Last updated: 25 October 2026
Version: 1.0
This policy explains what personal data Wavqu collects, why, who we share it with, how long we keep it, and your rights. It is written to meet applicable data protection law.
1. Who we are
The "controller" of your data is Wavqu. "Controller" means we decide how and why your data is used.
For any privacy question, email support@wavqu.com.
2. The data we collect
2.1 Data you give us
| Data | When |
|---|---|
| Email address | When you sign up |
| Password | When you sign up. We store only a scrambled version (a "hash") that cannot be turned back into your password. We never see or store your password in readable form. |
| MT4 account number | When you link your MT4 account, and each time you change it |
| Plan choice (plan, and monthly, six-month or annual billing) | When you choose a plan |
| Messages you send us | When you contact support |
We never ask for, collect or store your MT4 password, your broker login, or your broker account password. Never give these to anyone claiming to be from Wavqu. This also applies during assisted setup (section 2.6).
2.2 Data the Wavqu EA sends from your MT4 account
Each time the EA checks in with our server, it sends:
- your MT4 account number and licence key;
- your account balance, equity and account currency;
- current BTCUSD prices and some indicator values the strategy needs;
- the time on your broker's server;
- details of trades that Wavqu has open (ticket number, buy or sell, size, open price and time, take-profit, current profit or loss);
- the version of the EA.
The EA also sends details of closed trades, trade by trade: ticket number, symbol, buy or sell, size, open and close times and prices, commission, swap, profit, the "magic number" that shows which program placed the trade, and the trade comment. It also sends the date of the oldest entry in MT4's history list and how many entries there are.
To check your plan's deposit limit, the EA also sends the deposits and withdrawals in MT4's history list (amount, date and time) and the realised result of the account's closed trades. We use these to work out your capital at risk, and to check that the EA is reporting your funding reliably. On Starter, Standard and Pro, new baskets pause while it is not. We collect the same history on the Ultimate plan, which has no deposit limit. We keep it so that the right limit can be checked if you move to another plan.
In detail: for each deposit, withdrawal or credit entry in MT4's history list, the EA sends the ticket number, the entry type (balance or credit), the time, the amount, the comment (up to 64 characters) and the magic number. The realised result is not sent as a total. It is worked out by our server from the closed trades above, which cover every closed trade on the account, not only Wavqu's, because the deposit limit depends on the whole account's realised result. Your dashboard figures use only Wavqu's trades.
The EA does not send details of open trades you place yourself or that other programs have open. Closed trades of every kind are sent, as explained above.
2.3 Payment data
- Card payments. Stripe collects your card details directly. We never see or store your full card number. We receive and store your Stripe customer and subscription references, your plan, payment status, renewal date and invoice records.
- Crypto payments. We take Bitcoin payments through BTCPay Server, payment software that runs on Wavqu's own infrastructure. This means Wavqu, not a third party, processes your Bitcoin payment data. Our customer database stores the invoice reference, amount, currency, status and dates. Our BTCPay Server also records the Bitcoin address each invoice is paid to and the transaction ID of each payment, as it receives them from the Bitcoin network. It does not record the address you paid from unless the Bitcoin network reports it as part of the transaction.
- Bitcoin is public. Every Bitcoin payment is recorded on the public Bitcoin blockchain. Anyone can see it. We cannot change or delete that record.
- Payment exceptions. If a crypto payment does not match its invoice (for example an overpayment or a late payment), we keep a record of it, our review and the outcome. This includes any refund address you give us.
2.4 Technical data
When you use our website or the EA contacts our server, our systems record technical data such as your IP address, the time of the request and the page or address requested. We use this to keep the service secure, for example to limit repeated login attempts.
In detail: our application logs one line per request with your IP address, the time, the request (method and path) and the response status, plus error messages. Licence keys, one-time links and other secrets are removed before a line is written. Our web server (Caddy) does not keep a separate access log. The hosting provider's own monitoring of the server does not see request contents. Security events on your account (for example a login, a password change or a two-factor change) are recorded with the event type, your account and the time only, with no IP address.
2.5 Data we create
- Your licence key.
- Your subscription status and history, including plan changes and account-number changes.
- Records of each check-in, including whether it was accepted or blocked and why.
- Records of support and admin actions on your account, such as an extension or suspension, with the reason.
- Your capital at risk, available deposit allowance and deposit-limit eligibility status (for example within the limit, over the limit or unverified), and the reason if the EA cannot report your funding (for example an outdated EA, or history not yet reported or incomplete).
2.6 Assisted setup
If you choose optional assisted setup, we process:
- booking details, such as your account email, how to reach you and your preferred session time;
- session notes, such as what we installed and configured, and any problems found.
