Privacy Policy

1 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including but not limited to name, date of birth, email address, device identifiers, IP address, and financial account details.
• "Processing" means any operation or set of operations performed on Personal Data — including collection, recording, storage, alteration, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" means api666, which determines the purposes and means by which Personal Data is processed.
• "Data Processor" means any third party that processes Personal Data on api666's behalf pursuant to a written data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a Player's agreement to the processing of their Personal Data for one or more specified purposes.
• "KYC" (Know Your Customer) means identity and age verification procedures conducted by api666 to confirm the lawful eligibility of a Player before activating full account functionality.
• "Sensitive Data" means categories of Personal Data warranting heightened protection, including but not limited to financial account numbers, government-issued identity document numbers, and biometric or health information.
• "Third Party" means any natural or legal person other than the Player or api666, including but not limited to payment processors, game content providers, fraud prevention services, and regulatory authorities.

2 Scope & Application

This Policy applies to all Personal Data collected by api666 in connection with the operation of the Platform, including data collected through:

• The api666 website at https://api666.cam and all sub-domains;
• Account registration and KYC verification processes;
• Deposit, withdrawal, and payment transaction processing;
• Customer support interactions via live chat or email;
• Promotional participation and bonus claim flows;
• Automated technologies such as cookies, session logs, and device fingerprinting.

This Policy applies to all Players regardless of location. The Platform is designed for players resident in Indonesia and its data practices are designed with the Indonesian market in mind, while also adhering to internationally recognised privacy standards.

3 Data We Collect

3.1 Data You Provide Directly

When you register, verify your identity, make transactions, or contact our support team, you provide Personal Data that api666 collects and processes. The categories and examples of such data are set out below:

3.2 Data Collected Automatically

When you access and use the Platform, api666 automatically collects certain technical and behavioural data through server logs, cookies, and similar technologies:

• Device & Technical Data: IP address, browser type and version, operating system, device type, screen resolution, and language preferences;
• Usage Data: Pages visited, features accessed, session duration, click paths, bet history, game activity, and deposit/withdrawal patterns;
• Location Data: Approximate geographic location derived from IP address (city/region level), used for fraud detection and service eligibility checks;
• Cookie Data: Session identifiers, authentication tokens, preference settings, and analytics data as described further in Section 7.

3.3 Data from Third Parties

api666 may receive Personal Data about you from trusted third-party sources, including:

• Payment processors and banking partners, for transaction verification and fraud screening;
• Identity verification service providers, for KYC document validation;
• Fraud prevention and anti-money-laundering (AML) databases, for risk assessment;
• Game content providers (e.g., Evolution Gaming, Pragmatic Play), for game session data associated with your account.

4 Legal Basis for Processing

api666 processes your Personal Data only where a valid legal basis exists under applicable data protection law. The principal legal bases on which we rely are:

• Contractual necessity: Processing required to enter into and perform the account agreement with you — including registration, payment processing, KYC verification, and account management;
• Legal obligation: Processing required to comply with applicable law — including anti-money-laundering obligations, identity verification requirements, and responses to lawful regulatory or law enforcement requests;
• Legitimate interests: Processing conducted in api666's legitimate interest where such interests are not overridden by your privacy rights — including fraud detection, platform security, responsible gaming monitoring, and service improvement analytics;
• Consent: Processing for which you have provided explicit prior consent — such as receiving marketing communications and promotional offers from api666. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5 How We Use Your Data

api666 uses your Personal Data for the following specific purposes:

5.1 Account Management

To create and maintain your registered account, verify your identity and age (21+), manage your account balance, process your deposits and withdrawals, and communicate with you about account-related matters including security alerts and transaction confirmations.

5.2 Service Delivery

To provide access to the Platform's betting, live casino, slot, and togel (Indonesia's traditional numbers lottery) products; to record and settle bets; to apply bonuses and promotions to your account; and to deliver a personalised, optimised gaming experience.

5.3 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent transactions, bonus abuse, identity theft, account takeover, money laundering, and any other activity that violates our Terms & Conditions or applicable law. This includes automated transaction monitoring and device fingerprinting.

5.4 Regulatory Compliance

To fulfil anti-money-laundering (AML) obligations, respond to lawful requests from regulatory and law enforcement authorities, maintain mandatory transaction records, and comply with any other legal requirements applicable to the operation of an online betting platform.

5.5 Responsible Gaming

To monitor player activity for indicators of problem gambling behaviour; to enforce deposit limits, loss limits, and self-exclusion orders; and to contact Players who may benefit from responsible gaming resources. This processing is conducted in api666's legitimate interest and is integral to our duty of care toward Players.

5.6 Marketing & Promotions

Where you have provided consent, to send you information about api666 promotions, bonus offers, new game releases, and seasonal campaigns (such as Idul Fitri or Chinese New Year specials) by email or in-platform notification. You may withdraw marketing consent at any time by contacting support at [email protected].

5.7 Platform Improvement

To analyse aggregated, anonymised usage patterns in order to improve platform performance, user experience, product design, and customer support quality. Individual Players are not identifiable from the anonymised datasets used for this purpose.

6 Data Sharing

6.1 We Do Not Sell Your Data

api666 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. This is an unconditional commitment.

6.2 Authorised Data Processors

api666 shares Personal Data with carefully selected third-party service providers who process data on our behalf under binding data processing agreements. These include:

• Payment processors and banking partners — BCA, BRI, BNI, Mandiri, and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — for transaction execution;
• Identity verification providers — to validate KYC documents;
• Cloud infrastructure providers — for secure data hosting and platform operation;
• Game content providers — such as Evolution Gaming, Pragmatic Play, and Pocket Games Soft — to deliver game content and settle game results;
• Fraud prevention and AML screening services — to detect and prevent financial crime;
• Customer support technology providers — for live chat and email ticketing infrastructure.

6.3 Legal Disclosures

api666 may disclose your Personal Data to law enforcement authorities, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, valid court order, or regulatory directive. We will notify affected Players of such disclosures where we are legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a substantial part of api666's business, Personal Data held by api666 may be transferred to the acquiring entity as part of that transaction. Affected Players will be notified in advance of any material change to data processing arrangements arising from such a transfer.

7 Cookies & Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits and store preferences or session information. api666 uses both first-party cookies (set by api666 directly) and third-party cookies (set by authorised service providers).

7.2 Cookie Categories

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication, security tokens, and account preferences. These cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Used to measure page load times, identify technical errors, and analyse aggregate user journeys for platform improvement. Data collected is anonymised.
• Functional Cookies: Store your preferences such as display language, session limits settings, and notification preferences to provide a consistent experience across visits.
• Fraud Prevention & Security Cookies: Support device fingerprinting and session anomaly detection to identify and prevent unauthorised access and fraudulent activity.

7.3 Managing Cookies

You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Instructions for managing cookies are available in the help documentation of all major browsers. api666 does not respond to "Do Not Track" browser signals at this time, as there is no commonly accepted standard for their implementation.

8 Data Retention

api666 retains Personal Data for no longer than is necessary for the purposes for which it was collected, subject to the following retention schedules:

• Active Account Data — retained for the duration of the account relationship plus a period of five (5) years following account closure, to satisfy AML record-keeping obligations;
• Transaction Records — retained for five (5) years from the date of the transaction in accordance with financial record-keeping requirements;
• KYC Documentation — retained for five (5) years from the date of verification or account closure, whichever is later;
• Support & Communications Records — retained for two (2) years from the date of the interaction;
• Marketing Consent Records — retained for three (3) years from the date consent was given or withdrawn, as required for audit purposes.

At the end of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to an identified individual.

9 Data Security

api666 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and the Platform;
• Encryption at rest for all Sensitive Data stored on api666 servers, including KYC documents and financial account identifiers;
• Two-factor authentication (2FA) available on all Player accounts and mandatory for all staff accounts with access to Player data;
• Role-based access controls limiting staff access to Personal Data to the minimum necessary for their specific job function;
• Real-time intrusion detection and prevention systems monitoring the Platform infrastructure for anomalous activity;
• Regular independent security audits and penetration testing of the Platform's infrastructure and application layers;
• Staff data-handling training conducted at onboarding and annually thereafter.

Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. In the event of a data breach that poses a risk to your rights, api666 will notify affected Players without undue delay and report the breach to the appropriate regulatory authority as required by applicable law.

10 Your Rights

As a Player whose Personal Data is processed by api666, you hold the following rights with respect to your data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request — [Your Username]":

api666 will respond to all rights requests within 30 days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days with prior notice. We will not charge a fee for processing rights requests unless they are manifestly unfounded or excessive.

11 Minors & Age Policy

The api666 Platform is strictly for adults aged 21 years or older. We do not knowingly collect or process Personal Data from individuals under 21. All new accounts are subject to age verification as part of the KYC process prior to withdrawal activation.

If api666 discovers that Personal Data has been collected from an individual under the age of 21, the relevant account will be immediately suspended, all funds will be reviewed and handled in accordance with our Terms & Conditions, and the Personal Data of the minor will be deleted without delay. Parents or guardians who believe a minor may have registered an account on the Platform should contact us immediately at [email protected].

12 International Data Transfers

api666 operates infrastructure and engages service providers that may be located in countries outside Indonesia. Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection, api666 ensures appropriate safeguards are in place, including:

• Execution of standard contractual clauses or equivalent data transfer agreements with the receiving party;
• Verification that the receiving party maintains security standards equivalent to those applied by api666;
• Limitation of transferred data to the minimum necessary for the processing purpose.

By using the Platform, you acknowledge that your Personal Data may be processed in jurisdictions outside your country of residence. api666 is committed to ensuring that such transfers are conducted with appropriate protections in place.

13 Policy Changes

api666 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Any material changes — meaning changes that affect the nature of data collected, the purposes for which it is used, or your rights as a Player — will be communicated to active Players via email at least 14 days before the amended Policy takes effect.

The "Last updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the Platform following notification of a material change constitutes acceptance of the revised Policy. If you do not accept the amended terms, you should close your account before the effective date of the change.

Non-material changes — such as minor typographical corrections, clarifications that do not alter your rights, or formatting updates — may be made without prior notice. We encourage you to review this Policy periodically.

14 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy-related complaint, please contact api666 using the details below:

• Email: [email protected] — subject line "Privacy Query" or "Data Rights Request — [Your Username]"
• Live Chat: Available 24/7 directly from the Platform. For data rights requests via live chat, our agent will raise a formal ticket and provide you with a reference number.
• Response Time: We acknowledge all privacy-related queries within 48 hours and provide a substantive response within 30 days.

If you are not satisfied with api666's handling of a privacy complaint, you have the right to escalate to a senior compliance officer by requesting escalation in writing. api666 is committed to resolving all privacy complaints promptly and fairly.