Your privacy matters to us. This document explains exactly what personal data aptoto collects, why we collect it, how we use and protect it, and what rights you hold over your own information.
aptoto is committed to protecting the privacy and personal data of every individual who interacts with our Platform. We operate as the data controller for all personal information collected through https://aptoto.cam and its associated services, including customer support communications, payment processing interfaces, and promotional channels.
This Policy applies to all current and former Members, prospective Members who have initiated but not completed registration, and any individuals who contact our support team. It covers personal data collected through the website, live chat, email correspondence, WhatsApp support, and any other digital channel operated by aptoto.
aptoto's primary market is Indonesia. All data collection and processing activities are therefore oriented toward serving Indonesian players and comply with internationally recognized data protection principles, including purpose limitation, data minimization, storage limitation, accuracy, integrity, and confidentiality.
The following definitions apply throughout this Policy:
aptoto collects only the personal data that is necessary for the specific purposes outlined in this Policy. We do not collect excessive or irrelevant data. The categories of personal data we collect are described below:
When you create an Account on aptoto, we collect your full legal name, email address, date of birth, and chosen username. This information is required to create and manage your Account and to verify your eligibility to use the Platform (you must be at least 21 years of age and a resident of Indonesia).
Before we process any withdrawal, and periodically during our account monitoring process, we collect identity verification documents. These include a copy of your Indonesian National Identity Card (KTP), a photograph of you holding your KTP, proof of address (such as a utility bill or bank statement dated within the past three months), and in some cases, a short video verification. KYC data is classified as sensitive and is subject to the highest level of access restriction within our systems.
We collect your Indonesian bank account details (bank name, account number, and account holder name) or e-wallet identifier for the purpose of processing deposits and withdrawals. We record transaction amounts, timestamps, payment method used, and transaction status. aptoto does not store full debit or credit card numbers on our servers; card transactions (if applicable) are processed through PCI-DSS-compliant third-party payment gateways.
We record all betting and gaming activity associated with your Account, including wagers placed, game types, bet amounts, outcomes, bonus usage, session durations, and total win/loss history. This data is used to provide core platform services, calculate balances, resolve disputes, and fulfill our responsible gaming obligations.
When you access the Platform, our servers automatically collect certain technical data: your IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, and session timestamps. This data is used for fraud detection, security monitoring, Platform optimization, and aggregate analytics.
If you contact our customer support team via live chat, email, or WhatsApp, we retain records of those communications — including the content of messages, timestamps, and the support agent's responses. These records allow us to maintain service continuity, train support staff, and resolve disputes.
You may voluntarily provide additional information through survey responses, promotional entry forms, or feedback submissions. This data is used solely for the stated purpose of each collection and is not retained beyond its usefulness for that purpose.
aptoto uses personal data strictly for purposes that are compatible with the reason it was collected. The primary purposes for which we process your personal data are:
aptoto processes your personal data on one or more of the following recognized legal bases depending on the activity in question:
aptoto does not sell, rent, or trade your personal data to unaffiliated third parties for their own commercial purposes. We share personal data only in the limited circumstances described below:
To process deposits and withdrawals, we share the minimum necessary financial data with our payment processing partners — including local Indonesian bank transfer operators and e-wallet providers (OVO, DANA, GoPay, ShopeePay). These partners are contractually bound to use your data solely for payment processing purposes and to maintain appropriate security standards.
KYC verification may be conducted in part by third-party identity verification service providers. These providers receive only the specific documents and data needed to complete verification and are prohibited from using that data for any other purpose.
Third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive a session token or anonymized player identifier when you launch their games. These studios do not receive your full name, bank details, or contact information through this mechanism.
We may disclose personal data to law enforcement agencies, courts, regulators, or other public authorities when required to do so by applicable law, a valid court order, or a lawful regulatory request. We will, where legally permissible, notify you of such a disclosure.
In the event of a merger, acquisition, restructuring, or sale of assets involving aptoto, your personal data may be transferred to the acquiring entity. You will be notified of any such change and of any material alteration to how your data is processed as a result.
aptoto participates in industry-standard fraud prevention networks. We may share limited, pseudonymized identifiers with partner platforms to identify and block individuals who have been flagged for fraudulent activity, bonus abuse, or money laundering. No sensitive financial data or full identity documents are shared through this channel.
aptoto retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal obligations. The table below sets out our standard retention periods by data category:
After the applicable retention period expires, personal data is securely deleted or irreversibly anonymized. Anonymized, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.
aptoto uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device by a website server. It cannot execute programs or deliver viruses to your device.
These cookies are strictly necessary for the Platform to function. They maintain your login session, remember your language preference, and protect against cross-site request forgery. You cannot opt out of essential cookies without ceasing to use the Platform.
Functional cookies remember your preferences — such as your preferred deposit method or your most recently viewed betting markets — so that the Platform behaves consistently across sessions. These cookies do not track you across other websites.
We use first-party analytics tools to understand how Members navigate the Platform. Analytics cookies collect aggregated, anonymized data about page visits, session duration, click paths, and error events. This data helps us identify performance issues and improve the user experience. No personally identifiable information is transmitted to external analytics services without your consent.
Security cookies are used as part of our fraud detection and bot-prevention systems. They collect device fingerprint signals — such as browser configuration, screen dimensions, and time zone — to distinguish legitimate users from automated traffic. This processing is carried out on the basis of our legitimate interest in maintaining platform security.
You can manage or disable non-essential cookies through your browser settings. Most modern browsers allow you to view, block, and delete cookies. Note that disabling certain cookies may impair Platform functionality. Deleting cookies does not delete your Account or personal data held on our servers.
aptoto implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, aptoto will notify affected Members without undue delay and will take all reasonable steps to contain and remediate the breach.
As a data subject, you hold a set of rights over your personal data that aptoto is committed to honoring. These rights are described below. To exercise any of them, please contact our Privacy Officer at . We will respond to all verified requests within 30 calendar days.
You may request a copy of all personal data we hold about you, along with information about how it is being used.
You may request that inaccurate or incomplete personal data be corrected without undue delay.
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
You may ask us to restrict processing of your data while a dispute about its accuracy or the lawfulness of its processing is being resolved.
Where processing is based on consent or contract, you may request your data in a structured, commonly used, machine-readable format.
You may object to processing based on our legitimate interests, including direct marketing. We will cease that processing unless we can demonstrate compelling grounds to continue.
Please note that some rights are subject to limitations. For example, we cannot erase data that we are legally required to retain for AML compliance purposes. Where we are unable to fulfill a request in full, we will explain the reason and the extent to which we are able to respond.
The aptoto Platform is strictly intended for adults aged 21 years and over. We do not knowingly collect personal data from any person under the age of 21. If you are under 21, you must not use the Platform or submit any personal data to us.
If aptoto becomes aware that personal data has been collected from a person under 21 — through age verification checks, KYC review, or any other means — that Account will be immediately suspended, all associated data will be reviewed, and any funds deposited will be returned to the original payment source after verification of the account holder's identity. The personal data of the underage individual will be securely deleted as promptly as practicable.
The aptoto Platform may contain references to third-party services — for example, links to game studio support pages or payment provider help centers. This Policy applies solely to data collected and processed by aptoto. We are not responsible for the privacy practices of any third-party website or service, and we encourage you to review the privacy notices of any external service before submitting personal data to them.
The inclusion of any reference to a third-party service does not constitute an endorsement of that service's privacy practices by aptoto.
aptoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. When material changes are made, we will publish the updated Policy on this page with a revised "Last Updated" date and will notify active Members by email or in-platform notification at least 7 days before the changes take effect.
We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revised Policy constitutes your acknowledgment of and agreement to the updated terms. If you object to any change, you may request Account closure and withdrawal of your balance in accordance with our standard withdrawal process.
If you wish to exercise any of your data rights, have a question about how aptoto handles your personal data, or wish to make a complaint about our data processing practices, please contact our dedicated Privacy Officer through any of the following channels:
All formal data subject requests must be submitted in writing (email is acceptable) and must include sufficient information to verify your identity before we can process the request. This is to ensure that we do not disclose or modify personal data in response to fraudulent requests. We will acknowledge receipt of all formal requests within 5 business days and will provide a substantive response within 30 calendar days, extendable by a further 30 days for complex requests with prior notice to you.
Every byte of data exchanged between your device and aptoto's servers is protected by bank-grade 256-bit SSL/TLS encryption, ensuring your personal and financial information is never exposed in transit.
Your personal data is accessible only to authorized aptoto personnel with a specific operational need. Role-based access controls and mandatory multi-factor authentication are enforced across all internal systems.
KYC documents, financial records, and account data are stored in encrypted form at rest. Physical and logical access to our data infrastructure is restricted to authorized engineers only.
aptoto collects only the personal data that is genuinely necessary for service delivery, identity verification, and legal compliance. We do not harvest data speculatively or share it for third-party advertising.
Independent cybersecurity professionals conduct penetration testing and vulnerability assessments at least twice per year. Any identified weaknesses are remediated within clearly defined response windows.
Access, rectify, export, or delete your personal data at any time by contacting our Privacy Officer. We acknowledge all requests within 5 business days and resolve them within 30 calendar days.
Our support team and dedicated Privacy Officer are available around the clock to answer your data protection questions. You can also review our full Terms & Conditions or visit our FAQ for quick answers to common questions.