Privacy Policy

1. Who we are

ⓘ Remit2Any Inc. runs Xpat and is responsible for your information, while our licensed partners are responsible for the information they handle for their own services.

Xpat is operated by Remit2Any Inc., a financial technology company incorporated in the State of Washington, United States (Registration No. 604871470). Our address is 3206 93rd Pl SE, Everett, WA 98208, United States. Remit2Any Inc. decides how and why your personal information is used for the Xpat services, which makes us the “controller” (or, under India’s Digital Personal Data Protection Act, 2023, the “Data Fiduciary”) for that information.

Xpat is not a bank. Some of the services you reach through Xpat are provided by licensed partners. When a partner provides a service to you, that partner collects and uses your information for its own legal and regulatory purposes and acts as an independent controller under its own privacy policy. Today these partners include:

Our list of partners and their registration numbers is kept up to date on our Licenses & partners page. Third-party services you choose to reach from Xpat — for example mutual funds through goINRI, tax filing through Rally Tax, or payments from India under the Liberalised Remittance Scheme — are run by those providers, and their own privacy policies apply to what you share with them.

2. What this policy covers

ⓘ This policy covers our website, app and services for individuals and merchants, but not the separate sites and services of other companies.

This policy applies to personal information about visitors to xpat.money, people who sign up for or use Xpat, people who receive money or payment requests through Xpat, merchants and their representatives who use Get paid, people who are referred to Xpat, and anyone who contacts our support team.

It does not apply to websites, apps or services run by other companies, even if you reach them through a link in Xpat. If you use Xpat on behalf of a business, the business’s information is also handled under our Merchant terms.

If you live in the United States, our privacy notice under the Gramm-Leach-Bliley Act (GLBA) is part of this policy — see “Your choices about sharing”. If you live in California or another US state with a privacy law, see “US state privacy rights”. If you are in India or we process your information in India, see “Rights for people in India”.

3. Information we collect

ⓘ We collect identity, contact, financial, transaction, device and support information so we can run your account and keep it safe.

The information we collect depends on which services you use. The table below sets out the main categories.

Sensitive information

Some of this information is treated as sensitive under privacy laws, including your SSN or ITIN, government ID numbers, financial account details, account sign-in credentials and biometric information. We collect it only where it is needed to provide the service you asked for, to keep your account secure, or because the law requires it. Your SSN is always fully masked in the app and on our website after you enter it.

Biometric information

When you verify your identity, the selfie or liveness check is carried out by our identity verification providers — Persona for US verification and HyperVerge for India verification. Any biometric information (such as a face geometry template created to compare your selfie with your ID) is processed by the verification provider on our behalf, only to verify your identity and prevent fraud. Biometric and identity-verification information is retained only for as long as reasonably necessary for identity verification, fraud prevention, regulatory compliance and other legally permitted purposes, subject to applicable law and the retention policies of our identity-verification providers. Xpat does not create or independently store biometric or face-geometry templates. We may receive verification results, identity information, images, status information and risk signals as reasonably needed for identity verification, fraud prevention and compliance. Before the selfie step, you are shown the applicable biometric and privacy disclosure and asked for your consent.

Contacts

Xpat reads the contacts on your phone only if you choose to share them, and only to show you which of your contacts are already on Xpat so you can invite or pay them. We do not upload or permanently store your whole address book. We keep only the contact details actually needed for something you ask us to do — a transaction, a recipient or an invitation. We do not use your contacts to send them marketing without your action, and you can use Xpat without giving access to your contacts.

Information about other people

If you give us information about someone else — for example a recipient, a person you pay by phone, a member of a Circle or a friend you refer — please make sure they are comfortable with you sharing it. We use it only to provide the service you asked for and to meet our legal obligations.

4. Where we get information

ⓘ Most information comes from you, and the rest comes from our partners, verification and data providers, public sources and people who refer you.

