Terms of Use ← Back to App

Privacy Policy

Effective Date: October 30, 2026 Last Updated: October 30, 2026 Version: 3.1

1. Scope and Roles

1.1. Scope

This Privacy Policy explains how Dexa processes personal data and other information in connection with the Dexa platform, including its web application, dashboards, analytics, classifications, reports, integrations, alerts, automations and related functionality. This Privacy Policy applies to the use of the Service by brokers, prop trading firms and other business clients.

1.2. B2B Service

Dexa is a business-to-business service. The Service is provided to business clients and is not intended for direct use by individual traders or retail consumers.

1.3. Client as Controller

Where the Service processes personal data relating to traders, end-clients, broker employees or other individuals contained in Client Data, the Client acts as the data controller. The Client is responsible for determining the purposes and legal basis of such processing, providing required notices, handling data subject requests and complying with applicable data-protection laws.

1.4. Dexa as Processor

Dexa processes Client Data on behalf of the Client and in accordance with the Client’s documented instructions, including instructions given through the Service configuration, integrations, automation settings and support requests.

1.5. No Direct Relationship with Traders

Dexa does not usually have a direct contractual relationship with the Client’s traders or end-clients. Traders and end-clients should contact the relevant broker or financial institution if they have questions about how their personal data is used in connection with the Service.

1.6. Privacy Approach

The Service is designed in accordance with principles of data minimisation, logical tenant isolation, access control and security-by-design. Dexa’s analytics and classification pipeline does not require end-client names, email addresses, identity documents, KYC records, bank details or payment information for ordinary processing. Trader names and email addresses are processed only where the Client enables the optional functionality described in Section 2.5, and solely for the purposes specified in that Section.

Where Dexa processes personal data, including pseudonymised data, on behalf of the Client, it acts as a processor and processes such data in accordance with the Client’s documented instructions and the applicable agreement to provide, protect and maintain the Service, or as required by applicable law.

1.7. Dexa as Controller

In specific circumstances, Dexa serves as the data controller, establishing the objectives and methods for processing limited types of information. These categories include:

  1. profile details for the Client’s authorised users, encompassing names, corporate email addresses, professional roles, credentials, and authentication records;
  2. administrative data related to billing, invoicing, and payment processing;
  3. correspondence and records generated through support requests;
  4. cookies, interaction metrics, security logs, and technical information concerning how authorised users engage with the Service, as detailed in Section 12.

When operating as a controller, Dexa processes this information based on the following legal foundations: the execution of the Client agreement (for account management, access, and billing); legitimate business interests (for service security, fraud prevention, and platform optimization); and regulatory compliance (for taxation, accounting, and statutory record-keeping).

The provisions of Sections 5, 6, and 11.1 are not applicable to processing where Dexa is the controller; individuals may instead exercise their data protection rights directly with Dexa in accordance with Section 11.4.

2. Information We Process

2.1. Client Account Information

Dexa may process information relating to the Client and its authorised users, including names, business email addresses, company details, billing details, roles, permissions, login credentials, authentication data, access logs and support communications.

2.2. Trading and Analytics Data

Depending on the Client’s configuration and connected systems, Dexa may process trading and analytics data, including trading account numbers, groups, leverage, balance, equity, orders, deals, positions, volumes, instruments, timestamps, PnL, exposure, trading patterns, classifications, alerts, reports and related metrics.

2.3. Technical Data

Dexa may process technical data, including IP addresses, device identifiers, connection metadata, browser data, system logs, API logs, integration logs, security logs and other technical information required to operate, secure and support the Service.

2.4. Data Not Required for Ordinary Use

Dexa does not require end-client names, personal email addresses, phone numbers, identity documents, KYC files, bank account details or payment information for the ordinary operation of its analytics and classification pipeline.

Trader names and email addresses are retrieved from the Client’s connected trading platform only where the Client expressly enables the optional functionality described in Section 2.5, and are processed for the purposes specified in that Section.

Outside that functionality, the Client should not provide the personal data listed above unless necessary for a specific support, legal or operational purpose. Any such disclosure should be limited to the minimum data necessary for that purpose.

