Privacy Policy

Last updated: 15 June 2026

Who we are

XAlphaTrack operates this website. For the purposes of UK data protection law (UK-GDPR and the Data Protection Act 2018), XAlphaTrack is the data controller.

Contact: legal@xalphatrack.com

What we collect and why

Account email address

If you create an account, we store your email address to authenticate your sign-in and to manage your subscription status. Legal basis: performance of a contract (your account and any paid subscription).

Payment data

Subscription payments are processed by Stripe. We receive only a Stripe customer ID and subscription status — we never see, transmit, or store your card details. Stripe's own privacy policy governs payment data.

Session cookies

We set strictly necessary cookies to keep you signed in (Supabase authentication tokens). These are essential for the service to function and do not require consent under the Privacy and Electronic Communications Regulations (PECR). No advertising or tracking cookies are set.

Usage analytics

We use Cloudflare Web Analytics, which is cookieless and does not track individuals, set cookies, or collect personal data. No consent is required.

Server and security logs

Our network infrastructure (Cloudflare) processes your IP address and browser user-agent string to route and secure requests. These are not stored by us beyond Cloudflare's standard retention and are used solely to maintain availability and prevent abuse. Legal basis: legitimate interests.

Email sign-ups

If you submit your email to receive updates, we retain it to send you those updates. Legal basis: consent. You may unsubscribe or request deletion at any time.

Who we share data with

We share personal data only with the processors necessary to operate the service:

  • Supabase — database and authentication hosting (EU data centre)
  • Stripe — subscription billing and payment processing
  • Cloudflare — network delivery, security, and cookieless analytics

We do not sell personal data, share it with advertisers, or disclose it to any other third party except where required by law.

Data retention

Account data is retained for as long as your account is active and for a reasonable period thereafter to handle any outstanding billing or legal matters. Email-subscription addresses are deleted on request or when you unsubscribe. Server logs follow Cloudflare's standard retention periods.

Your rights under UK-GDPR

You have the right to:

  • access the personal data we hold about you
  • correct inaccurate or incomplete data
  • erasure of your data ("right to be forgotten")
  • portability of your data in a machine-readable format
  • object to processing based on legitimate interests
  • withdraw consent where processing is based on consent
  • restriction of processing while a dispute is resolved

To exercise any of these rights, email legal@xalphatrack.com. We will respond within one calendar month.

Complaints

If you consider that we have handled your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to registered account holders by email.