api66 Privacy Policy

1Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

Term	Meaning
"Personal Data"	Any information that identifies or can reasonably be used to identify a living individual, either directly or in combination with other data.
"Processing"	Any operation performed on Personal Data, including collection, storage, use , modification, disclosure, or deletion.
"Platform"	The api66 website at https://api66.bet, including all sub-pages, account dashboards, game interfaces, and any mobile-optimized versions thereof.
"Player" / "You"	Any individual who accesses, browses, registers on, or uses the api66 Platform in any capacity.
"Account"	The registered player account created by a Player to access real-money gambling Services on the api66 Platform.
"Services"	All gambling products, payment facilities, customer support, promotions, and ancillary features made available through the Platform.
"KYC"	Know Your Customer — the identity and document verification process conducted by api66 prior to processing withdrawals or as otherwise required.
"Cookie"	A small data file placed on your device by the Platform to remember information about your session, preferences, or behavior.
"Third Party"	Any natural or legal person other than you or api66, including payment processors, game studios, fraud prevention services, and analytics providers.
"IDR" / "Rp"	Indonesian Rupiah — the sole functional currency of the api66 Platform for Players accessing from Indonesia.

---

2Data Controller

2.1 api66 acts as the Data Controller in respect of the Personal Data you provide or that is collected when you use the Platform. As Data Controller, api66 determines the purposes and means of processing your Personal Data, and is responsible for ensuring that such processing complies with applicable data protection laws and the terms of its international gambling license.

2.2 All data protection inquiries, requests to exercise your data rights, and formal complaints should be directed to api66's designated Data Protection contact at [email protected] with the subject line "Data Protection Request." We aim to acknowledge all requests within five business days and to resolve them within 30 calendar days.

2.3 The api66 Platform is operated by an internationally licensed entity. Players based in Indonesia who access the Platform do so subject to the terms of api66's international license, and any cross-border data transfers are governed by appropriate safeguards as described in Clause 14 of this Policy.

---

3Personal Data We Collect

3.1 Registration Data. When you create an Account on the api66 Platform, we collect the following information:

• Full legal name (as it appears on your government-issued identification);
• Date of birth (used to verify that you meet the 21+ age requirement);
• Gender (optional, collected to personalize promotional communications);
• Indonesian mobile phone number (used for OTP verification and account security);
• Email address (used for account communications, security alerts, and promotions where opted in);
• Chosen username and encrypted password;
• City and province of residence within Indonesia (e.g., Jakarta, Surabaya, Bandung, Bali, Medan).

3.2 KYC Verification Data. To comply with our anti-money laundering (AML) and licensing obligations, we collect and process the following during the KYC verification process:

• Scanned copy or photograph of your Indonesian National Identity Card (KTP) or valid passport;
• Proof of address document (e.g., recent utility bill or bank statement from BCA, BRI, BNI, Mandiri, or another recognized Indonesian bank);
• Proof of payment method ownership (e.g., screenshot of your BCA or BRI mobile banking profile, or e-wallet registration confirmation for OVO, DANA, GoPay, ShopeePay, or LinkAja);
• Any additional documentation requested by our compliance team to satisfy licensing obligations.

3.3 Financial Data. When you make deposits or request withdrawals, we collect:

• Bank account details (account holder name, bank name such as BCA / BRI / BNI / Mandiri / CIMB Niaga / BSI, and account number);
• E-wallet registration details (phone number registered to OVO, DANA, GoPay, ShopeePay, or LinkAja);
• Transaction amounts, dates, and reference numbers;
• Deposit and withdrawal history on the Platform.

3.4 Gaming and Behavioral Data. As part of operating a safe and fair gambling platform, we collect:

• Wagering history, game play logs, and session records;
• Bet amounts, odds accepted, game types selected, and outcomes;
• Responsible gaming tool usage (deposit limits set, session time limits, self-exclusion requests);
• Bonus claim history and wagering requirement progress;
• Customer support interactions (live chat transcripts, email correspondence).

3.5 Technical and Device Data. When you access the Platform, our systems automatically collect:

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, and browser version;
• Pages visited, time spent on each page, and click-path data;
• Referral source (the URL from which you arrived on the Platform, if applicable);
• Session identifiers and authentication tokens.

---

4How We Collect Your Data

4.1 Directly from You. The majority of Personal Data we hold is provided directly by you at the point of registration, during KYC verification, when making deposits or withdrawal requests, when contacting customer support, or when opting into promotional communications.

