Privacy Policy

01Who is responsible for your data

Visionerse Ltd, trading as XSR Trading Community, is responsible for your personal data (the "data user" under Hong Kong's Personal Data (Privacy) Ordinance, and the collecting non-government agency under Taiwan's Personal Data Protection Act). You can reach us about anything in this policy at contact@xsrtrade.com — please put "Privacy" in the subject line.

02What we collect

We do not ask for sensitive data such as health, religion or political views, and we ask you not to put it in the journal or in messages to us. We do not collect Discord data: joining our Discord is between you and Discord.

03How we use it, and why

We use your profile answers to tailor your dashboard and the course suggestions you see. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, apart from automatic security measures such as ending a session after repeated capture detections, which you can ask us to review.

Direct marketing. The only emails we send are service messages, such as sign-in verification codes. We do not use your personal data for direct marketing, and we will not start without first asking for your consent.

04XSR AI and Google Gemini

XSR AI features are optional. When you use them, we send the following to Google's Gemini API, which processes it on our behalf to produce a response:

• what you type or upload in that request (including up to 4 screenshots, or the statement or screenshot you ask it to read), and the earlier messages in that conversation;
• the context the answer needs: today's date and your time zone, and short labels from your own data such as your prop-firm account names, firms, sizes and statuses, your strategy names and the symbols you trade.

We do not send your password, payment details or broker credentials. We keep the result of a statement or screenshot extraction with your journal import so you can check it. We do not use your content to train AI models, and XSR AI never gives trading advice.

05Who we share it with

We do not sell your personal data or share it with anyone for their own marketing. We share it only as follows.

Service providers who process it for us, under contracts that restrict them to our instructions:

Services you connect. If you connect a broker or platform (for example Tradovate, TopstepX, Alpaca or Interactive Brokers), we send the credentials you gave us to that provider to fetch your data, at your direction.

Referrers. If you signed up through someone's referral link, that person can see that a referred account was created and, if you buy a programme, the date, the programme and a masked version of your email (for example a•••@gmail.com). They never see your full email, name or anything else about you.

Others, only when necessary: professional advisers; the police, regulators or courts when the law requires it or to protect rights and safety; and a buyer or successor if our business is transferred, who must then protect your data as described here.

06Public certificate verification

Each XSR Academy certificate has a verification code. Anyone who has the code can open its verification page and see the holder's name, the course, the issue and expiry dates, the score, grade, hours and skills, and whether it was revoked (with the date and a short reason). That is what makes a certificate checkable by someone you choose to show it to.

We only publish a certificate page once a certificate is issued, and only people with the code can find it. If you do not want your certificate to be publicly verifiable, email us and we will withdraw its public page.

07Where your data is processed

We are based in Hong Kong, and our service providers operate data centres in other countries, which can include the United States, Singapore and member states of the European Union. When your data is transferred outside Hong Kong or Taiwan, we use providers that are contractually bound to protect it to a standard comparable with this policy, and we transfer only what is needed for the purpose.

08Cookies and local storage

We use a small number of cookies, all set by us and needed for the site to work or to remember a choice you made. We do not use advertising or analytics cookies, tracking pixels or third-party trackers.

The first time you visit, a cookie notice asks whether you allow optional cookies, such as analytics. None are set unless you say yes, and you can change your answer at any time from Cookie settings in the site footer.

Your browser's local storage also keeps some things on your device only — your language, lesson notes, where you stopped a video, playback speed, drafts, recent commands and similar preferences. They are not sent to us. You can clear them, and block or delete cookies, in your browser settings; if you block the session cookie, you will not be able to sign in.

09How long we keep it

Records we must keep after an account is closed are kept separately and used only for the reason we keep them.

10How we protect it

• All connections to the site use HTTPS encryption.
• Passwords are stored as salted one-way hashes (scrypt); verification codes are stored only as hashes.
• Broker credentials and referral payout details are encrypted in the database (AES-256-GCM).
• Session and video logs store a keyed hash of your IP address instead of the address itself.
• Access to personal data is limited to the people who need it to run the Services, and administrative actions are logged.

No system is completely secure. If a breach affects your personal data in a way that creates a real risk to you, we will tell you and the relevant authorities as the law requires.

11Your rights

Depending on where you live, you have the right to:

• ask whether we hold data about you, and get a copy of it;
• correct data that is wrong or incomplete (most of it you can edit yourself in your account);
• ask us to delete your data, or to stop collecting, processing or using it;
• receive your data in a portable format — the journal can already be exported as CSV, JSON or Markdown;
• object to processing based on our legitimate interests, and withdraw any consent you gave;
• complain to a data protection authority — for example the Office of the Privacy Commissioner for Personal Data in Hong Kong, or the competent authority in Taiwan.

To use any of these rights, email contact@xsrtrade.com from your account's email address. We may need to confirm your identity. We answer access requests within 15 days and other requests within 30 days, and tell you if we need more time as the law allows. Requests are free of charge.

Closing your account. Email us to close your account and delete its data. Deletion is permanent: your journal, progress and certificates cannot be recovered, and access to any programme you bought ends. Export anything you want to keep first.

12Notice for users in Taiwan

Under Article 8 of Taiwan's Personal Data Protection Act:

• Collector: Visionerse Ltd (XSR Trading Community).
• Purposes: contract and customer management (069, 090), e-commerce (148), information and communication services (135), education and training administration (109), statistics and research on our own services (157), and other business within our registered scope (181).
• Categories: identification data (C001), financial identification data (C002, for payments and payouts), personal descriptions (C011), and learning, transaction and service records (C093, C132) — as detailed in What we collect.
• Period, area, recipients and methods: for the periods in How long we keep it; in Hong Kong and the countries where our providers operate; by us and the providers listed in Who we share it with; by automated and manual means.
• Your rights under Article 3: to inquire into and review, obtain copies of, supplement or correct your data, and to ask us to stop collecting, processing or using it, or to delete it.
• If you do not provide data: you can browse the site without an account, but without an email address we cannot create one, and without payment details we cannot complete a purchase.

13Notice for users in Hong Kong

This policy is our Personal Information Collection Statement under the Personal Data (Privacy) Ordinance. Providing your data is voluntary, but we cannot create an account or complete a purchase without the data marked as required. Your data may be transferred to the classes of persons in Who we share it with for the purposes in How we use it. You may request access to and correction of your data by writing to our Data Protection Officer at contact@xsrtrade.com.

14Children

The Services are for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has created an account, tell us and we will delete it.

15Changes to this policy

We will update this policy when what we do changes. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you by email or in the Services before it takes effect and, where the law requires, ask for your consent.