We collect personal information from:

• You — when you sign up, verify your identity, link an account, make a transfer, contact support or answer a survey.
• Your devices — automatically, when you use our website or app.
• Our regulated partners — such as Bivo, Cybrid, Cross River Bank and our Indian payout partners, for example about the status of a payment, a returned ACH debit or a compliance review.
• Identity verification providers — such as Persona and HyperVerge (including DigiLocker records you choose to share), which confirm your identity and the authenticity of your documents.
• Plaid and other account-linking services — when you connect a US bank account.
• Credit bureaus, fraud prevention services and identity databases — to confirm your identity and help detect fraud.
• Sanctions lists and other public sources — such as government sanctions lists, public records and information you have made public.
• People who refer you or send you money — for example, a friend’s referral link, or a sender who enters your mobile number for Pay by phone.
• Merchants — when you pay them through Pay with Xpat.
• Sign-in, analytics and marketing providers — such as Google or Apple when you use social sign-in, and analytics tools that tell us how our website and app are used.

5. How we use information

ⓘ We use your information to provide Xpat, verify you, follow financial and tax laws, stop fraud, support you, improve the product and — subject to your choices — market to you.

We use personal information to:

• Provide our services — open and run your account, show you rates and fees, process transfers, Pay by phone, Circles, merchant payments, rewards and referrals, and send receipts, statements and service messages.
• Verify your identity — confirm who you are when you sign up, when your limits change, and when a transfer needs enhanced checks.
• Comply with the law — including the Bank Secrecy Act and anti-money-laundering rules, OFAC and other sanctions screening, the CFPB Remittance Transfer Rule, US tax reporting, and Indian tax rules including deducting and reporting TDS on remittances where Indian law requires it.
• Prevent fraud and financial crime — screen transactions, detect unusual activity, investigate returned payments, chargebacks and disputes, and protect you, other customers and Xpat.
• Keep Xpat secure — authenticate you, send one-time codes for sensitive actions, and monitor for misuse.
• Support you — answer questions, resolve errors and complaints, and keep records of our conversations.
• Improve Xpat — understand how our services are used, fix problems, test new features and develop new products.
• Market to you — tell you about Xpat products, offers and rewards, subject to the choices described in “Marketing messages”.
• Exercise and defend legal rights — enforce our agreements, recover amounts owed, and respond to legal claims and requests from authorities.

We may combine information we collect from different sources for these purposes. We may also create de-identified or aggregated information that no longer identifies you, and use it for any lawful purpose; we will not try to re-identify it except as the law allows.

We do not use automated decisions that produce legal effects about you without the possibility of human review. Our fraud and compliance tools may automatically flag a transfer for review, delay it or ask you for more information; if this happens, you can contact support.

6. Legal bases for using information

ⓘ Where the law asks us to have a reason for using your information, we rely on our contract with you, legal duties, legitimate interests or your consent.

Some privacy laws, including those in the European Union, the United Kingdom and India, require a legal basis for using personal information. Depending on the activity, we rely on:

• Contract — to provide the services you signed up for.
• Legal obligation — to verify identity, screen against sanctions, keep records, report to tax and financial authorities, and respond to lawful requests.
• Legitimate interests — to prevent fraud, keep our services secure, improve our products and market our own services, where these interests are not outweighed by your rights.
• Consent — for example, to read your contacts, to send certain marketing messages, or where local law requires consent. You can withdraw consent at any time; this does not affect anything we did before you withdrew it.

Under India’s Digital Personal Data Protection Act, 2023, we process digital personal data on the basis of your consent, given through a notice like this one, or for the “legitimate uses” the Act allows — such as complying with a law, a court order or a request from a government authority.

7. How we share information

ⓘ We share information with those who need it to run Xpat, complete your transfers, meet the law or protect against fraud, with analytics and advertising providers as described below, and when you ask us to.

Service providers

We use service providers that process personal information on our behalf, under contracts that limit how they may use it. They include:

Our affiliates

Xpat is part of a group of affiliated companies. We may share personal information with our affiliates where reasonably necessary to provide our services, process transactions, meet KYC/AML and sanctions obligations, manage fraud and risk, provide customer support, run our technology and platform, for accounting and corporate administration, and to meet legal and regulatory obligations.

Regulated partners

We share information with the licensed partners that provide parts of the service — such as Bivo, Cybrid, Cross River Bank and our Indian payout partners — so they can open and run accounts, move money, meet their own legal obligations and resolve issues.

Your recipients and their banks

When you send money, your recipient, their bank or payment service, and the intermediaries that process the payment receive your name and the details necessary to complete the transfer, such as the amount, the purpose code and a reference. Indian rules may require additional sender details to accompany a cross-border payment. When you pay someone by phone or contribute to a Circle, the other people involved can see your name and the payment.

