Privacy Notice — ReviewXM.ai
Short answer: To post a review you give us a star rating, your review text, your country and your email address. We publish the rating, the text, the country and the date, without a name. We never publish your email. We use it to confirm your review and to contact you about that review only. We do not ask for your name, and you do not need an account.
Last updated: 2026-11-09
1. Who we are
ReviewXM.ai is a website where traders share their own reviews of the broker XM. It is not XM and is not endorsed by XM. Run by a team that also operates an XM partner service. This site earns nothing from XM and has no partner links. More on the About page.
- Operator responsible for your data (data controller): ReviewXM.ai ([email protected])
- Privacy contact: [email protected]
XM is a separate company. Your XM account and the data you give XM are covered by XM's own privacy policy, not by this notice. This notice covers only ReviewXM.ai.
2. What we collect
| What | Where it comes from | Published? |
|---|---|---|
| Overall star rating | You, in the review form | Yes |
| Topic ratings (optional): deposits & withdrawals · spreads & execution · customer support · platform & app | You, if you open "Rate by topic" | Yes (as part of the topic scores) |
| Your review text | You | Yes — as soon as you confirm your email |
| Country, stored as a country code only | Pre-filled from your connection, which you can change | Yes, shown next to your review |
| Email address (required) | You | Never |
| Date and time you submitted and confirmed the review | Our system, automatically | The date is shown |
| Reports about a review — the reason you give, and your email if you report by email | You, through the Report link or by email | No |
| Messages you send us about a review or about your data | You, by email | No |
How the country is pre-filled: our hosting provider, Cloudflare, works out an approximate country from your connection. Our form receives only that country. Our review database does not store your IP address. For rate limits it keeps only a one-way keyed hash that changes every day and is deleted after a day. Cloudflare processes it to run the service and protect the site, including the bot check and limits on how often reviews can be sent. If the country is wrong (for example, because you use a VPN), change it before you submit.
What we never ask for and do not want: your name, your XM account number, your trading password or Members Area login, identity documents, or card or bank details. Do not put these in your review. An automatic filter blocks links, phone numbers and account numbers before you submit. If personal details still appear in a review and it is reported, we remove that part (see the Review Policy).
3. Why we use it
| Purpose | Data used | Legal basis (GDPR / Thai PDPA, in general terms) |
|---|---|---|
| Publish your review and calculate the scores shown on the site | Ratings, review text, country, date | Our legitimate interest in running an open review site, and the request you make when you submit |
| Send one email to confirm that the review is yours, and allow one review per email | Needed to process your submission; legitimate interest in preventing fake reviews | |
| Contact you about that review only — for example, if a report means we must remove personal details, or to answer your request to edit or delete it | Legitimate interest; handling your request | |
| Stop spam, bots and abuse | Bot check, rate limits and security signals processed by Cloudflare | Legitimate interest in keeping the site safe |
| Handle reports about reviews | The report and the review | Legitimate interest; legal obligations where content may be unlawful |
| Answer privacy requests and keep a record that we did | Your message and email | Legal obligation |
We do not use your email for marketing or newsletters. We do not add it to any mailing list. We do not sell, rent or trade personal data. We do not share reviewer email addresses with XM, or with the XM partner service run by the same team.
4. Who can access it
- Our team — to look at reported reviews and answer requests.
- Cloudflare — hosts the website and the review database, runs the Turnstile bot check, and processes connection data for security.
- An email delivery provider — sends the confirmation email for us (Resend).
- Cloudflare Web Analytics — counts page views (see section 6).
- Authorities, only when the law requires us to disclose data.
These providers act on our instructions and may process data in other countries. Where the law requires it, we rely on the transfer safeguards these providers offer (for example, standard contractual clauses).
5. How long we keep it
| Data | How long |
|---|---|
| Unconfirmed submission (review + email) | Deleted 30 days after submission if the confirmation link is not used |
| Email of a published review | Kept while the review is on the site, so you can ask us to edit or delete it. Deleted within 30 days after the review is removed |
| Published review (ratings, text, country, date) | Kept while the site runs, unless you ask us to delete it or we remove it under the Review Policy |
| Review removed after a report, and its email | Deleted within 90 days, kept only to handle repeat spam or abuse |
| Reports and emails you send us | 12 months after the matter is closed |
| Backups | Deleted data may stay in backups for up to 30 days before it is overwritten |
6. Cookies and analytics
Needed to run the site: the Cloudflare Turnstile bot check runs in your browser when you submit a review. It may use signals from your browser and device to tell people from bots. It is not used for advertising.
Analytics: we use Cloudflare Web Analytics, which counts page views without analytics cookies. We see totals and trends, not named people.
We do not use advertising or remarketing cookies.
7. Your rights
Depending on where you live — including under the EU/UK GDPR and Thailand's Personal Data Protection Act (PDPA) — you may have the right to:
- ask what data we hold about you and get a copy;
- correct it — for example, change the country on your review;
- ask us to delete it — including your whole review;
- object to, or ask us to limit, how we use it;
- withdraw consent where we rely on consent;
- complain to a data protection authority, such as Thailand's PDPC or the authority in your EU/UK country.
How to ask: email [email protected] from the email address you used for your review, and start the subject with "Privacy request". If you write from another address, we may need to send a check to the original address first. This keeps other people from changing or deleting your review.
We reply within 30 days. Deleting data we hold does not affect your XM account or any data XM holds. For that, contact XM directly.
8. Children
ReviewXM.ai is for adults. It is not intended for anyone under 18. If you believe a child has sent us data, contact us and we will delete it.
9. Language versions and changes
This notice is published in 12 languages. If a translation differs from this English version, the English version applies. If we change how we use your data, we will update this page and the date at the top. We will not start using your email for a new purpose without telling you first and, where the law requires it, asking for your consent.
10. Contact
Privacy questions and requests: [email protected] Operator: ReviewXM.ai ([email protected])
ReviewXM.ai is not XM and is not endorsed by XM. This site earns nothing from XM and has no partner links. Who runs it: see About.