bobato Privacy Policy

This page describes what we collect when you use bobato and how we keep that data protected. We collect personal information only to operate your account, process deposits and withdrawals, verify your identity, and comply with regulatory requirements in each jurisdiction where we provide service. We do not sell your data to third parties, and we encrypt sensitive information in transit and at rest.

Our privacy commitments reflect the principles behind our platform: transparency about what we do with your information, clear disclosure of how long we retain it, and straightforward access to your own data. When you contact our support team—whether through email, chat, or phone during business hours—we keep your communication records only as long as necessary to resolve your issue and then securely delete them. If you have questions about this policy after reading, our team operates in English and Indonesian and can explain how any clause applies to your account.

Our servers and processing facilities may sit outside your jurisdiction. We comply with data-protection standards applicable in each region where we operate. By using bobato, you consent to the collection, processing, and storage of your information as described here.

What We Collect and How We Use Your Data

Account Registration and Identity Verification

When you open an account on bobato, we collect your name, email address, phone number, date of birth, and residential address. We use this information to create your account, authenticate you at login, and comply with anti-money-laundering (AML) and know-your-customer (KYC) requirements. To verify your identity, we may request government-issued identification, address proof (utility bill or bank statement), and in some cases a selfie or video call with our verification team. We retain these documents only for the duration required by law—typically three to seven years depending on your jurisdiction—then securely delete them.

Our KYC process protects both your account and our compliance obligations. We do not share your identity documents with third parties except where required by law enforcement or regulatory bodies. When we conduct verification, our team operates during standard business hours in English and Indonesian. Response times typically range from a few hours to 24 hours on business days. If your verification is declined, we explain the reason and offer an opportunity to resubmit corrected documents.

Deposits, Withdrawals, and Payment Processing

We collect payment information when you deposit or withdraw. For DANA, e-wallet, mobile banking, and local payment transactions, we receive confirmation from your payment provider but do not store your login credentials. For bank transfers via online payment, e-wallet, mobile banking, or local payment, we retain your account number and bank name for settlement matching and fraud prevention. We do not store card numbers or full banking credentials; we rely on your payment provider's secure infrastructure. Our payment processors operate under their own privacy policies, which we encourage you to review.

We log every transaction for audit, dispute resolution, and regulatory compliance. If a withdrawal is delayed, we investigate using these logs and keep you informed. We may place holds on withdrawals if we detect suspicious patterns—for example, rapid deposit-and-withdrawal cycles or transfers to accounts not in your name. These holds are temporary and serve to protect your account from fraud. During review, we retain your transaction data pending clearance.

Slot Tournaments, Live Casino, and Sportsbook Activity

We record your participation in bobato tournaments (Aviator, Sweet Bonanza, Gates of Olympus, Fortune Tiger, Mahjong Ways), live casino sessions, and sportsbook wagers. This data includes entry amounts, game duration, outcomes, and timestamps. We use this information to settle payouts, detect fraud or collusion, and calculate your account balance. We do not use this data for marketing purposes or share it with game developers without your consent. If you contact support about a tournament entry or game outcome, we access these records to investigate your query and may retain the case notes for a limited period.

We keep your gameplay data confidential and use it only to operate your account and comply with anti-fraud standards. We do not sell this information.

Technical and Communication Data

When you access bobato via browser or mobile PWA, we log your IP address, device type, operating system, and browser version. We use this data to diagnose technical issues, prevent unauthorized access, and defend against fraud. Our web server logs include timestamps of your sessions and pages accessed; we retain these logs for up to 90 days. We do not track your behavior outside of bobato or link your session data to external websites.

We use cookies to maintain your login state and preferences. These are functional cookies necessary for bobato to operate; we do not use advertising or tracking cookies. You may disable cookies in your browser, but this will prevent you from logging in. When you contact our support team via email or chat, we retain your conversation records for 30 days to provide continuity across multiple inquiries. After resolution, we securely delete these records unless you request otherwise or they are required for dispute resolution.

Your Rights and Our Data Retention

Your Rights on bobato

You have the right to access, correct, or delete your personal data held on bobato. To exercise these rights, contact our support team with your account email and a clear request. We respond within 30 days. You may request a copy of all data we hold about you in a portable format. You may also request that we stop using your data for non-essential purposes, such as account activity summaries by email, though this does not affect our legal obligations to retain transaction records.

If you believe we have violated your privacy rights or processed your data unlawfully, you may lodge a complaint with the data protection authority in your jurisdiction. We are committed to resolving disputes directly; contact our support team first so we can address your concern. We will not retaliate against you for exercising any of these rights.

Data Retention and Deletion

We retain account registration data (name, email, phone, address, verification documents) for the duration of your account plus three to seven years after closure, depending on your jurisdiction's regulatory requirements. We retain transaction records (deposits, withdrawals, gameplay) for a minimum of five years to comply with financial crime prevention standards. Once this retention period expires, we securely delete or anonymize the data.

If you close your account, we mark it as inactive but do not immediately delete associated data. You may request full deletion of your account after the mandatory retention period has elapsed. We will delete gameplay records, chat logs, and non-essential profile information upon request, subject to regulatory holds. Certain data—such as transaction records tied to deposits—must be retained for legal compliance and cannot be deleted.

Third Parties and Data Sharing

We share your data with third-party processors only when necessary to operate bobato. This includes payment processors (DANA, e-wallet, mobile banking, local payment, and banking partners), identity verification providers, and fraud-detection services. We also share data with law enforcement or regulatory bodies when required by law. We do not sell your data to advertisers, data brokers, or marketing companies. Our processors operate under written data-protection agreements that require them to handle your information securely and only for the purposes we specify.

Our servers may sit in jurisdictions outside Southeast Asia. We ensure that any such location maintains data-protection standards equivalent to your home jurisdiction. Cross-border transfers are encrypted and subject to contractual safeguards.

Related policies

This privacy policy applies to all users of bobato regardless of location, subject to the jurisdiction-restricted access we maintain. We review and update this policy periodically to reflect changes in our practices or regulatory requirements. Material changes will be notified to you via email or a prominent notice on our site. Your continued use of bobato after such changes constitutes your acceptance of the updated policy. If you have questions about how we handle your data, our support team is available during business hours to provide clarification.