Privacy Policy.

01

Our Commitment to Privacy

Your privacy is important to XS. This Privacy Policy (this "Policy") describes how XS ("we," "us," or "our") collects, uses, shares, and protects information in connection with:

• the XS website and platform at https://xs.global (the "Site");
• XS Origination, XS Portfolio, XS Reporting, and the other features of the XS platform available under your subscription;
• our operating professionals program, where included in your plan; and
• our marketing communications, events, and other interactions with you.

We refer to all of these together as the "Services." By using the Services, you agree to the collection, use, and sharing of information as described in this Policy. If you are located in the European Economic Area, the United Kingdom, or Switzerland, our GDPR Privacy Policy applies to you instead of this Policy.

A note about Customer Data. Information that you or your organization enter into or upload to the Services, such as contacts, deal notes, pipeline information, and portfolio company data ("Customer Data"), is processed by XS on behalf of you or your organization in accordance with our Terms & Conditions and any applicable Data Processing Addendum. This Policy applies to Customer Data only to the extent expressly stated.

02

The Information We Collect

2.1 Information You Provide to Us

• Account and registration information, such as your name, job title, firm or organization, business email address, telephone number, business address, username, and password.
• Subscription information, such as your XS plan, subscription history, and communication preferences.
• Payment information, such as billing name and address. Payment card details are collected and processed by our third-party payment processor; XS does not store full payment card numbers.
• Configuration information, such as the investment criteria, sectors, geographies, and buy-box settings you configure in XS Origination, and the portfolio companies and data sources you connect to XS Portfolio.
• Communications, including messages you send us, support requests, and feedback.
• Authorized user information, including the names and email addresses of authorized users added to your organization's account.

2.2 Information We Collect Automatically

When you use the Services, we and our service providers automatically collect certain information, including your IP address, device and browser type, operating system, referring pages, the pages you view and links you click, the time and duration of your visits, email open and click activity, and platform usage logs. We collect some of this information through cookies and similar technologies, as described in Section 5.

2.3 Information We Obtain from Other Sources

We obtain information from sources other than you, including:

• Publicly available sources, such as company websites, press releases, regulatory filings, professional networking sites, news publications, and industry databases, which we use to compile market maps, company profiles, and research;
• Third-party data providers that supply business, market, and company information;
• Your organization and colleagues, for example when an administrator at your organization adds you as an authorized user;
• Systems you connect to the Services, such as the accounting, operational, and reporting systems of your portfolio companies, where you or your organization authorize the connection; and
• Payment processors and other service providers, which may provide confirmation of payment and related information.

If you are a professional at a company or firm that appears in XS Content, we may hold business information about you or your firm compiled from publicly available sources even if you have never interacted with XS directly. Section 6 explains how you can review, update, or request removal of that information.

03

How We Use Information

We use the information we collect for the following purposes:

• to provide, operate, and maintain the Services, including creating and managing your account and subscription;
• to compile, maintain, and present market maps, company profiles, scores, and analytics;
• to process payments, manage billing and renewals, and maintain financial records;
• to conduct research and to publish aggregated findings that do not identify individual users, organizations, or portfolio companies;
• to send you product updates and other communications about XS features, research, events, and Services, subject to your right to opt out of marketing communications;
• to make operating professionals available to you, where included in your plan;
• to operate, maintain, secure, and improve the Services, including through analytics, troubleshooting, and product development;
• to personalize content and communications based on your interests and use of the Services;
• to protect the security and integrity of the Services, to detect and prevent fraud, abuse, and violations of our Terms & Conditions, and to enforce our rights;
• to respond to your inquiries and requests;
• to comply with applicable laws, regulations, legal process, and governmental requests; and
• for any other purpose disclosed to you at the time of collection or with your consent.

We may aggregate or de-identify information so that it no longer identifies you, your organization, or your portfolio companies, and we may use and share aggregated or de-identified information for any purpose, including research, benchmarking, and product development.

