Privacy Policy

Who is responsible for your data

MT Trading is the data controller.

Write to support@mttrading.io, or from the support page inside the platform, and a person answers.

This policy covers mttrading.io in its English edition and our apps.

What we collect

Account data: your name and email address, and your password stored hashed — we cannot read it and cannot recover it. If you sign in with Google, Apple or Telegram we receive your identifier with that provider, your name, and your email address where the provider gives it.

Optional data you add yourself: your photo, your bio, your country, your @username, your Telegram username, and your trading account number if you enter one for copy trading.

Your learning activity: which courses you are enrolled in, your progress through the lessons, your notes, quiz attempts, certificates, and the questions and reviews you post.

Your community activity: your messages in rooms and direct chats, your reactions, your room memberships, your last-seen time, and the list of members you have blocked.

Payments: the invoice amount and currency, and the rail it was paid on. For a card payment, Whop holds the card details — we never see or store a card number. For crypto we store the network, the wallet address and the transaction hash. For a bank transfer through support, the sender name and reference you give us.

The consent you give at checkout to immediate access, with the moment you gave it. That record is what shows you were asked before your access was opened.

Basic technical data: your device type and operating system so notifications can be delivered, and the push token if you turn notifications on.

Why we collect it, and the legal basis

To deliver what you bought — opening courses, channels and live sessions, saving your progress, issuing your certificate. Legal basis: performance of our contract with you, GDPR Article 6(1)(b).

To run the community — delivering your messages to their room, showing your status to members according to your own settings, and keeping anyone you blocked from writing to you. Contract again.

To confirm a payment, activate access, and keep the accounting record behind the invoice. Contract, and our legal obligation under bookkeeping law, Article 6(1)(c).

To protect paid content — the watermark on the video and the signed links that expire. Our legitimate interest in not having the work taken, Article 6(1)(f).

To send you notifications you asked for — a session starting, an answer to your question, a subscription about to end. Your consent, Article 6(1)(a), which you can withdraw in your profile or in your device settings.

To see how the site is used — Google Analytics counts visits and the pages that are read. Your consent, Article 6(1)(a), given or refused in the cookie banner and changed at any time from Cookie settings in the footer.

We do not sell your data, we do not use it for third-party advertising, and we do not build marketing profiles from it that leave the platform.

Who processes it for us

Only the providers the platform runs on, and each only as far as it needs:

Whop — card payments. Whop is the payment processor and holds the card data; we do not.

DigitalOcean — our servers and the object storage the files live in (DigitalOcean Spaces).

Resend — the email we send and the email you send us.

Expo, Apple and Google — push notifications to your device.

Google, Apple and Telegram — signing in, when you choose one of them.

Telegram — our own bot, once you link your account, so it can add you to the paid channels you bought and remove you when a subscription ends.

Zoom for the live sessions, and LiveKit — self-hosted on our own server — for the voice rooms, when they are enabled.

The community assistant — questions sent to it are processed by an AI service to answer them; only the text of your question is sent, never your identity.

Google — Google Analytics, for aggregate usage statistics, and only if you accept it in the cookie banner.

Authorities, where the law requires it. Beyond that, we share your data with nobody.

Where it is stored, and how long we keep it

On servers operated by DigitalOcean in the European Union, and the files in DigitalOcean's object storage.

Some of the providers above are established outside the EU and the EEA. Where your data reaches them it travels under the safeguards the GDPR requires — the European Commission's standard contractual clauses, or an adequacy decision where one covers the transfer.

Your account data stays for as long as your account does.

Invoice records are kept for as long as bookkeeping law requires, and are stripped of your personal details when you delete your account.

Course videos hosted by us are protected: served through links that expire and, once processed, stored encrypted; every stream carries a watermark naming your account.

Lessons that play from YouTube or Vimeo are served by those platforms, under their own terms.

Your rights

Access and portability: ask us for a copy of everything we hold about you, and we answer within a month.

Correction: change your own details on the profile page at any time.

Erasure: delete your account yourself, from Profile → Delete account, in the site or the app. Your personal data, your messages and your progress are erased and cannot be brought back; the invoice record stays, stripped of your identity, because bookkeeping law requires it.

Restriction and objection: tell us and we stop the processing you object to, unless the law requires us to continue.

Withdrawing consent: analytics from Cookie settings in the footer, notification types in your profile, read receipts and last-seen in the community settings. Withdrawing consent never affects what was done before it.

Complaints

If you think we have handled your data wrongly, tell us first at support@mttrading.io.

You also have the right to complain to the data protection authority in the country you live in.

What we store in your browser

A session cookie that keeps you signed in, and a cookie that remembers whether you chose the Arabic or the English edition. Both are necessary for the site to do what you asked it to.

Preference cookies: the theme you picked, and the prompts you have dismissed, so we stop asking.

Short-lived cookies that carry a sign-in through Google, Apple or Telegram and back again. They are set when you start and cleared when you arrive.

A referral cookie, kept for 30 days, if you arrive through an affiliate's link. It records which affiliate sent you, so a commission can be attributed, and the click itself is stored with a one-way hash of your IP address — not the address.

Google Analytics cookies, only if you accept them in the cookie banner, to count visits and see which pages are read. Until you accept, nothing from Google loads. They do not identify you to us, and the IP address Google sees is anonymized.

A cookie that remembers your answer to the cookie banner for 12 months, so we do not ask on every visit. You can change your answer at any time from Cookie settings in the footer; withdrawing stops Google Analytics at once and removes its cookies.

Lessons that play from YouTube or Vimeo load those platforms' players, which set their own cookies under their own policies.

None of the cookies we set are advertising cookies, and we sell nothing that any of them record.

Social media accounts we connect

Our team connects MT Trading's own accounts on YouTube, TikTok, Instagram, Facebook, Threads, X and LinkedIn, so we can publish our own videos and posts and see how they perform. We never connect to, read or post on a member's personal social media accounts.

For each connected account we keep: the access token the platform issues to us, stored encrypted; the account's id, name and picture; and the statistics the platform reports for our posts, such as views, likes, comments and shares. We use them only to publish what our team has approved and to show our team how those posts did. We do not sell this data or share it with anyone else.

Disconnecting an account in our studio deletes its tokens. A platform's own settings can also revoke our access at any time. To ask us to delete data we received from one of these platforms, contact us through the support page.

Children

The platform is for people aged 18 and over. We do not create accounts for anyone younger, and if we learn of one we delete it.

Changes to this policy

If we change something material we tell you inside the platform before it takes effect. The date at the top of this page is when it last changed.