personal Data, as described in this Section 13, may be subject to limitations under applicable European Union or Member State law to which the Company is subject.

We will respond to your request without undue delay and, in any event, within one (1) month of receipt. This period may be extended by an additional two (2) months where necessary, taking into account the complexity and number of requests. If an extension is required, we will inform you within one month of receiving your request and explain the reasons for the delay.

Information provided in response to your request under this Section 13 will generally be free of charge. However, if a request is manifestly unfounded or excessive, particularly due to its repetitive nature, we may either:

Charge a reasonable fee reflecting the administrative costs of providing the information or taking the requested action; or
Refuse to act on the request.

Xonata-AI may request additional information necessary to verify your identity before processing your request, particularly where there are reasonable doubts concerning the identity of the person making the request.

14. Updates to This Policy

We reserve the right to update or amend this Privacy Policy from time to time. When changes are made, the revised version will be published on the Website with an updated “Last updated” date.

In the event of material changes, we may provide additional notice through means reasonably designed to inform you, such as a prominent notice on the Website. Unless otherwise stated, changes will become effective upon publication of the updated Privacy Policy on the Website.