During the session, our support person can see your screen through TeamViewer. We do not collect credentials. You type any broker passwords and security codes yourself. Session notes never include passwords, security codes, seed phrases or private keys. We never store TeamViewer passwords.
We do not record sessions. The only records we keep are the booking details and the short notes our support person writes when the session is scheduled and when it is completed. TeamViewer's software keeps its own connection log on each device under TeamViewer's own policy; we do not collect that log.
3. Why we use your data and our lawful basis
The law says we must have a "lawful basis" for each use of your data.
| What we do | Data used | Lawful basis |
|---|---|---|
| Create and run your account, let you log in | Email, password hash | Contract: we need it to provide the service you signed up for |
| Check your licence, account number and deposit limit, and send trading instructions | Account number, licence key, balance, equity, deposit, withdrawal and closed-trade history, prices, open trades | Contract |
| Book and deliver optional assisted setup | Booking details, session notes, account data | Contract |
| Take payment, manage renewals and review crypto payment exceptions | Payment and subscription data | Contract |
| Show you your dashboard figures | Balance and equity snapshots, closed-trade history | Contract |
| Send service emails (verification, password reset, payment problems, renewal and plan changes, important changes to the service or terms) | Contract | |
| Answer support requests | Email, messages, account data | Contract, and our legitimate interest in helping customers |
| Keep the service secure, stop abuse and fraud, limit repeated login attempts | Technical data, check-in records | Legitimate interests: protecting our customers and our systems |
| Find and fix faults, and improve the strategy and service | Check-in records, snapshots, trade history | Legitimate interests: running a reliable service. We do not use your trading data for strategy research unless it has first been anonymised and aggregated, so that it no longer identifies you or your account. If we ever plan to do that, we will update this policy and tell you first. |
| Keep financial and tax records | Payment and invoice records | Legal obligation |
| Deal with legal claims | Any relevant data | Legitimate interests: protecting our legal rights |
Where we rely on legitimate interests, we have weighed our interests against yours. You can ask us for details.
If you do not give us the data we need under "Contract", we cannot provide Wavqu to you.
Automated decisions
Our server automatically decides whether to send trading instructions. It does this by checking your subscription status, linked account number and deposit limit, and whether the EA is reporting your funding history reliably. This is how the service you signed up for works. These checks do not make decisions about you that have legal or similarly significant effects. If you think a check has been applied wrongly, contact us and a person will look at it.
4. Who we share your data with
We do not sell your data.
We share it only with service providers who help us run Wavqu ("processors"). They may only use your data on our instructions.
| Provider | What they do | Where |
|---|---|---|
| Stripe | Card payments and subscriptions | Stripe, Inc. (United States) and its affiliates, including Stripe Payments Europe, Ltd. (Ireland). Data is processed in the United States and Europe. |
| Resend | Sending service emails (verification, password reset, payment and security notices) | Resend, Inc. (United States) |
| Contabo | Hosting our website, server and database on a Linux server, and automatic backups of that server | Contabo GmbH (Germany). Our server is in Europe. |
| Contabo | Hosting our own BTCPay Server, on a separate server at the same provider | Contabo GmbH (Germany). Server in Europe. |
| Namecheap Private Email | Hosting the support@wavqu.com mailbox, where your support messages are kept | Namecheap, Inc. (United States) |
| TeamViewer | Remote connection for optional assisted setup sessions | TeamViewer Germany GmbH (Germany) |
Stripe is also a controller of some data in its own right, for example to meet anti-money-laundering rules. Stripe's own privacy policy applies to that.
If you use assisted setup, you run TeamViewer on your own device. TeamViewer is a separate controller of the connection data its software processes (such as the TeamViewer IDs, the connection times and the IP addresses of the two devices). It processes that data under its own privacy terms, which apply to its software. Wavqu does not record sessions and keeps no TeamViewer logs. The only records Wavqu keeps are our support person's booking and completion notes (section 2.6), for the period in section 6.
We do not use an outside company for crypto payments. Bitcoin payments go through BTCPay Server, which Wavqu runs on its own infrastructure. So Wavqu, not a third party, processes your Bitcoin payment data. Our BTCPay Server runs on its own server in Europe at our hosting provider, Contabo, listed in the table above.
We may also share data:
- with professional advisers, such as lawyers and accountants;
- with the police, regulators or courts if the law requires it;
- with a buyer if our business, or part of it, is sold. We will tell you if this happens.
We do not share your data with your broker. We do not contact your broker.
5. International transfers
Our own servers, including our BTCPay Server, are in Europe (Contabo). Stripe, Resend and Namecheap are United States companies and process data in the United States. TeamViewer is a German company. So some of your data, mainly your email address and payment references, is processed in the United States.
Wavqu is based in Ireland, in the European Union. When we send your data to Stripe, Resend or Namecheap Private Email in the United States, we rely on the safeguards that EU data protection law (the GDPR) provides for international transfers:
- the EU Standard Contractual Clauses in our contract with the provider; and
- where the provider is certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision for that framework.
You can ask us at support@wavqu.com which safeguard applies to a particular provider and for a copy of the relevant terms.
6. How long we keep your data
We keep data only as long as we need it.
| Data | How long |
|---|---|
| Account data (email, password hash, linked account number) | While your account is open, then deleted 12 months after you close it or ask us to delete it |
| Check-in logs (each EA check-in: the time, whether it was accepted or blocked and why, the instruction sent, and your balance and equity at that moment) | 14 days. Older entries are deleted automatically. |
| Balance and equity snapshots | Every snapshot is kept for 7 days. After that, we keep only one snapshot per hour. Hourly snapshots are kept for as long as your account exists, then deleted 12 months after you close it. |
| Closed-trade history for your linked account | For as long as your account exists, then deleted 12 months after you close it |
| Deposit and withdrawal history, and the realised result used for your deposit limit | For as long as your account exists, so that the right limit can be checked if you change plan, then deleted 12 months after you close it |
| Data for a previously linked MT4 account (after you change account) | It stops being shown on your dashboard. It is kept for as long as your account exists, then deleted 12 months after you close it. |
| Payment, invoice and subscription records | 7 years, as required by tax and accounting law |
| Admin action records (what was changed on your account, by whom, when and why) | 7 years |
| Request logs (IP address, time, request, status) | Kept in rotating log files capped by size (about 50 MB per service), so in practice days to a few weeks, and never longer than 30 days |
| Security events on your account (event type, account and time only) | For as long as your account exists, then deleted 12 months after you close it |
| Support messages | 24 months from the last message in the conversation |
| Assisted setup booking details and session notes | 12 months after the session, or after your account is closed if that is sooner |
If you ask us to delete your data (section 8), we delete it sooner, except for the records we must keep by law, such as payment records.
7. How we protect your data
We use measures such as:
- encrypted connections (HTTPS) between the EA, your browser and our server;
- password hashing, so we never store readable passwords;
- licence keys masked on screen by default;
- limits on repeated login and password-reset attempts;
- keeping licence keys and account numbers out of our server logs;
- access to customer data limited to people who need it.
No system is completely secure. If a data breach is likely to put you at high risk, we will tell you without undue delay.
8. Your rights
Depending on the data protection law that applies to you, you may have these rights over your personal data:
- Access. Ask for a copy of the data we hold about you.
- Correction. Ask us to correct data that is wrong or incomplete.
- Deletion. Ask us to delete your data. We may need to keep some data, for example payment records for tax law. We will tell you what we keep and why.
- Restriction. Ask us to pause using your data in some cases.
- Objection. Object to us using your data where we rely on legitimate interests.
- Portability. Ask for data you gave us, or that the EA sent us, in a common machine-readable format, such as CSV or JSON. You can ask us to send it to another organisation where this is technically possible.
- Withdraw consent. Where we rely on consent, you can withdraw it at any time.
To use any of these rights, email support@wavqu.com. We may need to check your identity first. We will reply within one month. We do not charge a fee in most cases.
Deleting your Wavqu account ends your subscription. It does not close any trades on your broker account.
9. Complaints
If you are unhappy with how we use your data, please contact us first at support@wavqu.com.
You may also have the right to complain to the data protection supervisory authority in the country where you live or work. In Ireland, where Wavqu is based, that is the Data Protection Commission (dataprotection.ie).
10. Cookies
Our website uses one cookie: a session cookie. It keeps you logged in, remembers your plan choice while you sign up, and protects forms from a type of attack called cross-site request forgery. It is strictly necessary for the website to work, so we do not need to ask for your consent. It is marked so that scripts on the page cannot read it, and it is only sent over secure connections.
We do not use analytics, advertising or tracking cookies. If we add any in future, we will update this policy and ask for your consent first where the law requires it.
When you pay by card you are sent to a page hosted by Stripe. Stripe sets its own cookies there, for example to prevent fraud. Stripe's cookie policy applies to those.
When you pay with Bitcoin, the payment page comes from our own BTCPay Server. That page may set its own functional cookies, for example to remember your language or the invoice you are paying. It uses no third-party trackers.
11. Children
Wavqu is only for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy. If we make important changes, we will email you before they apply. The date at the top shows the last update.
13. Contact
Wavqu
Email: support@wavqu.com