eviltoto Platform Privacy Notice

This page describes what we collect when you use eviltoto and how we keep that data protected. We collect personal information—name, email, phone number, date of birth, government ID—only to verify your identity, process your deposits and withdrawals, and comply with local law. We do not sell your data to third parties or use it for marketing outside of eviltoto service announcements.

Our eviltoto platform processes payment information when you deposit via DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, or bank transfers through mobile banking, local payment, online payment, and e-wallet. We tokenize payment credentials so we never store card numbers or e-wallet tokens in plaintext. Your account balance, transaction history, and game activity are encrypted and kept separate from your personal identity information.

We undertake to be transparent about what we collect, who we share it with, how long we keep it, and what rights you have. This notice sets out our commitments under eviltoto's privacy policy.

What We Collect and How We Use It

We collect data in two categories: identity data and activity data. Identity data includes your full name, date of birth, email address, phone number, and government ID (passport, national ID card, or driver's licence). We request identity data once during account registration and use it to verify you are eligible to access eviltoto services, to comply with Know Your Customer (KYC) regulations, and to process withdrawals to DANA, e-wallet, mobile banking, or bank accounts.

Activity data includes your account login history, deposit and withdrawal transactions, game selections, bet amounts, game outcomes, and customer-support interactions. We collect activity data automatically when you use eviltoto. This data helps us detect fraud, resolve disputes, audit gameplay fairness, and improve our platform.

Personal information: Name, date of birth, phone, email. Used for account verification and withdrawal processing.
Payment data: Tokenized payment credentials, deposit history, withdrawal requests. Never stored as card numbers or plaintext tokens.
Activity logs: Login timestamps, bet history, game outcomes, support tickets. Used for security and dispute resolution.
Device data: IP address, browser type, operating system. Used to detect unauthorized access and prevent account compromise.

Data Protection and Encryption

We encrypt all communication between your device and our eviltoto servers using SSL (Secure Socket Layer). Data in transit is protected with TLS 1.2 or higher. Data at rest—stored on our servers—is encrypted using industry-standard AES-256 encryption. Your password is hashed using bcrypt; we do not store it in plaintext and cannot recover it.

We keep personal identity data and activity data in separate systems. When you withdraw, our system matches your encrypted identity record to your account to process the payment; the withdrawal itself does not expose your full personal information to our payment processors.

Third-Party Processors

We use third-party vendors to process payments. When you deposit via local payment, online payment, e-wallet, mobile banking, or local payment, those e-wallet providers process the transaction and share a confirmation token with eviltoto; we do not store your e-wallet credentials. When you transfer via online payment, e-wallet, mobile banking, or local payment, the bank processes the transfer; we receive only the settlement confirmation.

We also use third-party hosting providers for our servers. Our hosting provider may store data outside your jurisdiction; we ensure they encrypt data and comply with industry-standard security practices. We do not share your data with analytics providers, advertisers, or social media platforms.

Data location: Our servers may sit in jurisdictions outside Indonesia. We apply the same encryption and access controls regardless of server location. Your data is subject to this privacy notice first, then to the legal framework of the jurisdiction where servers reside.

Cookies and Tracking

We use session cookies to keep you logged into eviltoto while you play and to prevent session hijacking. Session cookies expire when you log out. We do not use persistent cookies (cookies that survive after logout) to track your behaviour across sites.

We do not use third-party tracking pixels, analytics services, or advertisement networks on eviltoto. We log your IP address and user-agent for security purposes—to detect account compromise and prevent fraud—but we do not share this data with external services.

Data Retention and Your Rights

We retain your account data—name, contact information, transaction history—for seven years or as required by law, whichever is longer. If you close your eviltoto account, we retain the data for the same retention period for dispute resolution and regulatory compliance. You may request we delete your data after the retention period; we will comply where law permits.

You have the right to access your personal data held by eviltoto. You may request a copy of your data, request corrections if information is inaccurate, or ask us to limit how we use your data. Contact eviltoto support through in-app messaging or email to exercise these rights. We respond to data access requests within 14 days.

Account closure: If you close your eviltoto account, we disable login access immediately. We retain identity and transaction data for seven years for legal compliance; you may request data deletion after that period.

Updates to Our Privacy Policy

We may update this privacy notice as our services evolve or as laws change. Material changes—changes that expand data collection, add new third parties, or alter how we use your data—are communicated via email to your registered address at least 30 days before they take effect. Continued use of eviltoto after the update date means you accept the updated privacy notice.

You can review the previous version of this privacy notice on request. If you do not accept updated terms, you may close your eviltoto account; we will process account closure and data deletion according to our data retention policy.

If you have questions about our privacy practice, your data, or how we handle information from users in Jakarta, Surabaya, Bandung, Medan, or other regions where eviltoto operates, contact us through in-app support or email. We respond to privacy inquiries within 14 business days. Services on eviltoto are available only where local law permits.