Merchants you pay

When you pay a merchant through Pay with Xpat, we share your name, the payment details and information needed for refunds and disputes with that merchant.

People who referred you

If you joined through a referral, the person who referred you may see that you joined and whether you qualified for a bonus. We show your name in a masked or shortened form and do not share your transaction details with them.

Authorities and law enforcement

We disclose information to regulators, tax authorities, courts, law enforcement and other government bodies in the United States, India and elsewhere where we believe in good faith that the law requires it, including suspicious activity reporting, responses to subpoenas and court orders, and tax reporting.

Fraud prevention and safety

We share information with fraud prevention networks, identity databases, other financial institutions and payment networks to detect, prevent and investigate fraud, returned payments, scams and other financial crime, and to protect the rights, property or safety of you, Xpat or others.

Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, sale of assets or bankruptcy, personal information may be transferred to the other parties as part of that transaction, subject to this policy or a policy that is at least as protective.

With your consent or at your direction

We share information in other ways when you ask us to or agree to it — for example, when you choose to connect to a third-party service such as goINRI or Rally Tax.

Sale of personal information and advertising

We do not sell personal information for money. We use analytics, attribution and advertising technologies to understand how our services are used and to measure the effectiveness of our marketing. These tools may collect online identifiers and usage information — such as device and browser details and pages visited — and disclose it to analytics, attribution and advertising providers. Some US privacy laws treat this as “sharing” or “targeted advertising” even where no money changes hands; where those laws apply, you have the rights described in this policy, including the right to opt out. We do not knowingly sell or share the personal information of anyone under 16.

8. Your choices about sharing

ⓘ Federal law lets you limit some sharing; we do not share in the ways you would be able to limit.

Financial companies choose how they share your personal information. The Gramm-Leach-Bliley Act gives consumers the right to limit some, but not all, sharing. The table below explains how Xpat shares and whether you can limit it.

We share with our affiliates only as described in “Our affiliates” above. Where applicable law gives you a right to limit affiliate sharing, we will honour it; that right does not extend to sharing needed to provide the service, process transactions, prevent fraud or comply with law. We do not currently share your information with other financial companies for joint marketing; if we do so in future, we will give you any notice and choice the law requires.

You can still opt out of receiving our own marketing messages at any time — see “Marketing messages”. Some states, such as California and Vermont, give you additional protections; where they apply, we follow them.

9. Cookies and analytics

ⓘ We use cookies and similar tools to keep you signed in, keep Xpat secure and understand how it is used, and you can limit the optional ones.

Cookies are small files stored on your device. Our website and app use cookies and similar technologies (such as local storage and software development kits) for these purposes:

Most browsers let you block or delete cookies. If you block strictly necessary cookies, parts of Xpat — including signing in — may not work. On your phone, you can reset your advertising identifier and limit tracking in your device settings.

Some browsers send a “Do Not Track” signal. Because there is no common standard for it, we do not currently respond to it. Where applicable law requires, we honour legally valid opt-out preference signals, such as Global Privacy Control (GPC), as a request to opt out of the sale or sharing of personal information.

10. Marketing messages

ⓘ You can stop marketing emails, texts and push notifications at any time, but we will still send messages about your account and transfers.

With your permission where the law requires it, we may send you news, offers and reminders about Xpat by email, SMS, WhatsApp, push notification and in-app message. You can opt out at any time:

• Email — use the unsubscribe link in any marketing email.
• SMS — reply STOP to any marketing text. Message and data rates may apply.
• WhatsApp — follow the opt-out instruction in the message or ask support.
• Push notifications — turn them off in your phone’s settings or in the app.
• Anything else — contact support and we will update your preferences.

Opting out of marketing does not stop service messages, such as one-time codes, transfer receipts, security alerts, legal notices and messages about your account. You agreed to receive these electronically in our Consent to electronic communications.

11. How long we keep information

ⓘ We keep your information while you use Xpat and for as long afterwards as the law requires — generally at least five years for financial records.

We keep personal information for as long as we need it for the purposes described in this policy, including providing our services, resolving disputes, enforcing our agreements and meeting legal, tax, accounting and regulatory requirements.

As a financial services company, we are required by the Bank Secrecy Act to keep records of identity verification and transactions for at least five years, and other laws (including tax law and the Remittance Transfer Rule) set their own record-keeping periods. Because of this, closing your account does not mean we can delete all of your information straight away. We may also keep information longer when it is needed for a legal claim, an investigation or a regulator’s request.

As a general guide:

• Identity verification, KYC and AML records: generally at least 5 years, or longer where required by law, regulators, our banking and payment partners, an investigation or a legal hold.
• Transaction and payment records: generally at least 5 years, or the applicable legal or regulatory retention period.
• Account and profile information: for as long as you have an account, and afterwards for as long as reasonably necessary for legal, regulatory, fraud-prevention, dispute and record-keeping purposes.
• Customer support chats and emails: generally 5 years, unless a longer period is reasonably necessary for a dispute, investigation, litigation or regulatory requirement.
• Marketing information: until you withdraw consent or opt out, or the information is no longer reasonably necessary, unless the law permits or requires us to keep it.
• Analytics information: according to the retention period we configure and the settings of the relevant analytics provider, subject to applicable law.
• Biometric information: Xpat does not independently keep biometric templates. Any biometric processing and retention by Persona or HyperVerge is subject to applicable law and our arrangements with those providers.
• Legal and compliance records: for as long as reasonably necessary to comply with the law, respond to investigations, prevent fraud, resolve disputes or meet legal-hold requirements.

When information is no longer reasonably necessary, we delete, anonymise or de-identify it, except where the law requires or permits us to keep it. Information processed by our partners and verification providers is also kept according to their own retention policies.

12. How we protect information

ⓘ We use encryption, access controls and one-time codes to protect your information, and you can help by keeping your phone and codes safe.

We use administrative, technical and physical safeguards designed to protect personal information, including:

• encryption in transit, and encryption at rest where appropriate;
• access controls so that only people who need information to do their job can see it, with access logged;
• one-time codes for sensitive actions such as withdrawals, Pay by phone and closing your account;
• masking of your SSN, which is always fully hidden after you enter it;
• no self-service changes to your mobile number or email — our support team makes these changes after checking it is really you;
• not offering downloads of your identity documents, which are shown only as verified;
• monitoring for unusual activity, and contracts that require our service providers to protect information.

No system is completely secure. Please protect your phone, never share a one-time code with anyone — Xpat will never ask you for one — and contact us straight away at support@xpat.money or +1 866-421-4888 if you think your account has been compromised. If a security breach affects your personal information, we will notify you and the authorities where the law requires.

13. International transfers of information

ⓘ Your information is handled mainly in the United States and India, and we protect it wherever it goes.

Xpat serves customers who move money between the United States and India. Your information is stored and processed mainly in the United States, and is transferred to India when that is needed to deliver a transfer, verify Indian identity documents, provide support or meet Indian legal and tax requirements. Some service providers may process information in other countries.

These countries may have data protection laws that differ from those where you live. Whenever we transfer personal information, we protect it as described in this policy, including through contracts with our service providers and partners that require appropriate safeguards. We will not transfer personal data from India to any country that the Government of India restricts under the Digital Personal Data Protection Act, 2023.

14. US state privacy rights

ⓘ If you live in California or another state with a privacy law, you can ask to know, correct or delete your information, and we will not treat you differently for asking.

This section applies to residents of California and, where their laws apply to us, residents of other US states with consumer privacy laws. It supplements the rest of this policy.

Information covered by financial privacy laws

Much of the information we collect to provide financial services is covered by the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act, and is exempt from the California Consumer Privacy Act (CCPA) and many other state privacy laws. This section applies to the personal information that is not exempt — for example, information about website visitors, marketing and some device data.

Categories of personal information

In the last 12 months we have collected the following categories of personal information, as described in “Information we collect”, from the sources in “Where we get information”, for the purposes in “How we use information”:

We do not sell personal information or share it for cross-context behavioural advertising. We use sensitive personal information only for purposes the CCPA permits — such as providing the services you request, verifying your identity, security, fraud prevention and meeting legal obligations — so the right to limit its use does not currently apply. If that changes, we will tell you and offer a way to limit it. We keep each category for the periods described in “How long we keep information”.

