Privacy Policy — api33

1 Introduction

api33 ("we", "us", "our", "the Platform") operates the online betting and gaming platform accessible at api33.one. In the course of providing our services to registered players ("you", "the Player") primarily located in Indonesia, api33 collects and processes certain categories of personal data. We are committed to handling that data with transparency, care, and in accordance with internationally recognized data protection principles.

This Privacy Policy describes the categories of personal data we collect, the purposes for which we use it, the legal bases on which we rely to process it, how long we retain it, with whom we share it, and the rights that are available to you in relation to your personal data. Please read this Policy carefully. If you have any questions or concerns, contact our support team at any time using the details in Clause 15.

This Policy should be read alongside the api33 Terms & Conditions, which form the overarching legal agreement governing your use of the platform.

2 Definitions

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. This includes names, email addresses, phone numbers, bank account details, IP addresses, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, deletion, and any combination thereof.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, api33 is the Data Controller in respect of all player personal data.
• "Data Processor" means a third party that processes personal data on behalf of api33 and under api33's documented instructions. Data Processors include payment providers, KYC verification services, and cloud infrastructure providers.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Player's agreement to the processing of their personal data for a stated purpose.
• "KYC" (Know Your Customer) means the identity and age verification process conducted by api33 before processing withdrawal requests, as described in the Terms & Conditions.
• "Cookies" means small text files placed on your device by the api33 platform for the purposes of session management, analytics, and optional personalization.

3 Data We Collect

api33 collects the following categories of personal data in the course of providing its services:

3.1 Identity and Contact Data

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify the 21+ age requirement)
• Residential address in Indonesia
• Email address
• Mobile phone number
• Scanned or photographed copies of identity documents submitted during KYC (national ID / KTP, passport, or driver's license)

3.2 Financial and Payment Data

• Bank account details associated with your registered payment methods (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata)
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Deposit and withdrawal transaction records, including amounts (in IDR), timestamps, and payment method used
• Proof of payment documents submitted in connection with deposit disputes or KYC verification

3.3 Account and Activity Data

• api33 account username and encrypted password
• Account registration date and last login timestamp
• Full betting and gaming history, including markets wagered, stakes placed, outcomes, and winnings
• Bonus claims, promotional participation history, and wagering requirement progress
• Responsible gaming settings applied to the account (deposit limits, self-exclusion status)

3.4 Technical and Device Data

• IP address at time of registration and each subsequent login
• Device type, operating system, and browser version
• Session duration and platform navigation data
• Cookie identifiers and analytics data (see Clause 9)

3.5 Communications Data

• Records of live chat conversations with api33 customer support
• Email correspondence with api33
• Formal complaints and their resolutions

4 How We Collect Your Data

api33 collects personal data through the following channels:

• Directly from you: During account registration, when you complete KYC verification, when you make a deposit or withdrawal, when you contact customer support, and when you update your account settings.
• Automatically: Through cookies, server logs, and analytics tools as you navigate and interact with the api33 platform. This includes IP address logging, session tracking, and page interaction data.
• From third-party payment providers: When payment providers confirm or flag a transaction, they may share transaction-level data with api33 for the purposes of processing and fraud prevention.
• From KYC verification partners: When a third-party KYC provider processes your identity documents, they return verification results (pass/fail and confidence scores) to api33. The underlying document images may be retained by the KYC provider in accordance with their own data retention policies.

5 Legal Basis for Processing

api33 processes your personal data on the following legal bases, depending on the type of data and the purpose of processing:

6 How We Use Your Data

api33 uses your personal data for the following purposes:

• Account operation: To create, manage, and maintain your api33 account, including processing logins, updating account settings, and enforcing account security.
• Payment processing: To process your IDR deposits and withdrawals via your registered bank account or e-wallet, and to maintain accurate transaction records.
• Age and identity verification: To confirm that you meet the 21+ age requirement and to verify your identity as part of the KYC process before processing withdrawal requests.
• Fraud and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, multi-accounting, and abuse of promotional offers.
• Customer support: To respond to your enquiries, resolve disputes, and manage formal complaints.
• Responsible gaming: To monitor betting patterns for signs of problem gambling behavior, to apply responsible gaming limits and self-exclusion measures you have requested, and to honor self-exclusion by suppressing marketing communications to excluded players.
• Regulatory compliance: To meet record-keeping and reporting obligations under applicable anti-money-laundering and financial compliance frameworks.
• Platform improvement: To analyze aggregated, anonymized usage data for the purpose of improving platform performance, game offering, and user experience.
• Marketing (opt-in only): To send promotional offers, bonus notifications, and platform updates to players who have actively opted in to receive marketing communications.

api33 does not use automated decision-making or profiling that produces legal or similarly significant effects on Players without human oversight and review.

