Privacy policy

Covers luckydogstrading.com, the user area and the Lucky Dogs Link program.

Who we are

The data controller is Lucky Dogs Trading Systems. For any privacy matter, write to [email protected].

The short version

• No ads, tracking pixels or visitor analytics. Fonts are served by the website itself.
• If you only browse, you get no cookie from us, unless you pick a language in the selector.
• Data is stored on a server in the United States.
• We do not sell or rent data.
• Our EAs are sold on the MQL5 Market, run by MetaQuotes. The website does not process payments and exchanges no data with MetaQuotes.

What data we process, and why

Visiting the website. Your IP address, browser and the pages you request pass through Cloudflare to our server. The country inferred from the IP only sets the language and is not stored. Legal basis: legitimate interest in security and operation (LGPD art. 7, IX; GDPR art. 6(1)(f)).

Access log. When you sign in (or try), sign out or open the user area, we record date and time (UTC), IP, user, event and browser (user-agent). Brazilian law (Marco Civil da Internet, art. 15) requires us to keep these records for 6 months, confidentially, disclosed only under a court order. Legal basis: legal obligation (LGPD art. 7, II); for the browser, and in the European Union, legitimate interest in security (GDPR art. 6(1)(f)).

User area. A closed pilot: we create each account. We store your name, email, password (as a hash only), whether the account is active, and the creation and last sign-in dates. Legal basis: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).

Lucky Dogs Link. To copy the signal, the program reads the MetaTrader 5 terminals open on your PC and sends our service:

• your computer's Windows name and the Link version;
• for each account: number (login), server, broker and whether it is demo or real;
• balance, currency and open positions (ticket, symbol, side, volume, price, stop, target), including those that did not come from the signal;
• the result of each order it executes;
• MetaTrader's use of Windows graphics resources (to warn before it freezes);
• if it cannot read an account, a diagnostic: the MetaTrader folder (which may include your Windows user name), version, options, journal excerpts and its configuration, with login, password, proxy and email masked before leaving your PC.

The Link never asks for, reads or sends your broker account password: it uses the MetaTrader already logged in. Of your licence key, we keep only a hash and the last 4 characters. Your PC keeps the access token, encrypted by Windows, and a local log of up to 25 MB that is never sent. Legal basis: performance of a contract.

"Notify me when it opens". On the signal page, your email gets a single notice when the signal opens, with no offer. Legal basis: your request, before entering into a contract (LGPD art. 7, V; GDPR art. 6(1)(b)); cancel whenever you like. The news checkbox beside it is unticked and optional.

Published results. They show only Lucky Dogs' own accounts, read with an investor password that is never published. Client accounts never appear.

News emails

We do not send news yet. When we do:

• Tick the box "I want to receive news from Lucky Dogs" to get news. Legal basis: consent (LGPD art. 7, I; GDPR art. 6(1)(a)). We keep the proof: the text you saw, the date, time and IP.
• Clients may get emails about Lucky Dogs products similar to theirs, on legitimate interest (LGPD art. 7, IX and art. 10; GDPR art. 6(1)(f)). In the European Union, only if you bought from us and did not opt out at purchase (Directive 2002/58/EC, art. 13(2)); everyone else only through the checkbox.
• We use only name and email; Link data never decides what we offer, and your email never goes to third parties.
• Every email has a one-click unsubscribe; you can object at any time, without giving a reason (GDPR art. 21).

Cookies

cookie	purpose	lifetime
ld_lang	remembers the language you picked in the selector	1 year
ld_sessao	keeps you signed in (signed, httpOnly, SameSite=Strict)	12 hours, or until you sign out

Cloudflare may set technical anti-bot cookies (such as __cf_bm). There are no advertising or analytics cookies, so there is no banner.

Who we share data with

• Cloudflare: DNS, proxy and protection for all website and Link traffic.
• Hostinger: server (VPS) in Boston, United States, hosting the website, service and database.
• Telegram: operational alerts to the administrator, which may mention an account's number and server.
• Amazon Web Services (SES): will send the "Notify me" and news emails.
• Authorities: only when the law requires it.

In the dashboard, the administrator sees the connected accounts and the access log, to operate, support users and comply with the law.

International transfers

Data is stored in the United States, outside Brazil and the European Economic Area.

• User area, Link, access log and "Notify me": the transfer is necessary for the service you asked for and for the legal obligation (LGPD art. 33, IX).
• For news, the form states next to the checkbox that your email is stored in the United States (LGPD art. 33, VIII).
• Hostinger, Cloudflare and AWS process data on our behalf under the data processing agreements in their terms, which include the European Commission's standard contractual clauses (GDPR art. 46(2)(c)). Telegram offers no such agreement for bots.

Ask for a copy of these safeguards at [email protected].

How long we keep data

data	period
IP of sign-in attempts	15 minutes, in memory only
balance, positions and diagnostics	in memory only; each reading replaces the previous one
access log	6 months, even after the account is deleted
user area access	while the account exists (deactivating blocks, it does not delete)
MetaTrader accounts, PCs and keys	until removed in the dashboard or the account is deleted
orders, results and subscriptions	while the account exists; then restricted up to 5 years, only for defence in a dispute
"Notify me" email	up to 30 days after the notice, or until you cancel
news email	until you unsubscribe; then only as a hash on a block list
proof of consent	5 years after you withdraw it
record of the account deletion	5 years, with the email only as a hash

If MetaTrader stays open with the Link running, a removed account comes back, paused. Aggregate figures that identify no one may be kept for statistics.

Deleting your account

Write to [email protected], preferably from your registered email. Within 15 days we revoke your PCs (the Link stops copying and sending data) and delete your MetaTrader accounts, PCs, user area access, "Notify me" and news entries; key hashes stay, unlinked from you. Only what the table lists after deletion remains.

Positions opened by the Link stay in your broker account, unmanaged. The token and the log stay on your PC: uninstall the Link and delete its folder.

Security

• HTTPS from your browser and from the Link to the server; Link updates are signed and verified.
• Passwords, keys and tokens stored as hashes only; the administrator also signs in with an authenticator app.
• Signed session cookie, ended on password change or deactivation; at most 5 sign-in attempts per IP every 15 minutes.
• The website has no direct access to MetaTrader account data, which only flows through the authenticated API.

If an incident may put you at risk, we notify you and Brazil's authority (ANPD), as the law requires.

Your rights

Under the LGPD (art. 18) and the GDPR, you can ask for: confirmation of processing, access, correction, anonymisation, restriction or erasure, portability, the list of who we share data with, objection, and withdrawal of consent.

Write to [email protected], preferably from your registered email. We reply within 15 days. You can also complain to the ANPD or, in the European Union, to your country's data protection authority.

Children

The website and products are for adults (18+). If we find data about a minor, we delete it.

Changes to this policy

When it changes, we update the date at the top. Changes in purpose or sharing are announced to account holders before they take effect.