We collect personal information that our users provide to us in a variety of ways through our website and platform services, collectively referred to in this Policy as the "Services". These include the following:

• Login Credentials. You may be granted login credentials to access our Services.
• Communications. If you contact us by email, using the inquiry contact form on the Services or by postal mail, fax, or other means, we collect the personal information contained within, and associated with, your communication.
• Contact Details. With your consent to the extent required by applicable law, we will use your contact details to provide marketing regarding our products and services.
• Professional information. We may collect information, such as your job title and professional contact information.
• Other. Any other information you may provide during the course of using our Services.

We collect personal information uploaded to our platform by X& customers who are paid subscribers of the Services, for processing on their behalf. This is “Customer Data”. With respect to Customer Data, we act as a data processor and process Customer Data on behalf of our customers, who act as the data controller. This information may include information about a customer’s clients, such as name, email address and financial account data, in order to perform wealth management or investor advisory services for those clients via the Services. X& customers may electronically submit Customer Data to the Services or may instruct third parties (including custodians) to do so. X& may process Customer Data except as prohibited by the license agreement between X& and the customer, or as otherwise prohibited by law.

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you choose not to provide that information when requested, we may not be able to provide you with our Services.

When you visit our Services, we may use automatic data collection technologies to collect some information about you, your equipment, your technology providers, and your activities. For example, when you access our Services, we automatically collect your browser's Internet Protocol (IP) address, your browser type, the nature of the device from which you are visiting the Services such as a personal computer or a mobile device, the identifier for any handheld or mobile device that you may be using, the website that you visited immediately prior to accessing any web-based Services, the actions you take on our Services, and the content, features, and activities in which you participate on our Services.

We may collect this information automatically using technologies such as standard server logs, cookies, and web beacons. These and similar technologies are used to manage the Services and to collect information about you and your use of the Services. These technologies help us customize or personalize your experience and analyze the use of our Services to make them more useful to you.

Most internet browsers allow you to remove or manage cookie functions and adjust your privacy and security preferences. For information on how to do this, access the "help" menu on your internet browser, or access http://www.aboutcookies.org/how-to-control-cookies. Please note, however, that disabling our cookies may mean that you will not be able to take full advantage of our Services. For information about our and our third-party partners' use of cookies and related technologies to collect information automatically, and any choices you may have in relation to its collection, please see our Cookie Notice.

Through our Services, we may obtain personal information about your online activities over time and across third-party apps, websites, devices, and other online services. On our Services, we use third-party online analytics services, such as those of Google Analytics. The service providers that administer these analytics services use automated technologies to collect data (such as email addresses, IP addresses, cookies, and other device identifiers) to evaluate, for example, the use of our Services and to diagnose technical issues. To learn more about Google Analytics, please visit https://support.google.com/analytics/answer/6004245 and https://www.google.com/policies/privacy/partners/ To learn more about Mixpanel, please visit https://mixpanel.com/legal/privacy-policy/

We may receive personal information about you from third-parties, including our affiliates, vendors that provide services on our behalf, business partners, social networks (e.g., Linkedin), or publicly available sources (e.g., customer and other third-party websites). We may combine this information with other personal information we maintain about you.

We use personal information about you to perform our contract with you, or to take steps to form a contract with you, such as to:

• provide our Services and information that you may request;
• establish and manage your account with us, and identify and authenticate you so you can access and use our Services.

We may also process your personal information to pursue our legitimate interests in efficiently and securely providing our Services and otherwise managing our business. In doing so, we may process your personal information to:

• communicate with you about the Services or respond to any other inquiries you may have;
• enhance, improve, operate, and maintain our Services, programs, website, apps, and other systems and features (including managing the Services, developing new services and offerings; enhancing and improving our Services; managing our communications; analyzing our Services; performing data analytics; market research; and performing accounting, auditing and other internal functions);
• prevent fraudulent use of our Services and other systems and features;
• prevent or take action against activities that are, or may be, in violation of our Terms of Use, regulatory requirements, industry standards and applicable law;
• tailor content and other aspects of your experience on and in connection with the Services;
• maintain a record of our dealings with you;
• deliver marketing materials to you;
• perform other administrative activities.