04

How We Share Information

We share information in the following circumstances:

• Within your organization. Information in your account, and Customer Data, is visible to the other authorized users of your organization's account in accordance with the permissions your organization configures.
• With service providers that perform services on our behalf, including cloud hosting, data storage, email delivery, payment processing, customer relationship management, analytics, customer support, and IT security. These providers are permitted to use information only to perform services for us.
• With operating professionals engaged by XS to work with your organization, where included in your plan, and only to the extent necessary for them to provide those services to you.
• With our affiliates, for the purposes described in this Policy.
• With our professional advisers, including lawyers, accountants, auditors, and insurers.
• For legal reasons, including to comply with laws, regulations, legal process, or governmental requests; to enforce our Terms & Conditions; and to protect the rights, property, or safety of XS, our users, or others.
• In connection with a business transaction, such as a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to appropriate confidentiality protections.
• With your direction or consent, including when you ask us to share information with a third party or connect the Services to a third-party system.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising.

05

Cookies and Tracking Technologies

We and our service providers use cookies, pixels, web beacons, and similar technologies on the Site and in our emails to operate the Services, remember your preferences, understand how the Services are used, measure the effectiveness of our communications, and improve performance. These technologies may collect information such as your browser type, access times, pages viewed, and IP address. We may use third-party analytics services, such as Google Analytics, that use their own cookies to collect information about your use of the Services.

You can control cookies through your browser settings, and most browsers allow you to refuse or delete cookies. Disabling cookies may affect the functionality of the Services. For more information about cookies and how to manage them, visit www.allaboutcookies.org. Some browsers offer a "Do Not Track" signal; we do not currently respond to Do Not Track signals. Where required by applicable law, we honor opt-out preference signals, such as the Global Privacy Control.

06

Your Choices

• Marketing communications. You may opt out of marketing emails at any time by using the unsubscribe link in any email or by contacting us at privacy@xs.global. We may continue to send you transactional and account-related communications as long as you maintain an account.
• Account information. You may review and update account information through your account settings or by contacting us.
• Company and professional information. Any firm or individual whose business information appears in XS Content may request to review, correct, or remove that information by contacting us at privacy@xs.global.
• Cookies. You may manage cookies as described in Section 5.

07

Security

We maintain administrative, technical, and physical safeguards designed to protect the information we collect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. However, the transmission of information over the Internet is not completely secure, and no security measures are perfect. Although we work to protect your information, we cannot guarantee its security, and any transmission is at your own risk. You are responsible for keeping your login credentials confidential.

08

Data Retention

We retain information for as long as reasonably necessary to fulfil the purposes described in this Policy, including to provide the Services, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. In general, account and subscription data is retained for the life of your account and for 7 years thereafter; Customer Data is retained for the subscription term and the export period described in our Terms & Conditions; compiled company and professional information is retained for as long as it remains relevant or until we act on a valid removal request; marketing data is retained until you opt out; and financial records are retained for the periods required by law. We may retain aggregated or de-identified information indefinitely.

09

Children's Privacy

The Services are intended for business professionals and for individuals who are 18 years of age or older. We do not knowingly solicit or collect personal information from anyone under 18 years of age. If you believe we have collected personal information from a minor, please contact us so that we can delete it.

10

Third-Party Websites and Platforms

The Services may contain links to third-party websites and may be integrated with third-party platforms and systems. This Policy does not apply to the practices of third parties, and we encourage you to review their privacy policies before providing information to them.

11

International Users

XS is based in the United States, and the Services are hosted and administered in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your jurisdiction. Individuals in the European Economic Area, the United Kingdom, and Switzerland should refer to our GDPR Privacy Policy.

12

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we do, we will revise the Effective Date at the top of this Policy and, where the changes are material, we will provide additional notice, such as by email or by a prominent notice on the Site. Your continued use of the Services after a revised Policy takes effect constitutes your acceptance of the revised Policy.

13

Contact Us

If you have questions about this Policy, wish to access or update your information, or wish to exercise any of the rights described above, please contact us at: