Privacy notice
Last updated 21 October 2026
What personal data MassGrowth Markets collects, why, who it goes to, how long we keep it, and your rights. We collect as little as we can: no advertising, no analytics and no tracking on our websites.
Who we are
MassGrowth Markets is a trading name of MASSGROWTH PRO LIMITED, a company registered in England and Wales with company number 14769602. We are the controller of the personal data described here: we decide how it is used.
This notice covers our website, massgrowth.co; our waitlist; and our trader site, trader.massgrowth.co, where you open accounts, trade and request payouts.
For anything about your data, email contact@massgrowth.co. We are registered with the Information Commissioner's Office, registration number ZB612614.
What we collect and why
What we hold depends on what you do with us. After each item, in brackets, is the reason the law lets us use it (the "lawful basis"). Our services are for adults: you must be 18 or over to join the waitlist or open an account.
Visiting massgrowth.co
No cookies, no analytics and no tracking. Like every website, ours receives your IP address and browser details when you load a page: our hosting provider, Cloudflare, uses them to deliver the page and protect the site from attacks. Our typeface is loaded from Google Fonts, so your browser also sends your IP address to Google (legitimate interests: running a secure website).
Joining the waitlist
Your email address, the programme you are interested in, the page you joined from, the country your connection comes from (we cannot accept some countries), when you joined and confirmed, and your place in the queue. We use them to confirm your email, keep your place and any founding price, and tell you when we launch (consent: you asked to join, and every email has a link to stop them).
Opening an account
Your name, email address and country of residence. Your password, stored only as a one-way scrambled hash that we cannot read back. If you turn on two-factor sign-in, its secret key. The date you accepted our terms, and the country your connection came from at the time. The cookie that keeps you signed in (contract: we need them to provide your account).
Challenges, trading and payments
The challenges you order and their prices. For each payment, the references, amounts, coin and status we receive from our payment provider, NOWPayments: we never receive your wallet's keys or any card details. Everything that happens on your accounts: orders, trades, balances, rule checks, passes, breaches and payouts. Your trading goes into a tamper-evident audit trail, which is how we prove every decision on your account (contract; legal obligation: financial records).
Checking your identity
Before your first payout we check your identity through Didit, an identity-verification company. You give your identity document and a short face scan to Didit directly. Didit checks that the document is genuine and that you are the person in it, and screens your name against sanctions lists, which it may repeat while you trade with us. We receive only the outcome: approved or declined, the country of the document, and any reason codes. We never receive your document, your photos, your date of birth or your face scan (legitimate interests: preventing fraud and paying only real, eligible people; legal obligation: sanctions).
The face scan is biometric data. Didit uses it only to match you to your document, with your explicit consent, which we ask for before every check starts.
Payouts and commissions
The wallet address and network you give us for payouts or affiliate commissions, when you changed them, and the reference of each payment we send (contract; legal obligation: financial records).
Support and email
What you write in support tickets, and the emails you send us (contract; legitimate interests: helping you). We email you about your waitlist place, your account, payments, payouts and certificates, and replies to your tickets, through our email provider, Resend. We do not track whether you open our emails or click their links.
Referral links
If you arrive through another trader's referral link, a cookie remembers the link's code for 30 days. When you sign up we record who referred you, so they can earn a commission. They see how many people they referred and what they earned, never who (consent: the trader site asks before it sets the cookie).
Certificates
When you pass a phase, are funded or receive a payout, we issue a numbered certificate with a public page. It shows your initials unless you choose to show your full name (which needs a verified identity), with the account size, the date and, for a payout, the amount (contract; your choice for the full name).
Keeping our services safe
To stop people guessing passwords or flooding our forms, we count attempts by email address and by IP address. These counts are kept on our server for one day and never copied anywhere else (legitimate interests: security).
Outside the UK
Our server, and the records on it, are in London. Some of our providers handle data outside the UK, including in the United States and the European Union. When data leaves the UK, we rely on the UK's adequacy regulations (which cover the European Economic Area, and US companies certified under the UK Extension to the EU-US Data Privacy Framework) or on the ICO's International Data Transfer Agreement or Addendum. Our backups are encrypted on our server before they leave it, so the company storing them cannot read them. Email us for the safeguard used for a particular provider.
How long we keep it
| What | How long |
|---|---|
| A waitlist entry never confirmed | 30 days |
| A confirmed waitlist entry | Until you ask us to delete it |
| Your account details | While your account is open, then 6 years |
| Orders, payments, trading records, payouts and commissions | 6 years after the end of the financial year they belong to |
| The outcome of an identity check | 5 years after you stop trading with us |
| Your document and face scan, held by Didit | 5 years after you stop trading with us |
| Support tickets and emails | 2 years after the last message |
| Counts of sign-in and form attempts | 1 day |
We keep financial records for six years because UK tax law requires it. Our encrypted backups hold the same records and are kept no longer than the records themselves. If something is needed for a dispute or a legal claim, we keep it for as long as that lasts.
Decisions made automatically
Our trading engine judges every account automatically against our published rules: when a loss limit is broken the account ends at once, and passes are given the same way. Didit decides most identity checks automatically, and a person reviews the doubtful ones. A person looks at every payment that does not match its order, and approves every payout.
If a decision affects you, you can ask for a person to review it, give your view and challenge it: email us.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct it;
- delete it;
- limit how we use it;
- stop using it where we rely on legitimate interests;
- give it to you, or to another company, in a common format;
- stop using it where we rely on your consent (for the waitlist, the link in every email does this).
Email contact@massgrowth.co. We reply within one month, free of charge, and may first need to confirm who you are. Some records we must keep, such as those the law requires and the audit trail of an account for as long as we must keep it; if that applies, we will tell you.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Keeping it safe
Passwords are stored only as scrambled hashes, and sign-in can be protected with two-factor codes. Our websites reach our server only through an encrypted tunnel, and our staff screens sit behind a second sign-in. Backups are encrypted before they leave the server. Only the people who run MassGrowth Markets can see trader data, and every action they take on an account is recorded.
Changes to this notice
We publish every change here with a new date. If a change affects how we use data you have already given us, we email you before it takes effect.