Effective 2026-08-25

Kiroex Privacy Policy

1. Who We Are

Kiroex ("Kiroex," "we," "us," "our") operates the trading-education and community platform at kiroex.com. Kiroex is a trading name of Kiroex Ltd, a company registered in England and Wales under company number 17274823, with its registered office at 124 City Road, London EC1V 2NX

Kiroex is registered as a data controller with the UK Information Commissioner's Office (ICO), registration number [ICO registration number].

For any question about this policy or how we handle your personal data, contact our data protection contact:

• Email: support@kiroex.com
• Post: 124 City Road, London EC1V 2NX, marked "Data Protection"

Kiroex is an educational platform. We are not a financial adviser, broker, custodian, or fund manager. We do not hold client funds for trading, and nothing in this policy should be read as changing that.

2. Scope of This Policy

This policy explains how we collect, use, share, and protect personal data when you use kiroex.com, our mobile-responsive web app, and related services (the "Platform"). It applies to members, traders/educators, and visitors. It does not cover the practices of independent third parties we link to (such as brokers, prop firms, or payment processors), whose own privacy policies govern their handling of your data.

Our use of cookies and similar technologies is addressed briefly at Section 22 and in full in our separate Cookie Policy.

3. What Data We Collect

3.1 Account and profile data

Name, email address, username, password (hashed), country, profile photo/avatar, bio, social links, and, for traders/educators, community and public profile details.

3.2 Payment and billing data

Billing name, billing address, subscription tier and status, transaction history, and — where you pay by cryptocurrency — public wallet addresses associated with your transactions. We do not store full card numbers or crypto private keys. See Section 6.

3.3 Trading and journal data

Trade history you choose to import manually (CSV/HTML) or via a live MetaApi connection to your own MetaTrader 5 account (positions, entry/exit prices, sizes, P&L, instruments, timestamps), and any notes, tags, or screenshots you add to your trade journal.

3.4 Uploaded content

Avatars, chart screenshots, images and files attached to posts, forum messages, journal entries, or support tickets.

3.5 Communications data

Direct messages between members and traders (end-to-end encrypted client-side — see Section 13), public forum posts and comments, support tickets, and correspondence with us.

3.6 Usage and device data

Log data, IP address, device and browser type, pages viewed, features used, referral source, and analytics events, generally collected via cookies and similar technologies (see our Cookie Policy).

3.7 Referral and affiliate data

Affiliate/referral codes, click identifiers, and attribution data linking a signup or subscription to the affiliate who referred it.

3.8 Event attendance data

If you register for a Kiroex-hosted live session or event directly through the Platform, we collect your registration details and attendance record. This does not include attendees who register solely through a third-party platform such as Eventbrite, where that provider is the controller of the registration data (see Section 11).

3.9 Discord/Telegram data (where a trader opts in)

If a trader connects their community to Discord or Telegram, limited data (such as your Discord/Telegram username, if you choose to link your account for community access) may be shared to enable that integration. See Section 14.

4. Why We Collect It, and Our Lawful Basis

UK GDPR requires us to identify a lawful basis for each purpose. We rely on the following:

| Purpose | Lawful basis | |---|---| | Creating and administering your account, providing subscriptions you've purchased | Contract (necessary to perform our agreement with you) | | Processing payments via Stripe, BoomFi, or NOWPayments | Contract; Legal obligation (for tax/accounting records) | | Operating the trade journal, including AI-generated analysis of your own trades | Contract | | Providing the in-app AI assistant and AI-assisted support responses | Contract; Legitimate interests (improving support efficiency) | | Enabling direct messaging between members and traders | Contract | | Hosting and moderating public and per-community forums | Contract; Legitimate interests (maintaining a safe platform) | | Importing trading history from MT5 via MetaApi, or via manual CSV/HTML upload | Consent (you actively opt in and can disconnect at any time) | | Displaying public profiles, trade setups, and community content | Contract; Legitimate interests (operating a public community platform) | | Operating the marketplace and paying traders via Stripe Connect | Contract | | Fraud prevention, platform security, and abuse monitoring | Legitimate interests; Legal obligation | | Sending service and transactional emails (billing, security alerts, password resets) | Contract; Legal obligation | | Sending marketing communications (product updates, promotions) | Consent (opt-in, see Section 10) | | Affiliate/referral tracking and attribution | Consent (via cookie/tracking consent, see Sections 9 and 22) | | Broker and prop-firm referral link tracking | Legitimate interests / Consent, depending on mechanism (see Section 8) | | Running Kiroex-hosted events and maintaining an attendee record | Contract; Legitimate interests | | Identity verification for regulated payment services (future) | Legal obligation (see Section 17) | | Responding to legal requests, enforcing our Terms | Legal obligation; Legitimate interests |

Where we rely on legitimate interests, we have considered that this is not overridden by your rights and freedoms, and you can object at any time (Section 20).

5. Joint Controllership With Educators

When you purchase a course, subscribe to a trader-led community, or register for an educator-hosted event, both Kiroex and the relevant trader/educator act as controllers of certain data about you. This is a joint controllership arrangement under UK GDPR, and this section sets out its essence in plain English.

• What the educator receives: your name, username, email address (where required for communication), subscription/attendance status, and any content you post within their community or send them directly.
• What the educator may do with it: communicate with you about their course, community, or event; deliver the content or service you've paid for; and — subject to their own obligations under our Educator Terms and applicable law — contact you about related offerings, unless you opt out.
• What the educator may not do: sell your data to third parties, use it for purposes unrelated to their community, or retain it after you unsubscribe beyond what's reasonably necessary for their own records and legal obligations.
• Who to contact:

• For questions about how Kiroex processes your data (platform infrastructure, payments, hosting), contact us using the details in Section 1. - For questions about how a specific educator uses your data within their community, contact that educator directly; their contact details are available on their community page. - If you're unsure, contact us and we will help direct your query.

This arrangement mirrors the data protection terms in our Educator Terms of Service, which educators agree to as a condition of using Kiroex.

6. Payment Data Across Three Payment Rails

We use three payment processors, each handling payment data differently. Kiroex never stores your full card number, card CVV, or crypto private keys.

• Stripe — processes card and direct debit payments for platform subscriptions and marketplace community subscriptions, and powers payouts to traders via Stripe Connect. See [Stripe's Privacy Policy](https://stripe.com/gb/privacy).
• BoomFi — processes certain payments, including stablecoin/crypto payment flows, where offered. See BoomFi's privacy policy on their website.
• NOWPayments — processes cryptocurrency payments where offered. See NOWPayments' privacy policy on their website.

Crypto wallet addresses are personal data. If you pay by cryptocurrency, the wallet address you use is recorded against your transaction. Although a blockchain address is pseudonymous on its own, once it is linked to your Kiroex account it becomes personal data under UK GDPR, and we treat it accordingly — with the same access, retention, and security safeguards as other account data. We do not link your wallet address to your identity beyond what is necessary for payment reconciliation and fraud prevention.

Each processor is an independent controller for the payment data it collects directly from you (e.g., full card details), and a processor for us in respect of the transaction data it returns to us (amount, status, timestamp, partial card/wallet reference).

7. Connected Trading Accounts (MT5, Trade Journal)

If you choose to connect your own MetaTrader 5 account via MetaApi, or to manually import trade history via CSV/HTML, we ingest the trading data you provide: instruments traded, position sizes, entry/exit points, open/close timestamps, and resulting P&L.

• What we ingest: raw trade history as returned by MetaApi or contained in your uploaded file. We do not ingest your MT5 account password beyond what is required by MetaApi to establish a read-only connection, and you can disconnect at any time.
• Whether it's displayed publicly: by default, your trade journal is private to you. If you are a trader/educator, you may choose to make certain performance statistics or verified trade history visible to your subscribers or the public — this is always an opt-in action on your part, and we will clearly indicate what is public before you publish it.
• Verification badges and leaderboards: where we operate verification badges

Cookie Policy

Version v1 · Effective 2026-08-03

Cookie Policy

1. Introduction

This Cookie Policy explains how Kiroex ("Kiroex", "we", "us", "our") uses cookies and similar technologies when you visit or use kiroex.com (the "Platform"). It should be read alongside our Privacy Policy, which explains more generally how we collect and use personal data.

By using the Platform, you may be asked to give or manage your consent to certain categories of cookies through our cookie preferences control. This policy explains what cookies are, the categories we use, why we use them, how long they last, and how you can manage your choices.

2. What Are Cookies?

Cookies are small text files that are placed on your device (computer, tablet, or mobile) when you visit a website. They are widely used to make websites work, work more efficiently, and to provide information to the website owner.

Similar technologies include pixels, tags, local storage, and software development kit (SDK) identifiers used within web and app environments. For simplicity, we refer to all of these collectively as "cookies" in this policy.

Cookies can be:

• Session cookies – temporary cookies that are deleted when you close your browser.
• Persistent cookies – cookies that remain on your device for a set period, or until you delete them.
• First-party cookies – set directly by Kiroex.
• Third-party cookies – set by a domain other than kiroex.com, such as an analytics or advertising provider we work with.

3. Categories of Cookies We Use

We use four categories of cookies on the Platform, consistent with standard consent frameworks.

3.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be switched off. They are usually only set in response to actions you take, such as logging in, setting privacy preferences, or completing a checkout.