2.5. Trader Personal Data (Optional Functionality)

The Service includes optional functionality that allows the Client to identify traders by name or email address in addition to, or instead of, trading account numbers. This functionality is disabled by default. Dexa retrieves trader names or email addresses from the Client’s connected trading platform only where the Client expressly enables the relevant option in the Service configuration. Enabling an option constitutes the Client’s documented instruction to carry out the corresponding processing under Section 6.2.

Where the Client enables the “Load traders personal data” setting, Dexa retrieves traders’ first and last names, and displays them within the Client’s tenant to identify the relevant trading accounts. Dexa records which authorised user enabled the setting and when. Where the Client selects email addresses for account matching, Dexa also uses those addresses to link or consolidate trading accounts associated with the same email address into a single trader profile. The Client is responsible for verifying that accounts matched in this way belong to the same trader.

Trader names loaded under this Section are used solely for display within the Client’s tenant and in certain reports that the Service generates and allows the Client to export. They are not used for classifications, alerts or AI-assisted features, transmitted to AI providers, or recorded in logs. These restrictions apply specifically to trader names; email addresses are also processed for account matching where the Client enables that functionality.

Where the Client configures reports to be delivered by email, such reports, including any trader names they contain, are sent to the recipients designated by the Client. The Client is responsible for ensuring that all such recipients are authorised to receive this data.

Once the “Load traders personal data” setting is enabled, the loaded data is visible to all authorised users of the Client’s tenant, including any dealer, external service provider or consultant to whom the Client has granted access. Visibility cannot be restricted by user role or permission. The Client is responsible for ensuring that all such users are authorised to access this data before enabling the setting and while it remains enabled.

If the Client disables the “Load traders personal data” setting, Dexa stops retrieving trader names and deletes previously loaded trader names from the active tenant environment at the next synchronisation cycle, subject to Section 10.4. This deletion process applies to trader names and does not, by itself, describe the retention or deletion of email addresses used for account matching. Trader names contained in reports generated before the setting is disabled remain in those reports until the reports are deleted in accordance with Section 10.

3. How We Use Information

3.1. Providing the Service

Dexa processes information to provide, operate, maintain and support the Service, including analytics, dashboards, classifications, reports, alerts, integrations and automation features.

3.2. Analytics and Classification

Dexa uses trading and analytics data to detect trading patterns, generate classifications, calculate metrics, support A-book / B-book analysis, produce reports and provide decision-support outputs to the Client.

3.3. Security and Maintenance

Dexa processes information to secure the Service, manage access, monitor system performance, detect errors, prevent misuse, investigate incidents and maintain service reliability.

3.4. Support and Communication

Dexa may use Client account information and support communications to respond to requests, troubleshoot issues, provide notices, manage subscriptions and communicate with authorised Client users.

3.5. Compliance

Dexa may process information where necessary to comply with legal obligations, enforce applicable terms, protect its rights, prevent fraud, respond to lawful requests or address security, legal or regulatory risks.

4. AI, Machine Learning and Reports

4.1. AI and ML Features

Dexa may use rule-based, algorithmic, machine-learning and AI-assisted features to generate classifications, predictions, alerts, reports, explanations and other analytics outputs. These outputs are provided to the Client for internal analysis and decision-support purposes.

4.2. AI-Assisted Reports

Dexa may use third-party AI providers, including OpenAI and Anthropic / Claude, to support AI-assisted reports, summaries, query generation, explanations and similar functionality. Unless otherwise stated, third-party AI providers do not independently access the Client’s full tenant, analytics database, trading platform or source systems.

4.3. No Training on Client Data

Dexa does not knowingly permit third-party AI providers to use Client Data for their own model training, advertising or unrelated profiling purposes, unless expressly agreed otherwise.

4.4. Client Review

AI, ML and analytics outputs may be incomplete, inaccurate or unsuitable for a particular decision. The Client is responsible for reviewing and validating outputs before using them for any business, trading, compliance, payout or trader-handling decision.

5. Automated Processing and Client Decisions

5.1. Decision-Support Only

Dexa provides analytics, classifications, predictions, alerts, reports and recommendations for the Client’s internal use. Dexa does not independently decide whether any trader, trading account or end-client should be approved, rejected, suspended, restricted, moved to another execution group, denied a payout or treated as fraudulent, abusive or in breach of contract.

