That's not a very secure system.
You should set up a 1-of-2 multisig address with the user instead and have them send funds to that address. They're still placing a lot of trust in you but they don't have to expose their private key.
As far as your original question goes: I don't think so since they're still technically in control of their funds (just you are as well), it's more like a jointly owned bank account. Of course, I am not a lawyer.
Or better yet (updating this later after thinking about it a bit): Instead, have the user sign a bitcoin transaction, specifying the destination address but have them give it to you without actually publishing it until the condition has been met. That way you don't have control over their funds at all, but you can still pull the trigger on sending a transaction. This has the benefit of only requiring a single tx to complete the whole process.