Example purposes:

• Keeping you logged in to your Kiroex account securely across pages.
• Enabling secure checkout and subscription payments processed via Stripe.
• Remembering your cookie consent choices.
• Load-balancing and maintaining the security and stability of the Platform.
• Detecting and preventing fraud or abuse (for example, during sign-up or payment).

Because these cookies are necessary to deliver the service you have requested, they do not require your consent, though we still tell you about them here.

3.2 Analytics Cookies

These cookies help us understand how visitors and members use the Platform, so we can improve it. They collect information anonymously or in aggregate wherever possible.

Example purposes:

• Measuring which pages, features, courses, or communities are most used.
• Understanding how users navigate between the trade journal, forums, and live sessions.
• Identifying errors or performance issues.
• Testing and measuring the impact of new features before wider rollout.

3.3 Functional Cookies

These cookies allow the Platform to remember choices you make and provide enhanced, more personalised features.

Example purposes:

• Remembering display preferences, such as theme, language, or timezone settings.
• Remembering which communities, forums, or courses you have recently viewed.
• Supporting embedded live session players and remembering playback settings.
• Enabling optional integrations you choose to set up, such as connecting Discord or Telegram (for traders) or your MetaTrader 5 account via MetaApi.

3.4 Marketing Cookies

These cookies are used to make advertising more relevant to you and to measure the effectiveness of our marketing, including our affiliate/referral programme and broker or prop-firm referral links.

Example purposes:

• Tracking referral and affiliate links so that referral partners or affiliates are correctly credited.
• Measuring the performance of our own marketing campaigns.
• Showing you more relevant adverts for Kiroex on third-party platforms, where applicable.
• Limiting how often you see the same advert.

4. Third-Party Cookies

Some cookies on the Platform are set by third parties who provide services to us or whose content is embedded within the Platform. These third parties may include:

• Payment and marketplace infrastructure – Stripe and Stripe Connect, used to process subscriptions, marketplace payments, and payouts to traders.
• Analytics providers – used to measure usage and performance of the Platform.
• Marketing and affiliate tracking providers – used to attribute referrals and measure marketing performance.
• Embedded content providers – such as video or streaming services used for live trading sessions, or services underlying optional Discord or Telegram broadcasts.
• MetaApi – where you choose to connect your MetaTrader 5 account, MetaApi may set cookies or use similar technologies as part of that connection.

These third parties may set cookies when you interact with their content on our Platform. We do not control third-party cookies directly, and we encourage you to review the relevant third party's own cookie or privacy policy for further information.

We do not control cookies set by AI service providers we use to power certain features (such as the trade journal analysis, in-app assistant, or support responses), as these providers process content rather than set cookies through your browser; details of how such data is handled are set out in our Privacy Policy.

5. How Long Do Cookies Last?

Cookie duration depends on the type and purpose of the cookie:

• Session cookies are deleted automatically when you close your browser.
• Persistent cookies remain on your device for a fixed period, which varies by cookie but is typically between 30 days and 24 months, unless deleted sooner by you.
• Strictly necessary cookies generally last only for your session or, where needed for login persistence, for a limited period (typically up to 30 days).
• Analytics, functional, and marketing cookies typically persist for periods ranging from 30 days up to 24 months, depending on the specific provider and purpose.

Specific expiry periods for individual cookies may be provided in more detail within our cookie preferences control or on request.

6. Managing Your Cookie Preferences

When you first visit the Platform, you will be shown a cookie banner or preference centre allowing you to accept or reject non-essential cookies (analytics, functional, and marketing).

You can change your preferences at any time by:

• Using the "Cookie Preferences" or "Manage Cookies" link, typically available in the website footer.
• Clearing cookies through your browser settings, which will remove existing cookies and reset your preferences on your next visit.

Please note:

• Strictly necessary cookies cannot be disabled through the preference centre, as they are required for the Platform to function.
• If you reject analytics, functional, or marketing cookies, some features may not work as intended (for example, remembered preferences may be lost, or embedded content may not display correctly).
• Withdrawing consent does not affect the lawfulness of any use of cookies before you withdrew consent.

Most web browsers also allow you to control cookies through their settings, including blocking or deleting cookies. Refer to your browser's help section for instructions, as the process varies by browser and device.

7. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, legal requirements, or the way the Platform operates. Where changes are significant, we will take reasonable steps to notify you, such as displaying a notice on the Platform or requesting renewed consent where required.

The "last updated" date at the top of this document (or, where not shown, the version available on kiroex.com) indicates when this policy was last revised.

8. Contact Us

If you have any questions about this Cookie Policy or how we use cookies, please contact us using the contact details provided on the Platform or in our Privacy Policy.