5.2. Client Responsibility

The Client remains responsible for all decisions made in connection with its use of the Service, including trading, execution, risk-management, compliance, payout and trader-handling decisions.

5.3. Human Review

Where Service outputs may affect a trader, trading account or end-client, the Client is responsible for ensuring appropriate human review, supporting evidence and compliance with applicable law.

5.4. Automation Settings

If the Client enables automation features, any automated action is based on rules, thresholds or instructions configured by the Client. Such automation is the technical execution of the Client’s instructions and does not constitute an independent decision by Dexa.

7. Sharing and Subprocessors

7.1. No Sale of Personal Data

Dexa does not sell Client Data or personal data processed through the Service. Dexa does not use Client Data for advertising or unrelated profiling.

7.2. Service Providers and Subprocessors

Dexa may use trusted service providers and subprocessors to host, operate, secure, support and improve the Service. These may include cloud infrastructure providers, database and hosting providers, communication tools, email delivery providers, AI providers, FX reference-rate providers and economic-calendar or news-data providers.

7.3. Categories of Subprocessors

Dexa may share information with subprocessors only to the extent reasonably necessary for the relevant purpose, including:

  1. cloud infrastructure providers for hosting, storage and compute;
  2. AI providers, including OpenAI and Anthropic / Claude, for AI-assisted reports, summaries, query generation, explanations or similar functionality;
  3. FX reference-rate providers for public reference-rate feeds;
  4. economic-calendar and news-data providers for market events and news data;
  5. email delivery providers for transactional and other notifications expressly configured by the Client;
  6. support, security or operational service providers where required to provide or maintain the Service.

7.4. AI Provider Data

Where AI-assisted features are used, Dexa may transmit to its AI providers prompts, schema metadata and limited structured results to the extent necessary to fulfil the relevant request. Dexa does not authorise AI providers to use Client Data for their own model training, advertising or unrelated profiling purposes, unless expressly agreed in writing with the Client. Trader names loaded under Section 2.5 are excluded from all data transmitted to AI providers, including prompts, schema metadata and structured results.

7.5. External Market Data Providers

FX reference-rate providers, economic-calendar providers and news-data providers generally provide external market or reference data to Dexa. Unless expressly stated or agreed otherwise, such providers do not receive Client trading data or trader analytics data from Dexa.

7.6. Subprocessor Changes

Dexa may update its subprocessors from time to time. Where required by applicable law or agreement, Dexa will provide notice of material subprocessor changes and allow the Client to object in accordance with the applicable data-processing terms.

7.7. Legal Disclosures

Dexa may disclose information where required by law, court order, regulator request or other lawful process, or where necessary to protect its rights, systems, users, clients or the security of the Service.

8. International Transfers

8.1. Processing Locations

Dexa and its service providers may process information in different countries, including countries where the Client, Dexa, hosting providers, AI providers or other subprocessors are located.

8.2. Transfer Safeguards

In instances where personal information is moved beyond the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions with cross-border transfer restrictions, Dexa implements measures to ensure such transfers occur exclusively:

  1. to territories acknowledged as offering a sufficient degree of protection by relevant data-protection statutes;
  2. through the implementation of Standard Contractual Clauses, the UK International Data Transfer Addendum, or alternative valid mechanisms sanctioned by applicable law; or
  3. via other legitimate safeguards or exceptions authorized under governing data-protection regulations.

Specifics regarding transfer protocols and active subprocessors are documented within the Data Processing Agreement and the associated Subprocessor List, as appropriate.

8.3. Client Systems

Where the Client connects trading platforms, servers, databases or other systems located outside the Client’s jurisdiction, the Client is responsible for ensuring that such connection and data transfer is lawful.

9. Security

9.1. Security Measures

Dexa maintains technical and organisational measures designed to protect information processed through the Service against unauthorised access, loss, misuse, alteration or disclosure. These measures may include HTTPS/TLS encryption for data in transit, encryption of sensitive credentials and API keys, secure password hashing, role-based access controls, tenant separation, logging and monitoring, backups, firewalls, infrastructure security controls and restricted access to production systems.

9.2. Encryption and Credentials

Dexa implements encryption protocols and rigorous credential-handling procedures tailored to the specific operational requirements of the Service.

These protections may include TLS/HTTPS encryption for data moving between the platform, integrated systems, and AI subprocessors; secure storage of trading credentials and API keys; infrastructure-level encryption for managed databases; and robust hashing algorithms for authorized user passwords. The Service is designed to avoid the logging or storage of passwords in plaintext format.

9.3. Access Control and Tenant Separation

Dexa applies access-control measures designed to restrict access to Client Data to authorised users and authorised personnel only. Each Client’s analytics environment is logically separated from other clients. User access is managed through roles, permissions and authentication controls.

9.4. Logging and Monitoring

Dexa maintains logs for security, audit, troubleshooting, synchronisation and operational purposes. The Service is configured to minimise personal data in logs where reasonably possible, including through masking, limitation, rotation or other controls.

9.5. Client Responsibilities

The Client is responsible for securely managing its users, roles, permissions, devices, credentials, API keys, connected systems and internal access controls. The Client must promptly notify Dexa of any suspected unauthorised access, credential compromise or misuse of the Service.

9.6. No Absolute Security

No system, transmission or storage method is completely secure. Dexa does not guarantee that the Service will be free from all vulnerabilities, security incidents, interruptions or unauthorised access.

9.7. Breach Notification Protocols

Upon confirming a security incident that impacts personal information within Client Data, Dexa shall inform the Client without unnecessary delay. Such notification will be delivered within applicable statutory windows as mandated by governing law or the underlying service agreement.

9.8. Notification Particulars

To the extent information is accessible, Dexa’s communication will outline the circumstances of the incident, the specific data types involved, anticipated repercussions, and the remedial actions executed or intended. Additionally, Dexa may provide recommendations regarding measures the Client should consider to mitigate further risk.

9.9. Controller Disclosure Obligations

As the data controller, the Client maintains sole responsibility for assessing whether the incident necessitates formal disclosure to traders, retail users, regulators, or supervisory bodies. Dexa will offer reasonable support to facilitate such compliance efforts, consistent with the nature of the event and available technical insights.

10. Data Retention and Deletion

10.1. Retention During Service Use

Dexa retains information for as long as reasonably necessary to provide, operate, secure and support the Service, comply with applicable terms, resolve disputes and meet legal or operational requirements.

10.2. Configured Retention Periods

Where supported by the relevant functionality, the Service applies configured retention periods to the following categories of Client Data, depending on the Client’s configuration and enabled features:

  1. deals, orders and balance operations;
  2. classification history;
  3. news-deal matches;
  4. AI report prompts and outputs;
  5. trader profiles, metrics and classifications;
  6. trader names and email addresses loaded at the Client’s election under Section 2.5;
  7. positions and other real-time or periodically synchronised data;
  8. application, synchronisation, security and audit logs;
  9. Client account and authorised-user data; and
  10. tenant databases retained following account closure or termination.

Retention and deletion remain subject to Section 10.4 and any specific deletion provisions in Section 2.5.

10.3. Automated Cleanup and Reconciliation

Certain data may be automatically deleted, overwritten or reconciled through retention, cleanup, rotation or synchronisation processes. For example, positions may be replaced during synchronisation cycles, logs may be rotated after a defined period, and historical analytics data may be deleted when the applicable retention period expires.

Where the Client disables the relevant setting under Section 2.5, previously loaded trader names are deleted from the active tenant environment at the next synchronisation cycle, subject to Section 10.4. Trader names contained in reports generated before the setting is disabled remain in those reports until the reports are deleted in accordance with Section 10.

10.4. Backups, Logs and Legal Records

Deletion from active systems may not immediately remove copies held in backups or archives, or records retained where necessary for security, audit, billing, legal compliance, dispute resolution or fraud prevention.

Such data remains subject to applicable confidentiality and security safeguards, with access and use limited to the purposes for which it is retained. Backup and archival copies are deleted or overwritten in accordance with the applicable retention schedules. Other retained records are deleted or anonymised when no longer necessary for the relevant purpose, unless continued retention is required by applicable law.

This Section does not authorise the recording of trader names in logs where prohibited under Section 2.5.

