Privacy Policy
Last updated: 1 November 2026
1. Who we are
MyPropGuard is operated by Tickwire Labs, based in Ibadan, Oyo State, Nigeria. Tickwire Labs decides how and why your personal data is used, so it is the data controller under the Nigeria Data Protection Act 2023 (NDPA). "We" and "us" in this policy mean Tickwire Labs.
Contact for anything in this policy: support@mypropguard.io
2. What we collect
- Account data - email address, username, country, and a hashed password (no password if you only use Google sign-in).
- Google sign-in - if you sign in with Google, Google gives us your Google account ID, your verified email address and your name. We use the name as your username unless you change it.
- MT5 connection data - account login, broker server name, and the account password you provide, stored encrypted and used only to run monitoring and enforcement.
- Trading data - balance, equity, positions, orders and trades from your connected accounts, plus the rule breaches, locks and closes the guard records. Used to evaluate your rules and shown back to you in the dashboard.
- Security and device data - the IP address and browser (user agent) of each sign-in, sign-up, password reset and other sensitive action, kept in an audit log, and the IP address and browser of each signed-in device. If you connect Telegram, each new sign-in sends you an alert showing the IP address it came from.
- Notification data - your Telegram chat ID if you connect Telegram alerts, and a history of the emails and Telegram messages we sent you.
- Billing records - your plan, billing interval, the customer and subscription identifiers issued by our payment provider, each payment's amount and date, and any discount or partner code you used. We keep these so your account history and any refund or commission can be reconciled.
- Partner data - if you join the partner programme: your name, email, commission rate, payout details you give us, and the commission ledger tied to your code. Referred traders are recorded against your code by an internal identifier. You see each referral only as a masked email (the first two letters and the domain, such as al***@gmail.com), with their plan, status and the amount and date of each payment.
- Waitlist sign-ups - if you joined the waitlist before launch: your email address and, if you gave them, your first name, last name and country. We send one confirmation email and contact you about the launch.
3. What we never collect
We never see or store your card details. Payments are processed entirely by our payment provider; we receive only confirmation that a payment succeeded, the amount, which plan it was for and whether a discount code was applied.
4. Why we use it, and our lawful basis
The NDPA requires a lawful basis for each use of personal data. We do not sell personal data or use it for third-party advertising.
| Purpose | Lawful basis |
|---|---|
| Creating your account, signing you in (including with Google), and account emails such as verification and password reset | Contract - needed to provide the service you signed up for |
| Connecting your MT5 accounts, monitoring them and enforcing your rules | Contract |
| Sending the email and Telegram alerts you set up | Contract (Telegram only once you connect it) |
| Taking payments, applying discount codes, handling refunds | Contract |
| Keeping billing and tax records after the payment | Legal obligation |
| Calculating partner commission and showing partners their masked referrals | Contract with the partner, and our legitimate interest in running the programme fairly |
| Audit log, IP address and browser records, new sign-in alerts, detecting misuse | Legitimate interest in keeping your account and our service secure |
| Waitlist confirmation and launch announcement | Consent - given when you joined; you can withdraw it at any time |
5. Automated decisions
MyPropGuard acts on its own. When an account breaks one of the rules you set, the guard can close positions and lock trading on that account until the next trading day, without a person reviewing it first. These decisions use only your trading data and the rules you chose. They are the service you signed up for, so the lawful basis is contract (NDPA section 37).
You stay in control:
- You choose the rules, and whether a breach locks the account.
- You can change or remove rules and disconnect accounts, except that rules are frozen while an account is locked and once trading has started that day when the lock is on. This stops the guard from being switched off in the moment it is meant to protect you. The freeze ends at the daily reset (midnight New York time).
- You have the right to object to automated decisions and to ask a person to review one. Email support@mypropguard.io and we will look at what happened and explain it. We cannot reopen a closed trade.
6. Who we share it with
We use these providers (subprocessors). Each receives only what it needs to do its job.
| Provider | What it does | What it gets |
|---|---|---|
| FxSocket | Hosts the MT5 terminal connection for each account you connect, and carries out closes | MT5 login, password and broker server; the account's balance, equity, positions, orders and trades |
| Whop | Checkout, subscriptions and payments | Your email, the card details you enter on its checkout (we never see them), plan, price and any discount code |
| Resend | Sends our emails | Your email address and the content of each email (account emails, alerts, waitlist confirmation) |
| Telegram | Delivers Telegram alerts, if you connect them | Your Telegram chat ID and each alert's content, which can include trade details and the IP address of a new sign-in |
| Google sign-in, if you use it | Google confirms your identity to us; its sign-in button loads on our sign-in and sign-up pages | |
| Cloudflare Turnstile | Bot check on sign-in, sign-up and password reset | Your IP address and browser details |
| Fly.io | Hosts our website, API, database and its backups | All the data described in this policy, stored there, and your IP address, browser and the requests you make, in transit |
7. Transfers outside Nigeria
These providers store or process data outside Nigeria. Under NDPA sections 41 to 43, we transfer personal data abroad only where it is needed to provide the service you signed up for, each provider gets only the data listed above, and data travels to them over encrypted (TLS) connections. If you want to know more about a particular transfer, ask us.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data and Google sign-in details | While your account exists |
| MT5 password | While the MT5 account is in your dashboard. Cancelling your plan disconnects the account but keeps the encrypted password, so you can reconnect without re-entering it. Removing the MT5 account, or deleting your account, deletes the password. If you cancel and want it gone straight away, remove the account or ask us. |
| MT5 login, broker and enforcement history (breaches, locks, closes) | Until you delete your account |
| Trade action logs for an MT5 account | Until you remove that MT5 account or delete your account |
| Audit log, including IP address and browser | Until you delete your account |
| Signed-in device records (IP address and browser) | A session expires 7 days after last use. Its record is cleared when you sign out of that device, the next time you sign in after it has expired, or when you delete your account |
| Notification history and Telegram chat ID | Until you delete your account (the chat ID also goes when you disconnect Telegram) |
| Billing records | Kept after the payment for 6 years, as tax and accounting law requires, including after you delete your account (with your email and name removed) |
| Partner data | While you are a partner, then as billing records |
| Waitlist sign-ups | Until you ask us to remove you, and no longer than 12 months after launch |
You can delete your account from settings. Your connected MT5 accounts are disconnected and your personal data is deleted. Where billing records must be kept, your account is anonymised instead: your email, name, passwords and contact handles are removed.
9. Security
MT5 passwords are encrypted at rest, transport is TLS, access to production systems is restricted, and every sensitive action is written to an audit trail.
10. Your rights
Under the NDPA you can:
- get a copy of your personal data, and have it in a format you can move elsewhere;
- correct data that is wrong;
- have your data deleted, or ask us to restrict how we use it;
- object to how we use it, including the automated decisions in section 5;
- withdraw consent where we rely on it (such as the waitlist), without affecting what we did before.
Most of this you can do from the dashboard. "Download my data" in settings gives you your account, MT5 accounts, rules, rule breaches, billing, notifications, security log and signed-in devices. Partner data and waitlist sign-ups are not in that download; email us and we will send them. For anything else, email support@mypropguard.io. Depending on where you live you may have additional statutory rights (e.g. under the GDPR), which we honour.
If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. We would like the chance to put it right first, so please contact us too.
11. Changes
If we change this policy materially we will tell you by email or in the dashboard before the change takes effect.
12. Contact
Privacy questions: support@mypropguard.io