Privacy Policy

1. Definitions

Throughout this Privacy Policy, the following terms carry the meanings assigned below:

• "sapu4d", "we", "us", or "our" — the sapu4d online betting platform operated under an international gaming licence and accessible at https://sapu4d.cam.
• "User", "you", or "your" — any individual who accesses, registers on, or otherwise uses the sapu4d platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, as defined under internationally recognised data-protection standards.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, transmission, and deletion.
• "Controller" — sapu4d, in its capacity as the entity that determines the purposes and means of processing Personal Data collected through the platform.
• "Third-Party Processor" — a sub-contractor or partner entity that processes Personal Data on our behalf under a written data-processing agreement (e.g., payment gateways, game providers, identity-verification vendors).
• "KYC" — Know Your Customer: the identity-verification procedure required by anti-money laundering (AML) regulations and responsible gaming obligations.
• "Services" — all products and features available on the sapu4d platform, including sports betting, live casino, togel (Indonesia's traditional numbers lottery), slot gacor (high-payout online slots), and customer-support channels.

2. Data We Collect

sapu4d collects only the Personal Data that is necessary to deliver our Services safely and in compliance with applicable regulations. The categories of data we collect are set out in the table below.

3. How We Collect Data

We collect Personal Data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC, making deposits or withdrawals, claiming bonuses, or contacting our support team.
• Automated technologies: Cookies, web beacons, and server logs that record technical and usage data while you navigate the platform. See Section 7 for details.
• Third-party verification providers: Identity-verification vendors who return match results and risk scores based on documents you submit.
• Payment processors: Transaction status, masked bank account or e-wallet details provided by BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja to confirm payment completion.
• Game providers: Evolution Gaming, Pragmatic Play, and other licensed studios transmit session-level data (game ID, round outcomes, timestamps) to our platform for settlement purposes.
• Fraud-detection tools: Device fingerprinting and IP-intelligence services may supplement data collected during registration and login to detect suspicious access patterns.

4. Legal Basis for Processing

sapu4d processes your Personal Data under the following legal grounds:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted — for example, managing your account, processing bets, and handling withdrawals.
• Legal obligation: Processing required to comply with applicable laws and our international gaming licence conditions, including KYC, AML, and responsible gaming mandates.
• Legitimate interests: Processing necessary for fraud detection, platform security, and improving user experience, where these interests are not overridden by your fundamental rights.
• Consent: Processing for optional purposes such as marketing communications and personalised promotional offers, where you have expressly opted in. You may withdraw consent at any time via Account Settings without affecting your ability to use the platform.

5. How We Use Your Data

5.1 Core Service Delivery

We use your Personal Data to create and manage your sapu4d account, process deposits and withdrawals in Indonesian Rupiah (IDR), settle bets and casino game outcomes, apply bonuses and cashback, enforce responsible gaming limits (deposit caps, session timers, self-exclusion), and provide 24/7 Indonesian-speaking customer support.

5.2 Security and Fraud Prevention

We analyse technical and behavioural data to detect and prevent unauthorised account access, multiple-account fraud, bonus abuse, money laundering, and other prohibited activities defined in our Terms & Conditions. Automated systems and human review may flag accounts for further investigation when anomalies are detected.

5.3 Regulatory Compliance

Our international gaming licence requires us to maintain records of user identity, transaction history, and betting activity for a minimum period (see Section 8). We may be obliged to disclose information to licensing authorities, law-enforcement agencies, or financial intelligence units upon lawful request.

5.4 Responsible Gaming Monitoring

Betting and session data are analysed to identify patterns that may indicate problem gambling behaviour (e.g., rapidly escalating bet sizes, extended session durations, repeated maximum deposits following losses). If our systems flag a concern, trained staff may reach out to offer responsible gaming tools or support. This processing is in both your interest and our regulatory obligation. For full details, see our Responsible Gaming page.

