Their private key is stored in a normal database I suppose. But yes, you should use exchanges only for trading. They are not supposed to keep you coins. So be careful and keep your coins in wallet.