4.2 Automatically. Certain technical and behavioral data is collected automatically by our Platform systems and third-party analytics tools as you browse and use the Platform. This includes data collected via cookies and similar tracking technologies, as described in Clause 8.

4.3 From Third Parties. We may receive Personal Data about you from:

• Payment processors and banks: Transaction confirmation data from BCA, BRI, BNI, Mandiri, and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to verify deposit and withdrawal status;
• Fraud prevention and identity verification services: Third-party KYC and AML screening services may provide us with verification outcomes or risk scores;
• Licensing authorities: Our international licensing body may share compliance-related information or instructions regarding specific accounts;
• Publicly available sources: We may verify information you provide against publicly available records where legally permitted.

---

5Legal Basis for Processing

5.1 api66 processes your Personal Data on the following legal bases:

Legal Basis	Processing Activities Covered
Contract Performance	Processing your registration data, KYC verification, deposits and withdrawals, gaming activity records, and account management — all necessary to provide the Services you have contracted for.
Legal Obligation	AML screening, age verification, fraud prevention, record-keeping obligations imposed by our international licensing authority, and responding to lawful requests from law enforcement or regulatory bodies.
Legitimate Interests	Platform security monitoring, fraud detection, responsible gaming monitoring, analytics to improve the Platform, and limited direct marketing communications where you have not opted out.
Consent	Sending promotional emails or SMS messages (where you have expressly opted in); placing non-essential cookies on your device (where required by applicable law).

5.2 Where processing is based on your consent, you have the right to withdraw that consent at any time by contacting support or by using the opt-out mechanism in any marketing communication. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

---

6How We Use Your Personal Data

6.1 api66 uses your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and securing your Player Account; processing login requests and authentication challenges;
• Service Delivery: Processing deposits and withdrawals in Indonesian Rupiah (IDR); calculating and settling wagers; awarding bonuses and applying wagering requirements;
• Identity and Age Verification: Confirming that you are at least 21 years of age and a resident of Indonesia as required by our Terms & Conditions;
• Fraud Prevention and AML: Monitoring for suspicious activity, multi-accounting, money laundering, and other prohibited conduct; conducting AML screening against relevant watchlists;
• Responsible Gaming: Monitoring gaming patterns for signs of problem gambling; applying deposit limits, session time limits, and self-exclusion preferences you have set; proactively contacting Players who exhibit high-risk gambling behaviors;
• Customer Support: Responding to queries, resolving disputes, and providing account assistance via live chat and email;
• Legal Compliance: Maintaining records required by our licensing authority; responding to lawful requests from law enforcement or regulatory bodies;
• Platform Improvement: Analyzing aggregated, anonymized behavioral data to improve Platform performance, game selection, and user experience;
• Marketing Communications: Sending promotional offers, bonus notifications, and news about new games or features — but only where you have opted in or where we have a legitimate interest and you have not opted out.

6.2 api66 will not use your Personal Data for any purpose materially different from those described in this Clause without providing you with prior notice and, where required, obtaining your consent.

---

7How We Share Your Data

7.1 No Sale of Personal Data. api66 will never sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. Full stop.

7.2 Service Providers. We share Personal Data with carefully selected third-party service providers who process data on our behalf and under our instructions. These include:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — to facilitate deposits and withdrawals;
• KYC and identity verification providers: Third-party services used to verify the authenticity of identity documents and screen against AML watchlists;
• Game studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and other licensed game studios whose products are integrated into the Platform — limited technical data (session tokens, bet history) is shared to ensure game integrity and RTP accuracy;
• Hosting and infrastructure providers: Cloud hosting and content delivery network (CDN) providers used to operate and secure the Platform;
• Analytics providers: Aggregated and pseudonymized behavioral analytics platforms used to improve Platform performance.

7.3 Legal Disclosures. We may disclose your Personal Data to law enforcement agencies, regulatory authorities, courts, or our international licensing body where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of api66, our Players, or the public.

7.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of api66's business, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to the acquiring entity assuming the same data protection obligations set out in this Policy.

7.5 Aggregated Data. We may share aggregated, anonymized data sets (which do not identify any individual Player) with industry partners, researchers, or in public reports about Platform trends and responsible gaming metrics.

---

8Cookies & Tracking Technologies

8.1 The api66 Platform uses cookies and similar technologies (such as web beacons and local storage) to ensure the Platform functions correctly, to enhance your experience, and to support our analytics and security operations.

8.2 Cookie Categories. We use the following categories of cookies:

• Essential Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, CSRF protection tokens, load balancing cookies, and secure payment flow cookies. These cannot be disabled without breaking core Platform functionality.
• Analytics Performance & Analytics Cookies: Help us understand how Players interact with the Platform — which pages are visited most, where Players drop off, and how game performance is perceived. Data is aggregated and anonymized.
• Functional Functional Cookies: Remember your preferences such as language settings, last visited game category, responsible gaming tool settings, and display preferences to provide a more personalized experience on return visits.
• Marketing Marketing & Targeting Cookies: Used only where you have opted in, to deliver relevant promotional content and to measure the effectiveness of our marketing campaigns. We do not use cross-site advertising networks to track you across the internet.

8.3 Cookie Duration. Session cookies expire when you close your browser. Persistent cookies have a maximum lifetime of 12 months from the date they are set, after which they are automatically deleted and — if still required — refreshed on your next visit.

8.4 Managing Cookies. You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. Disabling analytics or functional cookies will not prevent you from accessing games or making transactions.

---

9Data Retention

9.1 api66 retains your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by our legal, regulatory, and licensing obligations. The following retention periods apply:

Data Category	Retention Period	Basis
Registration and Account Data	Duration of Account + 5 years after closure	Licensing obligation / AML compliance
KYC Identity Documents	Duration of Account + 5 years after closure	Licensing obligation / AML compliance
Financial Transaction Records	Duration of Account + 7 years after closure	AML / financial record-keeping requirements
Gaming Activity Logs	Duration of Account + 3 years after closure	Dispute resolution / licensing compliance
Customer Support Records	3 years from the date of the interaction	Dispute resolution / legitimate interest
Marketing Consent Records	Until consent is withdrawn + 2 years	Legal compliance (proof of consent)
Analytics and Technical Logs	13 months (rolling)	Legitimate interest (platform improvement)

9.2 Upon expiry of the applicable retention period, Personal Data is securely and permanently deleted or irreversibly anonymized so that it can no longer be linked to any individual. We do not retain Personal Data "just in case" — deletion is an active, scheduled process governed by our internal data lifecycle management procedures.

9.3 Where a legal hold is imposed (e.g., as a result of an ongoing investigation or litigation), retention will be extended for the duration of the hold, after which the normal deletion schedule resumes.

---

10Security Measures

10.1 api66 takes the security of your Personal Data seriously and has implemented a comprehensive set of technical and organizational measures to protect it against unauthorized access, accidental loss, alteration, or disclosure. These include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and the api66 Platform is encrypted in transit using industry-standard TLS 1.3 protocols;
• AES-256 Encryption at Rest: All Personal Data stored on our servers — including identity documents, financial records, and account credentials — is encrypted using AES-256 at rest;
• Hashed Passwords: Account passwords are never stored in plain text. They are salted and hashed using bcrypt with a work factor sufficient to resist modern brute-force attacks;
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable OTP-based 2FA via their registered Indonesian mobile number. 2FA is mandatorily applied for withdrawal requests above Rp 5.000.000;
• Access Controls: Internal access to Player Personal Data is restricted on a strict need-to-know basis. Employees accessing Personal Data are subject to background checks, confidentiality agreements, and regular security awareness training;
• Penetration Testing: The api66 Platform undergoes independent security penetration testing on a quarterly basis to identify and remediate vulnerabilities;
• DDoS Protection and Firewalls: Enterprise-grade distributed denial-of-service (DDoS) protection and web application firewalls (WAF) are in place to protect Platform availability and integrity;
• Fraud Monitoring: Real-time automated fraud detection systems monitor all transactions and account activity for anomalous patterns, flagging suspicious activity for manual review.

10.2 Despite these measures, no internet-based platform can guarantee absolute security. In the unlikely event of a Personal Data breach that poses a risk to your rights and freedoms, api66 will notify you via the email address on your Account within 72 hours of becoming aware of the breach, in accordance with applicable data protection law.

10.3 You are responsible for maintaining the security of your own Account credentials. api66 strongly recommends using a unique, complex password for your api66 Account that you do not use on any other website, and enabling 2FA. If you suspect your Account has been compromised, contact api66 support immediately via live chat.

