Xlane ("we", "us") operates the peer-to-peer currency matching platform at xlane.app and the Xlane mobile applications. For the purposes of the UK GDPR, the EU GDPR, and other applicable data protection laws, Xlane is the data controller of the personal data described in this policy.
You can contact us about privacy at privacy@xlane.app.
Account data: name, email address, phone number, password (stored only as a cryptographic hash), and authentication identifiers such as your Google account ID when you sign in with Google.
Identity verification data: government-issued ID documents, selfies or liveness checks, and proof of address, collected to meet KYC and anti-fraud obligations.
Location data: approximate location, used to match you with nearby users and agents. Your exact location is never shown to other users.
Transaction data: requests you post, matches, deal status, ratings, and related communications on the platform.
Technical data: device type, IP address, app version, and usage logs needed to operate, secure, and debug the Service.
To create and secure your account, verify your identity, match you with counterparties, operate trades and ratings, provide customer support, send service and security notifications, prevent fraud and abuse, comply with legal obligations, and improve the Service.
We do not use your identity documents or precise location for advertising, and we do not sell your personal data.
Contract: processing needed to provide the Service you signed up for (account, matching, trade coordination).
Legal obligation: identity verification and record-keeping required by anti-money-laundering and fraud-prevention laws.
Legitimate interests: platform security, fraud detection, analytics, and product improvement, balanced against your rights.
Consent: where required (for example, precise location access on your device), which you can withdraw at any time in your device settings.
Service providers that process data on our behalf under contract: cloud hosting (Google Cloud), email delivery, SMS/OTP delivery, and identity verification tooling.
Other users, only to the extent needed to complete a trade — for example your first name, rating, and approximate area. Your documents, contact details, and exact location are never shared with other users.
Authorities or third parties where required by law, court order, or to protect the rights and safety of users and the public.
Some of our service providers process data outside the UK/EEA. Where this happens we rely on adequacy regulations or standard contractual clauses to protect your data.
We keep account and verification data for as long as your account is active and for the period afterwards required by law (typically up to 5 years for KYC/AML records). Technical logs are retained for a shorter period. When data is no longer needed it is deleted or anonymised.
We use encryption in transit and at rest, access controls, and least-privilege practices to protect your data. No system is perfectly secure; if a breach affects your rights we will notify you and the regulator as required by law.
You have the right to access, correct, delete, or export your personal data; to restrict or object to processing; and to withdraw consent where processing is based on it. You can exercise these rights from your account settings or by emailing privacy@xlane.app.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local data protection authority.
We use strictly necessary cookies and storage for authentication and security, and privacy-respecting analytics to understand how the Service is used. You can control cookies through your browser settings.
The Service is not directed at anyone under 18, and we do not knowingly collect data from minors.
We may update this policy from time to time and will post the new version here. Questions or requests: privacy@xlane.app.
Last updated: September 2026.