5.5 Marketing Communications

With your consent, we may send you personalised promotions, bonus offers, and platform news via email, SMS, or WhatsApp. Each marketing message includes an unsubscribe link or opt-out instruction. Withdrawing consent will stop marketing messages but will not affect your account or Services access.

5.6 Platform Improvement

Aggregated and anonymised usage data informs decisions about feature development, odds display, navigation design, and payment-method prioritisation (e.g., understanding that most Jakarta-based users prefer BCA while Surabaya users prefer BRI helps us optimise deposit flows). Individual users are not identifiable in these analytical datasets.

6. Sharing & Disclosure of Personal Data

sapu4d does not sell your Personal Data to third-party marketing companies under any circumstances. We share data only with the following categories of recipients and only to the extent necessary:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja receive account-holder names and transaction amounts to facilitate deposits and withdrawals. These entities are bound by Indonesian banking regulations and their own privacy frameworks.
• Identity-verification providers: KTP images and selfies are transmitted to accredited KYC vendors who perform automated facial-recognition matching and document authenticity checks. These vendors process data solely for verification purposes under contractual data-processing agreements.
• Game providers: Evolution Gaming, Pragmatic Play, Microgaming, Spribe, Pocket Games Soft, and other licensed studios receive your account identifier and session tokens to deliver game content and return round results. They do not receive your full identity documents or bank details.
• Fraud-prevention and security vendors: IP-intelligence, device-fingerprinting, and AML-screening providers receive technical identifiers to assess risk. All such vendors operate under strict data-processing agreements that prohibit secondary use of your data.
• Regulatory and law-enforcement authorities: We will disclose Personal Data to licensing regulators, financial intelligence units, or law-enforcement agencies when legally compelled to do so by a valid court order, regulatory request, or applicable law.
• Professional advisers: Lawyers, auditors, and insurers may access Personal Data under obligations of professional confidentiality where necessary to provide their services to sapu4d.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of sapu4d's business, your Personal Data may be transferred to the acquiring entity, subject to the same protections described in this policy. You will be notified of any such transfer in advance.

7. Cookies & Tracking Technologies

7.1 What Are Cookies

Cookies are small text files stored on your device by your browser when you visit a website. We also use similar technologies such as web beacons (pixel tags), local storage, and session tokens. Together, these tools allow us to recognise your device across visits, maintain your login session, and measure how the platform is used.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication tokens, security cookies that prevent cross-site request forgery (CSRF), and cookies that maintain your language and currency preferences. These cannot be disabled without breaking core functionality.
• Performance & Analytics Cookies: Collect anonymised data about how users navigate the platform — which pages are visited most often, where users drop off, and how long sessions last. This data helps us improve user experience.
• Functional Cookies: Remember your preferences such as previously used deposit method, preferred sports category, or odds format (decimal vs. fractional), reducing the need to re-configure settings each visit.
• Marketing Cookies: Used only if you have opted in to personalised marketing. These help us deliver relevant bonus offers and promotions based on your activity. They are not used to track you across third-party websites.

7.3 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies; however, disabling strictly necessary cookies will impair platform functionality and may prevent you from logging in. For marketing and analytics cookies, you may opt out via your Account Settings at any time.

8. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by our international gaming licence and applicable laws. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Anonymised datasets used for aggregate analytics are not subject to these retention limits, as they no longer constitute Personal Data.

9. Data Security

sapu4d applies industry-standard technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your browser and our servers, indicated by the HTTPS padlock in your browser address bar.
• Encryption at rest for sensitive stored data, including KTP images, bank account numbers, and password hashes (passwords are never stored in plain text; we use bcrypt with a high work factor).
• Multi-factor authentication (MFA) available for all user accounts and mandatory for platform administrators.
• Role-based access controls (RBAC) ensuring that only authorised personnel with a legitimate business need can access specific categories of Personal Data.
• Regular penetration testing by independent third-party security firms to identify and remediate vulnerabilities before they can be exploited.
• Intrusion-detection systems (IDS) and 24/7 security monitoring to identify and respond to threats in real time.
• Data segregation between production and development environments, ensuring that real user data is never used in testing.

10. Your Rights Regarding Personal Data

As a user of the sapu4d platform, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will respond within 30 days.

• Right of Access: You may request a copy of the Personal Data we hold about you, including the categories of data, the purposes for which it is processed, and the recipients with whom it has been shared.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you may request correction. For minor details such as phone number or email address, you can update these directly in Account Settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, or where you withdraw consent and no other legal basis applies. Note that regulatory retention obligations (Section 8) may prevent complete erasure of certain records.
• Right to Restriction of Processing: You may request that we limit how we use your Personal Data in certain circumstances — for example, while a disputed accuracy claim is under investigation.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a machine-readable copy of your data (JSON or CSV format) for transfer to another service provider.
• Right to Object: You may object to processing based on our legitimate interests, including profiling for fraud detection. We will honour your objection unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based solely on consent (e.g., marketing communications), you may withdraw consent at any time via Account Settings → Notification Preferences. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint: If you believe we have not handled your Personal Data in accordance with this policy, you have the right to lodge a complaint with the relevant data-protection authority in the jurisdiction under which our licence operates.

11. Protection of Minors

sapu4d Services are strictly limited to individuals aged 21 years and above. We do not knowingly collect Personal Data from persons under 21. Our KYC process is specifically designed to verify that all registered users meet this age requirement by confirming date of birth against a valid Indonesian identity document (KTP).

If we discover that Personal Data has been submitted by or on behalf of a person under 21, we will immediately close the associated account, void any pending bets, return genuine deposited funds to the originating payment method, and delete all collected data relating to that individual without delay.

Parents and guardians are encouraged to use parental control software and monitor device usage to prevent underage individuals from accessing online gambling platforms. If you believe a minor may have accessed sapu4d, please contact us immediately at [email protected].

12. International Data Transfers

sapu4d operates under an international gaming licence and may process or store data on servers located outside Indonesia. Where Personal Data is transferred internationally, we ensure that appropriate safeguards are in place, including:

• Contractual clauses in agreements with Third-Party Processors that impose data-protection obligations equivalent to or exceeding those in this policy.
• Transfer to jurisdictions that provide an adequate level of data protection as assessed by recognised international standards.
• Adoption of binding corporate rules or equivalent mechanisms where data is transferred within a corporate group.

By creating an account and using sapu4d Services, you acknowledge and consent to the transfer of your Personal Data to the jurisdictions described above, subject to the protections outlined in this section.

13. Third-Party Services and Embedded Content

The sapu4d platform integrates services from licensed third-party providers — including game studios, live streaming infrastructure, and payment gateways — to deliver a complete gaming experience. When you interact with these embedded services, those providers may independently collect certain technical data (such as your IP address and device identifiers) under their own privacy policies.

sapu4d is not responsible for the privacy practices of independent third-party service providers. We select partners who maintain high data-protection standards and require contractual commitments to protect user data, but we encourage you to review the privacy policies of any third-party service you interact with directly.

14. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes in our processing activities, applicable regulations, or business operations. When we make material changes — such as collecting new categories of data, introducing new processing purposes, or changing how long we retain data — we will notify registered users by email and display a prominent notice on the platform at least 14 days before the changes take effect.

For minor or non-material changes (such as editorial corrections or clarifications that do not alter the substance of the policy), we will update the "Last Updated" date at the top of this page without issuing a separate notification. We encourage you to review this policy periodically to stay informed of how we protect your data.

15. Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact us using the details below. All communications must be in English or Indonesian (Bahasa Indonesia); our data team will respond in English.

• Email: [email protected] — use subject line "Privacy Policy Query" for fastest routing
• Live Chat: Available 24/7 directly on the platform — ask to be connected to the Data Protection team
• Response Time: We aim to acknowledge all privacy-related requests within 3 business days (WIB) and provide a substantive response within 30 calendar days