api99 Privacy Policy

api99 ("we", "us", "our", or "the Platform") operates the online gambling platform accessible at https://api99.vu and all associated sub-domains and mobile interfaces. We are committed to protecting the privacy and personal data of every player who accesses, registers on, or uses our services.

This Privacy Policy describes in detail:

• What categories of personal data api99 collects from you;
• The purposes for which that data is processed;
• The legal basis on which processing is carried out;
• How long we retain your data;
• The circumstances under which we may share your data with third parties; and
• The rights you hold in respect of your personal data and how to exercise them.

This Privacy Policy forms part of api99's broader legal framework alongside our Terms & Conditions and Responsible Gaming policy. By creating an account or continuing to use the api99 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

If you do not agree with any part of this Privacy Policy, you should discontinue use of the platform and may request account closure by contacting our support team.

api99 collects personal data through several channels: information you provide directly at registration or during KYC verification, data generated automatically through your use of the platform, and in limited circumstances, information received from trusted third-party service providers.

2.1 Information You Provide Directly

2.2 Data Collected Automatically

When you access the api99 platform, our systems automatically record certain technical and behavioural data including:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, games played, session duration, betting history, wagering patterns, login timestamps, and in-platform navigation path.
• Location Data: Approximate geographic location derived from your IP address (country and city level — for example, Jakarta, Surabaya, Bandung, Bali). api99 does not access GPS or precise device location data.
• Cookie & Tracker Data: Session cookies, persistent cookies, and similar tracking technologies as described in Section 6 of this Policy.

2.3 Data From Third Parties

In limited circumstances, api99 may receive personal data about you from third-party sources, including:

• Identity verification and fraud prevention service providers used during the KYC process;
• Payment processors and banking partners, to confirm the status of transactions; and
• Publicly available sources and sanctions screening databases, for anti-money laundering (AML) compliance purposes.

In all cases, api99 ensures that any third-party data sharing arrangement is governed by appropriate data protection agreements.

api99 uses your personal data for the following purposes, each of which is described alongside its legal basis in Section 4:

• Account Management: To create, maintain, and administer your player account, including processing deposits and withdrawals in Indonesian Rupiah (IDR) and maintaining your account balance and transaction history.
• Identity & Age Verification (KYC): To verify that you are at least 21 years of age and that your identity matches the details you provided at registration, in compliance with our responsible gaming and anti-fraud obligations.
• Service Delivery: To provide access to all games and betting markets on the api99 platform, including slots, live casino, sportsbook (including mix parlay accumulators and BRI Liga 1 markets), and all other services.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeover attempts, and other prohibited or illegal activities.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and maintain records of all support interactions for quality and training purposes.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling and to administer any responsible gaming tools you activate, including deposit limits, cooling-off periods, and self-exclusion requests.
• Marketing & Promotions: Where you have opted in to receive marketing communications, to send you information about bonuses, seasonal promotions (such as Ramadhan and Idul Fitri offers), and platform updates. You may opt out at any time via account settings or by contacting support.
• Platform Improvement: To analyse aggregated usage data in order to improve the platform's performance, user interface, game selection, and overall player experience.
• Legal Compliance: To comply with applicable legal and regulatory obligations, including responding to lawful requests from courts, law enforcement agencies, or regulatory bodies.

api99 processes personal data on one or more of the following legal bases, depending on the specific purpose of processing:

api99 does not sell your personal data. We share personal data only in the following limited circumstances and always subject to appropriate safeguards:

• Payment Processors & Banking Partners: Your name, account number, and transaction details are shared with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing deposits and withdrawals.
• KYC & Identity Verification Providers: Verification documents submitted during the KYC process are shared with our contracted identity verification partner for the purpose of confirming identity and age. These providers operate under strict confidentiality obligations.
• Fraud Prevention & AML Services: Certain transaction data and identity information may be shared with third-party fraud prevention and AML screening services to detect and prevent financial crime.
• IT & Infrastructure Providers: api99 uses cloud hosting, data storage, and cybersecurity service providers to operate the platform. These providers process data on our behalf under data processing agreements and are not permitted to use your data for their own purposes.
• Legal & Regulatory Authorities: api99 will disclose personal data to courts, law enforcement agencies, government bodies, or regulatory authorities when required to do so by a valid legal process, court order, or applicable law — including in connection with the investigation of financial crime or underage gambling.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of api99's business assets, player data may be transferred to the successor entity, subject to the same privacy protections described in this Policy. Affected players will be notified in advance.

api99 uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain session security, and to understand how players interact with our services. The following categories of cookies are used:

api99 does not use third-party advertising cookies or behavioural profiling cookies that track you across other websites. You may configure your browser to block or delete cookies; however, please note that disabling strictly necessary cookies will prevent you from logging in to your api99 account.

api99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account's active status, plus a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission, as required by applicable anti-money laundering legislation.
• Transaction Records: Deposit and withdrawal histories are retained for a minimum of five (5) years from the date of each transaction.
• Support Communications: Chat transcripts and email correspondence are retained for up to three (3) years from the date of the interaction.
• Marketing Preference Records: Consent and opt-out records are retained for the duration of the account plus three (3) years to demonstrate compliance with marketing obligations.
• Technical & Log Data: Server logs and security event records are retained for up to twelve (12) months, unless a specific investigation requires extended retention.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

api99 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security programme includes the following measures:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or app and api99 servers is encrypted in transit using TLS 1.3, the current industry standard for secure web communications.
• Data Encryption at Rest: Sensitive data fields — including passwords (stored as salted cryptographic hashes), financial account details, and KYC document files — are encrypted at rest using AES-256 encryption.
• Access Controls: Role-based access controls restrict internal staff access to personal data on a strict need-to-know basis. All privileged access events are logged and audited.
• Two-Factor Authentication (2FA): api99 offers optional 2FA for all player accounts. We strongly recommend enabling 2FA to provide an additional layer of protection beyond your password.
• Penetration Testing: api99 engages independent security professionals to conduct regular penetration tests of the platform, with identified vulnerabilities remediated according to a defined priority schedule.
• Incident Response: api99 maintains a documented security incident response plan. In the event of a data breach that poses a risk to player rights, api99 will notify affected players promptly and take all necessary remediation steps.

As a registered player on the api99 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team via Live Chat or email at [email protected]. api99 will respond to all verifiable rights requests within thirty (30) days.

The api99 platform is strictly intended for adults aged 21 and above. api99 does not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is a mandatory component of the account registration and KYC process.

If api99 becomes aware that personal data has been submitted by or on behalf of a person under the age of 21, the associated account will be immediately suspended pending investigation, all data collected will be securely deleted without unnecessary delay, and any funds deposited will be returned to the originating payment account where possible.

Parents and guardians who believe that a minor in their care may have accessed the api99 platform are urged to contact our support team immediately at [email protected]. api99 takes underage access extremely seriously and will act swiftly on all such reports.

api99 operates internationally and, as such, some of your personal data may be processed by our contracted service providers in countries outside of Indonesia. This may include data processed by cloud infrastructure providers, KYC verification partners, and fraud prevention services.

Whenever personal data is transferred internationally, api99 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Privacy Policy. These safeguards may include:

• Contractual data protection clauses in agreements with all third-party processors operating outside Indonesia;
• Transfers to countries or organizations that have been assessed as providing an adequate level of data protection; and
• Where required, your explicit consent for specific international transfer scenarios.

If you have questions about the safeguards applied to international data transfers involving your personal data, please contact our support team.

api99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform services. When material changes are made — meaning changes that significantly affect your rights or how your personal data is used — api99 will notify registered players via email and/or a prominent notice on the platform at least seven (7) days before the amended Policy takes effect.

Minor or clarificatory changes may be made without advance notice. In all cases, the "Last Updated" date at the top of this page will be revised to reflect the date of the most recent amendment.

Your continued use of the api99 platform after an amended Privacy Policy takes effect constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should discontinue use of the platform and contact our support team to request account closure.

We encourage you to review this Privacy Policy periodically to stay informed about how api99 protects your personal data. The current version is always available at https://api99.vu/privacy-policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data by api99, please reach out to our dedicated support team through any of the following channels:

• Live Chat: Available 24/7 via the chat widget on the api99 platform — the fastest channel for account-specific privacy queries.
• Email: [email protected] — for formal privacy rights requests, please use the subject line "Privacy Rights Request — [Type of Request]". We will acknowledge receipt within two (2) business days and provide a full response within thirty (30) days.
• WhatsApp: Available 08:00–22:00 WIB (Western Indonesia Time, UTC+7) for players who prefer to communicate in Indonesian or English via messaging.

When submitting a privacy rights request, please include your registered email address and a clear description of your request so that we can verify your identity and process your request efficiently. api99 will not process rights requests submitted by unverified third parties.