7 Sharing Your Data

api33 does not sell, rent, or trade your personal data. We share your data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja receive transaction data necessary to process your deposit or withdrawal. Payment providers are bound by their own privacy and data security obligations.
• KYC verification providers: Third-party identity verification services receive the identity documents you submit during KYC and return verification results to api33. These providers are contractually bound to process your data solely for KYC purposes and to maintain appropriate security standards.
• Game studios: Third-party game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive a session token and player identifier to initialize game sessions. They do not receive your full name, financial data, or contact details.
• Cloud and infrastructure providers: api33 uses secure cloud infrastructure to host its platform and databases. Infrastructure providers have access to server data under strict data processing agreements and are not permitted to access player data for their own purposes.
• Legal and regulatory authorities: api33 may disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law, a valid legal order, or to protect the rights and safety of api33, its players, or third parties.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of api33's assets, player personal data may be transferred to the acquiring entity. Players will be notified of any such transfer and any material change in data handling practices in advance.

8 International Data Transfers

8.1  api33 operates internationally, and some of our third-party service providers are based outside of Indonesia. Processing your personal data may therefore involve transferring it to countries whose data protection laws differ from those applicable in Indonesia.

8.2  Where api33 transfers personal data internationally, we ensure that appropriate safeguards are in place to protect that data to a standard at least equivalent to the protections described in this Policy. These safeguards include contractual clauses binding receiving parties to confidentiality, security, and data use restrictions consistent with this Policy.

8.3  By using the api33 platform, you acknowledge and consent to the transfer of your personal data to countries outside Indonesia where such transfers are necessary to deliver the services you have requested.

9 Cookies & Tracking Technologies

api33 uses cookies and similar tracking technologies on the api33.one platform. The categories of cookies used are as follows:

You can manage or disable non-essential cookies through your browser settings at any time. Disabling essential or security cookies may prevent certain platform features from functioning correctly.

10 Data Retention

api33 retains personal data for the periods set out below. Where multiple retention periods could apply to the same category of data, the longer period prevails.

• Account and identity data: Retained for a minimum of 5 years following account closure, in compliance with anti-money-laundering record-keeping requirements.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• KYC documents: Retained for a minimum of 5 years following account closure or the date of the last KYC submission, whichever is later.
• Customer support communications: Retained for 3 years from the date of the last communication in a support thread.
• Marketing consent records: Retained for as long as your account remains active plus 12 months following account closure, to evidence compliance with consent requirements.
• Analytics and technical data: Aggregated analytics data may be retained indefinitely in anonymized form. Individual session logs are retained for up to 12 months.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized so that it can no longer be associated with an identifiable individual.

11 Exercising Your Data Rights

11.1  You may exercise any of the data rights described in the "Your Rights" section above by submitting a request to api33 customer support via live chat or email. Requests are acknowledged within 5 business days and fulfilled within 30 days of receipt. If api33 requires additional information to verify your identity before processing a request, the 30-day period begins when the verification information has been received.

11.2  api33 does not charge a fee for processing data rights requests. However, if a request is manifestly unfounded or excessive (including requests that are repetitive in nature), api33 reserves the right to charge a reasonable administrative fee or to decline to act on the request, with written reasons provided.

11.3  Right to withdraw consent: Where api33 processes your data on the basis of your consent (e.g., for marketing communications), you may withdraw that consent at any time by updating your preferences in your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

11.4  Self-exclusion and data: If you request self-exclusion from api33, your account will be closed and no new bets or deposits will be accepted. However, api33 is required by law to retain your personal data for the retention periods set out in Clause 10, even after self-exclusion. Your data will not be used for any marketing or promotional purpose during or after the exclusion period.

12 Security Measures

api33 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the api33 platform
• Encryption of sensitive personal data (including payment details and KYC document references) at rest
• Role-based access controls, ensuring that api33 personnel can access player data only to the extent required by their specific job function
• Multi-factor authentication requirements for all internal api33 staff accessing player data systems
• Regular security audits and penetration testing of the api33 platform and associated infrastructure
• Automated intrusion detection and anomalous login monitoring
• Documented incident response procedures in the event of a data breach

In the event of a data breach that is likely to result in a risk to your rights and freedoms, api33 will notify affected players as promptly as reasonably practicable, providing details of the nature of the breach, the likely consequences, and the measures api33 has taken or proposes to take to address it.

While api33 takes all reasonable precautions to protect your data, no internet-based system can be guaranteed to be entirely secure. You also play a role in data security — please keep your api33 login credentials confidential and report any suspected unauthorized account access to api33 support immediately.

13 Minors

api33's services are strictly intended for adults aged 21 and over. api33 does not knowingly collect personal data from individuals under the age of 21. If api33 becomes aware that personal data has been collected from a person under 21, that data will be deleted promptly and the associated account will be permanently closed.

If you are a parent or guardian and believe that your child may have registered an account with api33, please contact us immediately at support@api33.one and we will investigate and take appropriate action without delay.

14 Changes to This Privacy Policy

14.1  api33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. The date of the most recent update is displayed at the top of this page.

14.2  For material changes — those that significantly affect the way we collect or use your personal data, or that reduce your rights — api33 will notify registered players by email at least 14 days before the changes take effect. For minor or administrative updates, a notice on the api33 platform may be used in place of direct email notification.

14.3  Continued use of the api33 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you must stop using the platform and close your account.

14.4  The current version of this Privacy Policy is always available at api33.one/privacy-policy. Players are encouraged to review this page periodically.

15 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a potential data security concern, please contact api33 as follows:

If you are not satisfied with api33's response to a data rights request or privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction.