Privacy Policy

What we collect

This policy describes the data the demonstration actually stores. It does not describe a larger advertising business, because there is not one.

Account data, kept in the operator’s database: email, username, a hash of your password (not the password itself), role, name, mobile number, country, currency, date of birth, and KYC status. If a KYC file is uploaded, the file itself is stored. Accepted types are JPEG, PNG, and PDF.

Session: an HttpOnly cookie named sid, kept for about seven days, with SameSite set to Lax. The server stores a hash of that token, not the raw cookie value.

Play records: mock deposit and withdrawal requests, transfers of demo float, sports bets, casino rounds, and the ledger entries that back simulated balances. Those records exist so the preview can show a history. They are not bank transactions.

• The bet slip is saved in localStorage in your browser.
• A short-lived key for a casino play is saved in sessionStorage so a refresh does not double-submit that play.
• There are no third-party analytics cookies and no advertising cookies.

How we use it

The data is used to run the demonstration: to log you in, to show your account and your own history, to enforce the age gate and suspensions, and to let staff in your tree do the jobs their role already allows. It is not used to sell advertising profiles and it is not used to take a real-money payment.

Legal basis

Where a data-protection law applies, the operator relies on the need to provide the demonstration you chose to use, and on the legitimate operation and security of that preview. The bet slip and the short-lived casino key stay in your browser; clearing site data removes them. This policy is not a claim that a particular statute has been certified. It is an honest description of a demo.

Sharing

The operator does not sell personal data. Staff above you in the same operator tree can see the account and play information their role is already allowed to see, such as a balance or a pending mock cash request. The database and the application stay with the operator. There is no named third-party processor in this preview.

Retention

Account and play data are kept for the life of the demo account. When the operator deletes the account, that data goes with it, except where a backup or a legal duty briefly retains a copy. Session cookies expire after about seven days of inactivity or when you log out. Browser storage lasts until you clear it or the play key is discarded.

Security

Passwords are stored as hashes. Session tokens are stored as hashes. The session cookie is HttpOnly so page scripts cannot read it. No method of storage is perfect. Do not put real identity documents into this preview unless you accept that it is a demonstration database, not a bank vault.

Your rights

You may ask for a copy of your account data, a correction, or deletion by writing to [Operator contact email to be completed]. The person who opened your account can also pass that request on. This demonstration does not provide a regulated self-service privacy portal, and it does not promise response times set by a particular statute. The operator will not use a privacy request as a reason to convert demo float into money.

Cookies and local storage

The only cookie the application sets for a signed-in session is sid. It is strictly for keeping you logged in. localStorage holds the bet slip. sessionStorage holds a casino play key for the current tab. You can clear both in your browser. Clearing them can log you out or drop an unsubmitted slip. There is no advertising cookie to opt out of.

International transfers

Data sits where the operator hosts this demonstration. There is no named foreign processor and no transfer to an advertising network. If you use the site from another country, your request still lands on that same host.

Children

The demonstration is for people aged 18 and over. It does not knowingly collect data from anyone younger. If an underage account is discovered, it will be closed and the associated play data will be removed when the operator deletes the account. Do not upload a child’s documents.

Changes

This policy may be updated by posting a new version on this page. The effective date is 21 October 2026. Continued use after a posted change means you have seen the new policy.

Contact

Privacy requests: [Operator contact email to be completed].