10.5. Post-Termination Retention

Upon the closure of an account or service termination, Dexa maintains the tenant environment for a thirty (30) day grace period, in accordance with the governing agreement, to facilitate potential reactivation, data export, or structured decommissioning, unless alternative arrangements are documented or statutory mandates require otherwise. Following this designated interval, Dexa proceeds to delete or deactivate the tenant database pursuant to its standard retention protocols, while acknowledging that data may persist within backup lifecycles, security logs, and records kept for legal or audit purposes as outlined in this Privacy Policy.

11. Data Subject Rights

11.1. Requests to the Client

Traders, end-clients, employees and other individuals should contact the relevant Client if they wish to exercise privacy or data-protection rights relating to data processed through the Service. The Client is responsible for responding to such requests as the data controller.

11.2. Dexa Assistance

Where required by applicable law and reasonably possible, Dexa will assist the Client in responding to data subject requests, including requests for access, correction, deletion, restriction, objection or portability.

11.3. Direct Requests to Dexa

If Dexa receives a request directly from a trader, end-client or other individual whose data is processed on behalf of a Client, Dexa may redirect the individual to the relevant Client.

Dexa will not independently respond to such requests unless required by law or authorised by the Client.

11.4. Data Rights Under Dexa’s Control

In instances where Dexa operates as the data controller pursuant to Section 1.7, affected individuals—including the Client’s authorised users—may directly exercise their legal rights of access, rectification, erasure, processing restriction, objection, and data portability. Such requests should be directed to Dexa via the communication channels specified in Section 14.

Furthermore, such individuals maintain the right to submit a formal complaint to a relevant data-protection supervisory authority. This may include the regulatory body in their primary residence, their professional location, or the jurisdiction where a suspected infringement occurred.

12. Cookies and Usage Data

12.1. Cookies and Similar Technologies

Dexa implements cookies, local storage, and related technologies essential for the Service’s functionality. These tools are utilized to manage active sessions, preserve user-specific settings, facilitate authentication protocols, and uphold platform security measures. The Service does not deploy third-party cookies for advertising or promotional objectives. In the event that non-essential technologies requiring legal authorization are introduced, Dexa shall obtain the necessary consent via a formal mechanism prior to their activation.

12.2. Usage Data

Dexa may collect usage data relating to how authorised users interact with the Service, including login activity, feature usage, pages viewed, technical events, errors and performance data.

12.3. Purpose

Cookies and usage data are used to provide, secure, maintain, troubleshoot and improve the Service.

Dexa does not use Client Data or trader analytics data for unrelated advertising purposes.

13. Changes to This Privacy Policy

13.1. Updates

Dexa may update this Privacy Policy from time to time to reflect changes in the Service, legal requirements, security practices, subprocessors or data-processing activities.

13.2. Notice

Updated versions may be made available through the Service, by email, or by posting the updated Privacy Policy on Dexa’s website or application.

Where required by law or applicable agreement, Dexa will provide additional notice of material changes.

13.3. Policy Revision Commencement

Every revised iteration of this Privacy Policy shall be deemed operative from its specified effective date.This Privacy Policy constitutes an explanatory notification outlining Dexa's processing methodologies. The binding legal rights and duties of the Parties regarding data handling are dictated by the underlying service agreement and the corresponding Data Processing Agreement.

14. Contact and Complaints

14.1. Entity Identification

The Service is managed by Tools For Brokers Pte. Ltd, a corporate entity incorporated at 531 Upper Cross Street #02-11, Hong Lim Complex, Singapore (050531) (referred to herein as "Dexa").

14.2. Communication Channels

Inquiries regarding this Privacy Policy or the methods by which Dexa handles information may be submitted to [email protected] or through the dedicated support infrastructure integrated within the Service.

14.3. Trader and End-Client Inquiries

Individual traders and end-clients whose personal information is handled on behalf of a Client should primarily engage with the specific broker or financial institution serving as the data controller. Should Dexa receive such communications directly, it reserves the right to redirect the data subject to the appropriate Client pursuant to Section 11.3.

14.4. Regulatory Oversight

Where Dexa operates as a controller, affected individuals maintain the statutory right to file a formal grievance with a relevant data-protection supervisory body.