---

11Your Data Rights

11.1 Depending on your jurisdiction and the legal basis for processing, you may have some or all of the following rights in relation to your Personal Data held by api66:

• Right of Access: You have the right to request a copy of the Personal Data we hold about you, along with information about how it is being processed;
• Right to Rectification: You have the right to request that inaccurate or incomplete Personal Data we hold about you is corrected or completed without undue delay;
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent (subject to our legal retention obligations — see Clause 9);
• Right to Restriction: You have the right to request that we restrict processing of your Personal Data in certain circumstances, such as while a dispute about its accuracy is resolved;
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller;
• Right to Object: You have the right to object to processing based on legitimate interests (including profiling for marketing) at any time. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

11.2 How to Exercise Your Rights. To exercise any of the rights described above, please contact api66's Data Protection team at [email protected] with the subject line "Data Rights Request." Please include your registered email address and a description of the right you wish to exercise. We may need to verify your identity before processing your request.

11.3 Response Timeframes. api66 will acknowledge your request within five business days and will complete the request within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

11.4 Complaints. If you believe api66 has not handled your Personal Data appropriately, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. api66 encourages you to contact us directly in the first instance so that we can address your concerns before escalation.

---

12Minors & Age Restriction

12.1 The api66 Platform is strictly for adults aged 21 years and older. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21. Registration is blocked by automated age-screening checks at the point of sign-up.

12.2 If api66 discovers or is informed that a Player's Account was registered by a person under the age of 21, the Account will be closed immediately, all Personal Data associated with it will be deleted from active systems within 30 days (subject to any mandatory legal retention obligations), and any balance will be handled in accordance with our Terms & Conditions and applicable law.

12.3 Parents and guardians who suspect that a minor in their care has registered on the api66 Platform are urged to contact support immediately at [email protected]. We will investigate and take immediate action.

---

13Third-Party Services & Links

13.1 The api66 Platform integrates third-party game studios, payment gateways, and analytics tools that may have their own privacy policies governing how they process data within their systems. Where a third party processes Personal Data on our behalf, they do so under a data processing agreement that binds them to api66's data protection standards.

13.2 Game studios integrated into the Platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — receive limited session and wagering data necessary to operate games and verify RTP compliance. These studios are licensed by recognized international gambling regulators and maintain their own documented security and privacy practices.

13.3 api66 is not responsible for the privacy practices of third-party websites or applications that you may access through links on the Platform. We encourage you to review the privacy policy of any third-party service you interact with independently of api66.

---

14International Data Transfers

14.1 As an internationally operated platform serving Players primarily in Indonesia, api66 may transfer your Personal Data to and process it in countries outside Indonesia. These transfers may involve jurisdictions that have different data protection laws from those in Indonesia.

14.2 Where such transfers occur, api66 ensures that appropriate safeguards are in place to protect your Personal Data to a standard equivalent to that required under this Policy, including:

• Standard contractual clauses (SCCs) or equivalent contractual protections with the receiving entity;
• Transfers to entities in jurisdictions recognized as providing an adequate level of data protection;
• Binding corporate rules where data is transferred within a corporate group;
• Where none of the above apply, explicit consent from you or reliance on another applicable derogation under data protection law.

14.3 You may request information about the specific safeguards in place for any particular international transfer by contacting our Data Protection team at [email protected].

---

15Changes to This Privacy Policy

15.1 api66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform Services. The "Effective Date" at the top of this page will always reflect the date the current version came into force.

15.2 For material changes — those that significantly affect your privacy rights or how we use your data — api66 will provide advance notice by sending an email to your registered address and displaying a prominent notice on the Platform upon your next login. We will provide at least 14 days' notice before a material change takes effect.

15.3 For minor or administrative changes (such as updated contact details or clarifications that do not affect how data is processed), we will update the Policy and revise the Effective Date without individual notice. We encourage you to review this Policy periodically.

15.4 Your continued use of the Platform after the revised Policy's Effective Date constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the Platform and may request Account closure by contacting support.

---

16Contact Us

16.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the way api66 handles your Personal Data, please contact our Data Protection team using the details below:

Channel	Details
Email	[email protected] — subject line: "Privacy Policy Inquiry"
Live Chat	Available 24/7 directly on the api66 Platform. Our Indonesian-speaking support agents are on hand around the clock to assist with data protection queries.
Response Time	Email inquiries acknowledged within 5 business days; resolved within 30 calendar days. Live chat queries addressed in real time during your session.
Operating Hours	24 hours a day, 7 days a week (WIB, UTC+7). Support is available on all Indonesian public holidays including Idul Fitri, Idul Adha, Christmas, and Nyepi.

16.2 api66 is committed to resolving all privacy-related concerns directly and transparently. We treat every data rights request with the same priority as a financial transaction — your trust in our platform depends on it.