In addition, we may use the personal information we obtain when it is necessary to protect, exercise or defend our legal rights, or when we are required to do so to comply with applicable laws or regulations. Lastly, we may use your personal information for other purposes about which we will notify you when we request the information. Where required by applicable law, we will obtain your consent to process your personal information.

We may disclose information to third parties in the following circumstances:

We offer you certain choices in connection with the personal information we collect about you, such as the ability to request access to, or rectification or deletion of, your personal information. Subject to applicable law, you may also have the right to request that we restrict our processing of your personal information, or to object to our processing. You may also have the right to receive the personal information you have provided to us in a structured, commonly used, and machine-readable format, or to request that we transmit this information to another business. Where we rely on your consent for processing of your personal information, you may withdraw such consent. As a reminder, if you withdraw such consent, we may not be able to provide our Services to you.

If you wish to exercise these rights with respect to the personal information we hold about you, you may contact us at privacy@xand.vc.

If you request that we delete your account on any of our Services (via a user settings page, by email, or otherwise) we will do so within a reasonable period of time. However, we may retain some of your personal information to satisfy our legal obligations, such as our records retention obligations, or where we reasonably believe that we have a legitimate business reason to do so, such as for the establishment, exercise, or defense of legal claims.

You can also unsubscribe from our marketing mailing lists by following the “Unsubscribe” link in our emails.

If you are unsatisfied with the way that we process your personal information, you have the right to lodge a complaint with the data protection regulator in your jurisdiction. However, we would appreciate the opportunity to resolve any concerns you may have before doing so by emailing privacy@xand.vc.

All transactions relating to our Services shall be deemed to have occurred in the United States, where we currently have our data residency and maintain operations. Your information collected through the Services may be stored and processed in the United States or any other country in which X& or our subsidiaries, affiliates or service providers maintain facilities. If you are located in the European Union or other regions with laws governing data collection and use that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. If we conduct such transfer of information from the European Union to third parties outside the European Union and to countries not subject to schemes which are considered as providing an adequate data protection standard, we will enter into contracts which are based on the EU Standard Contractual Clauses with these parties.

X& maintains administrative, technical and physical safeguards reasonably designed to protect personal information we obtain through the Services against accidental loss, disclosure, misuse, and destruction.

To the extent required by applicable law, we keep the personal information we obtain about you for the period necessary to fulfill the purposes described in this Policy, taking into account applicable statute of limitations periods and any legal, regulatory, tax, accounting, or other records retention requirements. If necessary, we may retain your personal information for a longer period in the event of a complaint or in reasonable anticipation of potential litigation.

The Services may contain links to and from third-party websites of our business partners, advertisers, and social media sites and our users may post links to third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. We strongly recommend that you read their privacy policies and terms and conditions of use to understand how they collect, use, and share information. We are not responsible for the privacy practices or the content on the websites of third-party sites.

Our Services are not directed to, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of 13. If you are under the age of 13, please do not use our Services or otherwise provide us with any personal information either directly or by other means. If a child under the age of 13 has provided personal information to us, we encourage the child's parent or guardian to contact us to request that we remove the personal information from our systems. If we learn that any personal information we collect has been provided by a child under the age of 13, we will promptly delete that personal information.

Last Updated: February 24, 2025

This California Consumer Privacy Statement (“Statement”) supplements X&’s Privacy Policy. It applies solely to California consumers and addresses personal information we collect online and offline. This Statement does not apply to X& personnel or information collected, processed or disclosed pursuant to the Gramm-Leach-Bliley Act, its implementing regulations or the California Financial Information Privacy Act.

This Statement uses certain terms that have the meanings given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA/CPRA”).

We may use (and may have used during the 12-month period prior to the effective date of this Statement) the categories of personal information listed above for the purposes described elsewhere in X& Privacy Policy and for the following business purposes specified in the CCPA/CPRA.

We do not collect or process sensitive personal information for purposes of inferring characteristics about consumers.

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

2. Retention of Personal Information
We will retain your personal information as described in the “Data Retention” section of the Privacy Policy.

We may update this Policy from time to time. If we make any changes to this Policy, we will change the "Last Updated" date at the top of the Policy and will post the updated Policy on this page. If we make material changes to this Policy, we will notify you by email to your registered email address, by prominent posting on this website or our online services, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise provided.

If you have any questions about this Policy, please contact us at privacy@xand.vc or by writing to us: