Privacy Policy

01 Introduction & Scope

This Privacy Policy describes how api67 ("api67", "we", "us", or "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "User") who access or use the api67 online betting and gaming platform at https://api67.cam (the "Platform").

This Policy applies to all personal data collected through: your registration and use of the Platform; your communications with our support team; your participation in promotions, surveys, or feedback programmes; and your browsing activity on the Platform. It applies regardless of whether you access the Platform via a desktop browser, mobile browser, or any other device.

api67 is primarily directed at adult residents of Indonesia aged 21 or older. Where this Policy references applicable law, it encompasses the data-protection and privacy regulations of the jurisdiction in which api67 holds its primary operating licence, as well as any Indonesian laws and regulations applicable to the processing of Indonesian residents' personal data.

02 Data Controller

For the purposes of applicable data-protection law, api67 is the data controller responsible for your personal data. This means api67 determines the purposes for which and the means by which your personal data is processed.

If you have any questions about how api67 handles your personal data, or if you wish to exercise any of the rights described in Clause 9, please contact our Data Protection team at:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: "Privacy / Data Protection Request"

api67 aims to acknowledge all data-related requests within 5 business days and to resolve them within 30 calendar days of receipt.

03 Personal Data We Collect

api67 collects several categories of personal data depending on how you interact with the Platform. The table below summarises the primary categories and examples of data within each.

api67 does not intentionally collect special-category (sensitive) personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning a person's sex life or sexual orientation, except to the minimal extent required by applicable AML or KYC regulations.

04 How We Collect Your Data

4.1 Directly From You

The majority of personal data api67 holds is provided directly by you when you register for an Account, complete KYC verification, make a deposit or withdrawal, participate in a promotion, or contact our support team. You are responsible for ensuring that all data you provide is accurate, complete, and kept up to date.

4.2 Automated Technical Collection

When you access the Platform, certain technical and usage data is collected automatically through server logs, session cookies, and analytics tools. This includes your IP address, browser fingerprint, device identifiers, and interaction patterns within the Platform. This data is used primarily for platform security, fraud detection, and performance optimisation.

4.3 Third-Party Sources

api67 may receive data about you from the following third-party sources where applicable and lawful:

• Identity verification providers — to cross-check KTP details and confirm identity during KYC;
• Payment processors — confirmation data from BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, GoPay, DANA, ShopeePay, and LinkAja to validate deposit and withdrawal transactions;
• Anti-fraud and AML screening services — sanctions list checks, politically exposed person (PEP) screening, and adverse-media monitoring;
• Self-exclusion registries — where applicable, to enforce voluntary exclusion commitments made by Users.

05 Purposes of Processing & Legal Basis

api67 processes your personal data only where a valid legal basis exists. The primary purposes for which api67 processes personal data, and the corresponding legal basis, are set out below:

• Account registration and management — Contract performance
  Processing your registration details and maintaining your Account is necessary to fulfil the contractual relationship with you as a Platform user.
• KYC and age verification — Legal obligation
  api67 is obligated to verify that all users are at least 21 years of age and to confirm identity to satisfy applicable anti-money-laundering requirements.
• Payment processing — Contract performance
  Processing deposits and withdrawals in IDR via local banks and e-wallets is a core element of the service api67 provides.
• Fraud prevention and platform security — Legitimate interest
  api67 has a legitimate interest in detecting and preventing fraud, money laundering, collusion, and other prohibited conduct that could harm the Platform and its users.
• Responsible gaming compliance — Legal obligation / Legitimate interest
  Processing self-exclusion status, deposit limit configurations, and at-risk indicators is necessary to fulfil api67's responsible gaming obligations and to protect users from gambling-related harm.
• Customer support — Contract performance
  Retaining support communications enables api67 to provide consistent, effective assistance and to maintain a record of interactions for dispute resolution.
• Marketing communications — Consent
  Where you have opted in, api67 will send you promotional emails, bonus offers, and platform updates. You may withdraw consent at any time by contacting support.
• Platform analytics and improvement — Legitimate interest
  Analysing aggregated usage data helps api67 improve the Platform experience for Indonesian users, optimise loading performance, and prioritise feature development.

06 Data Sharing & Disclosure

api67 does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data-processing agreements:

6.1 Service Providers

We engage trusted third-party service providers to support the operation of the Platform, including payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, GoPay, DANA, ShopeePay, LinkAja), identity verification and KYC providers, cloud infrastructure and hosting providers, fraud detection and AML screening services, and customer support software vendors. These providers process your data only on api67's documented instructions and are prohibited from using it for their own purposes.

6.2 Game and Software Providers

Certain game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive anonymised or pseudonymised session data necessary to operate their games within the api67 Platform. No directly identifiable personal data (such as your name or KTP number) is shared with game providers beyond what is technically required for game delivery.

6.3 Legal and Regulatory Disclosures

api67 may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other governmental bodies where required by applicable law, pursuant to a valid legal order, or where api67 reasonably believes disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights or safety of api67, its users, or the public; or (c) detect, prevent, or address fraud, security, or technical issues.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of api67's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

07 International Data Transfers

api67 operates an internationally-hosted platform. As a result, your personal data may be transferred to, stored in, and processed in countries other than Indonesia, including countries where the data-protection laws may differ from those applicable in Indonesia.

Where such international transfers occur, api67 takes steps to ensure your personal data receives an adequate level of protection, including: relying on standard contractual clauses approved by the relevant data-protection authority; implementing supplementary technical and organisational security measures; and selecting service providers with established, auditable data-protection programmes.

By using the api67 Platform and providing your personal data, you acknowledge and consent to these international transfers subject to the safeguards described in this Clause.

08 Data Retention

api67 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The general retention periods applicable to the main categories of data are as follows:

• Account and identity data: Retained for the duration of the Account relationship and for a minimum of five (5) years following Account closure, in compliance with AML record-keeping requirements.
• Financial and transaction data: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial regulations.
• KYC documents: Retained for a minimum of five (5) years following Account closure or the last transaction date, whichever is later.
• Support and communications data: Retained for two (2) years from the date of the relevant interaction, or longer where subject to an unresolved dispute or formal complaint.
• Responsible gaming data: Self-exclusion and limit records are retained for a minimum of five (5) years to prevent circumvention of player-protection measures.
• Technical and usage data: Aggregated analytics data is retained indefinitely in anonymised form; individually identifiable technical logs are retained for up to twelve (12) months.
• Marketing consent records: Retained until you withdraw consent, and for one (1) year thereafter as evidence of the consent given.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with api67's internal data lifecycle procedures.

09 Your Data Rights

Subject to applicable law, you hold the following rights in relation to personal data that api67 holds about you. To exercise any of these rights, contact our support team at [email protected] with the subject line "Privacy / Data Protection Request".

api67 will respond to all verified data-rights requests within 30 calendar days. In complex cases, this period may be extended by a further 60 days with prior notification to you. api67 reserves the right to request proof of identity before actioning any data-rights request to prevent unauthorised disclosure.

10 Cookies & Tracking Technologies

api67 uses cookies and similar tracking technologies (such as local storage and session tokens) to operate and improve the Platform. The categories of cookies api67 uses are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. They cannot be disabled without impairing your use of the Platform.
• Functional Cookies: Remember your preferences such as language settings, game layout choices, and deposit method selections to provide a personalised experience across sessions.
• Analytics Cookies: Collect anonymised data on how Users interact with the Platform — pages visited, session duration, game categories accessed — to help api67 identify areas for improvement. No personally identifiable information is shared with analytics providers.

api67 does not use advertising or retargeting cookies, and does not permit third-party advertising networks to place cookies on the Platform.

You may manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will affect the functionality of the Platform and may prevent you from logging in or completing transactions.

11 Children's Privacy

The api67 Platform is strictly intended for adults aged 21 and over. api67 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step during Account registration, and KYC identity checks are conducted to confirm that all registered users meet this requirement.

If api67 becomes aware that personal data has been collected from a person under the age of 21 without appropriate consent, that data will be deleted promptly and the Account will be closed. If you believe that a minor has registered on the Platform, please contact our support team at [email protected] immediately.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. api67 supports the use of such tools as part of its broader commitment to responsible gaming and player protection.

12 Security Measures

api67 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Key measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and api67's servers;
• Encryption at rest for sensitive stored data including KTP details, financial account information, and password hashes (stored using one-way cryptographic hashing — api67 cannot retrieve your plaintext password);
• Role-based access controls limiting access to personal data strictly to authorised personnel with a documented operational need;
• Regular independent security audits and penetration testing conducted by qualified third-party security specialists;
• Intrusion detection and monitoring systems operating continuously to identify and respond to anomalous access patterns;
• Incident response procedures ensuring that any confirmed personal data breach is assessed, contained, and — where required by applicable law — reported to the relevant supervisory authority and affected users within the legally prescribed timeframe.

While api67 takes all reasonable steps to protect your personal data, no security system is completely impenetrable. You are responsible for maintaining the security of your Account credentials and for notifying api67 promptly if you suspect any unauthorised access to your Account.

13 Responsible Gaming Data

api67 processes a specific sub-category of personal data related to Responsible Gaming tools — including self-exclusion status, voluntary deposit limit configurations, loss limit settings, session time-out preferences, and behavioural indicators that may suggest at-risk gambling patterns. This data is processed for the purpose of fulfilling api67's player-protection obligations and is treated with the highest level of confidentiality.

Responsible Gaming data is never used for marketing profiling or shared with third parties for commercial purposes. It is used solely to enforce the protective measures you or api67 have put in place on your Account. Self-exclusion records are retained for a minimum of five (5) years to prevent re-registration during an active exclusion period.

If you wish to activate self-exclusion, deposit limits, or other responsible gaming controls, or if you have concerns about your gambling behaviour, please visit our Responsible Gaming page or contact our support team directly.

14 Amendments to This Policy

api67 reserves the right to update or modify this Privacy Policy at any time to reflect changes in applicable law, our data-processing practices, or the services we offer. Where changes are material, api67 will provide reasonable advance notice to registered Users via email notification or a prominent in-platform notice prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following the effective date of any update constitutes your acknowledgement of the revised Privacy Policy. If you do not agree to the updated terms, you should cease using the Platform and contact our support team to request Account closure.

We encourage you to review this Privacy Policy periodically to stay informed about how api67 protects your personal data.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to api67's handling of your personal data, please reach out to our team through the following channels. All contact details are provided as plain text and are not clickable links:

• Email: [email protected] — use subject line "Privacy / Data Protection Request"
• Live Chat: Available 24/7 via the in-platform support widget
• WhatsApp: +62 812 0000 0000 (available Monday–Saturday, 08:00–22:00 WIB)

For the fastest response, email is recommended for all formal data-rights requests. api67 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.