Privacy Policy

"We", "us" and "Pepperstone AI" mean the Pepperstone AI technology platform operated for Australian clients. "Personal information" is information about an identified or reasonably identifiable person. "Processing" covers collecting, holding, using and disclosing that information. "Client" is a registered user of the platform, whether or not the account has been funded.

Registration collects your first name, last name, email address and phone number. Verification, where you complete it, adds your date of birth, residential address, identity document details and a selfie or liveness capture. Account use adds deposit and withdrawal records, trading activity, and correspondence with our team. Support enquiries collect the content of your messages.

Like most websites we receive technical data: IP address, browser type and version, device type, referring page, and the pages and features you use, with timestamps. This arrives in server logs and helps us keep the service secure, diagnose faults and understand which features clients actually use.

We use a small number of first-party cookies and similar technologies: a session cookie that keeps you signed in, a security cookie that supports protection against automated abuse, and preference storage. Analytics may be enabled by the site operator through a dedicated slot; if so, it measures aggregate use, never your identity. You can block or delete cookies in your browser; the site will still work, you may just need to sign in again.

We do not sell personal information. We disclose it only to: service providers listed above; third parties involved in servicing your account, such as payment providers and execution venues, to the extent they need it; and regulators, law-enforcement bodies or courts where the law compels us. Where a provider processes data outside Australia, we require contractual protections for the transfer.

Personal information is encrypted in transit and at rest, access is limited to staff who need it to support accounts, and systems are monitored for unauthorised access. Accounts themselves carry the protections described on the security page, including two-factor authentication and login alerts. If a data breach is likely to cause serious harm, affected clients will be notified directly, as Australian law requires.

You may ask to access the personal information we hold about you, ask us to correct it, request deletion where no legal obligation requires retention, restrict or object to certain processing, and withdraw marketing consent at any time. Requests go to [email protected] and are answered within a reasonable period, normally within 30 days. We may ask you to verify your identity before acting, to protect your own data.

Where the site operator enables an analytics service, it reports aggregate usage statistics. We do not use your personal information to build advertising profiles, and we do not sell it to advertisers. If retargeting tools are ever added, they will run only with the consent mechanisms available in your browser.