Your rights

• Right to know and access — the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to.
• Right to delete — personal information we collected from you, subject to legal exceptions (for example, records we must keep under the Bank Secrecy Act).
• Right to correct — inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of.
• Right to limit use of sensitive personal information — as explained above.
• Right to non-discrimination — we will not deny you service, charge you a different price or give you a different quality of service because you exercised your privacy rights.

Verification, agents and timing

To protect you, we verify your identity before acting on a request, usually by matching information you give us with information we hold, or by asking you to confirm a one-time code sent to your registered mobile number or email. You may use an authorized agent to make a request for you; we will ask for proof that you gave the agent signed permission, and we may ask you to verify your identity directly.

We will confirm that we received your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you why and may extend this by a further 45 days. If we cannot meet your request, we will explain why. Residents of states that give a right to appeal a decision can appeal by replying to our response or contacting us using the details below.

Shine the Light

California residents may ask whether we disclosed personal information to third parties for their own direct marketing in the previous year. We do not make these disclosures.

15. Rights for people in India

ⓘ If India’s data protection law applies to you, you can access, correct and erase your data, nominate someone to act for you, and complain to our Grievance Officer.

If we process your digital personal data in India, or in connection with offering services to you in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules give you, as a “Data Principal”, the following rights:

• Access — a summary of the personal data we process about you and how we process it, and the identities of other Data Fiduciaries and Data Processors we have shared it with, together with a description of what was shared.
• Correction, completion and updating — of inaccurate, incomplete or out-of-date personal data.
• Erasure — of personal data that is no longer needed for the purpose it was collected for, unless the law requires us to keep it.
• Withdrawal of consent — where we rely on your consent, as easily as you gave it. Withdrawal does not affect processing done before it, and we may be unable to continue some services without the data.
• Grievance redressal — a response from our Grievance Officer to any complaint about how we handle your personal data.
• Nomination — to nominate another person to exercise your rights if you die or become unable to do so.

When you exercise these rights, you also have duties under the DPDP Act — for example, not to impersonate anyone and not to give false information or file frivolous complaints.

Grievance Officer

You can contact our Grievance Officer using the details in “Contact us” below. We aim to acknowledge and respond to privacy grievances within 15 business days and, in all cases, within the period required by applicable law. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.

16. How to exercise your rights

ⓘ Email or call us, and we will verify it is you and respond within the time the law allows.

To make a privacy request — whether under a US state law, the DPDP Act or another law that applies to you — contact us:

• Email: privacy@xpat.money or support@xpat.money
• Phone: +1 866-421-4888
• In-app chat: tell our support team you want to make a privacy request

Please tell us which right you want to exercise and which law applies. You can also update some information yourself in the app. For your security, changes to your mobile number or email address are made only by our support team after checking your identity.

Making a request is free. We may decline a request, or charge a reasonable fee where the law allows, if it is manifestly unfounded, excessive or repetitive. We may also be unable to delete or change information we are legally required to keep.

17. Children

ⓘ Xpat is only for adults aged 18 or over, and we do not knowingly collect information about children.

Xpat is not intended for anyone under 18, and you must be at least 18 to open an account. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it unless the law requires us to keep it.

If you give us information about a child — for example as a recipient — you confirm that you are their parent or guardian or have their parent’s or guardian’s permission. Where the DPDP Act applies, we do not process a child’s personal data without verifiable consent from their parent or lawful guardian.

18. Changes to this policy

ⓘ We will update this policy when our practices change and tell you about important changes before they take effect.

We may update this policy from time to time. The date at the top shows when it was last changed. If we make a material change, we will tell you before it takes effect — for example, by email, by a message in the app or by a notice on our website — and, where the law requires, ask for your consent.

19. Contact us

ⓘ Reach us by email, phone, WhatsApp or in-app chat with any privacy question.

If you have a question or complaint about this policy or how we handle your personal information, contact us:

• Remit2Any Inc., 3206 93rd Pl SE, Everett, WA 98208, United States
• Email: privacy@xpat.money, support@xpat.money or help@xpat.money
• Phone: +1 866-421-4888
• WhatsApp: +1 555-704-7061
• In-app chat
• India Grievance Officer: grievance@xpat.money

Our partners have their own privacy contacts. For questions about the Cash Plus Account, you can also refer to Bivo’s Privacy Policy, and for other partners see Licenses & partners.