Privacy Policy — How ai77 Protects Your Data

For the purposes of this Privacy Policy, the data controller responsible for the personal information collected through the ai77 Platform is ai77, operating the website at ai77.io. As data controller, ai77 determines the purposes for which and the means by which personal data is processed.

If you have any questions about how ai77 processes your personal data, or if you wish to exercise any of your privacy rights, please contact our dedicated privacy team using the details set out in Section 14 of this policy.

References in this policy to "ai77", "we", "us", or "our" refer to the data controller. References to "you", "your", or "the Player" refer to any individual whose personal data we collect and process.

ai77 collects the following categories of personal data, depending on how you interact with the Platform:

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used for age verification — players must be 21 or older).
• Gender (optional, collected during registration).
• Username chosen at the time of account creation.
• National ID number or passport number, collected during KYC verification.

2.2 Contact Data

• Email address (used for account communications, support, and, where you have opted in, marketing).
• Mobile phone number (used for account security notifications and, where applicable, two-factor authentication).
• Residential address including city (e.g., Dhaka, Chittagong, Sylhet, Khulna) and postal code.

2.3 Financial & Payment Data

• Payment method identifiers: bKash account number, Nagad account number, Rocket account number, Upay account number, or masked Visa/Mastercard card number.
• Transaction history: deposit amounts, withdrawal requests, dates, and reference numbers.
• Account wallet balance held in Bangladeshi Taka (BDT).
• Source-of-funds documentation where requested for anti-money laundering compliance.

2.4 KYC Verification Documents

• Scanned or photographed copy of government-issued photo ID (National Identity Card, passport, or driving licence).
• Proof of address document where required (utility bill, bank statement issued within the last three months).
• Selfie or liveness-check image used to match against the photo ID submitted.

2.5 Behavioural & Usage Data

• Betting and gaming history: games played, stake amounts, outcomes, session durations.
• Login timestamps, IP addresses at the time of login, and device identifiers.
• Pages visited, features used, and navigation patterns within the Platform.
• Responsible gaming tool settings: deposit limits configured, self-exclusion requests, session time preferences.

2.6 Technical Data

• IP address and approximate geolocation derived from it.
• Browser type and version, operating system, screen resolution.
• Cookie identifiers and session tokens (see Section 7 on Cookies).
• Referral source (the URL from which you arrived at ai77.io, if applicable).

2.7 Communications Data

• Content of support chat conversations and email correspondence with ai77 customer support.
• Feedback and survey responses submitted voluntarily.
• Complaints and dispute records.

ai77 collects personal data through the following channels and mechanisms:

• Direct collection at registration: When you create an account on ai77.io, you provide identity, contact, and age information directly via the registration form.
• KYC submission: When you complete identity verification, you upload documents and images through our secure KYC portal.
• Deposit and withdrawal transactions: When you initiate a payment through bKash, Nagad, Rocket, Upay, Visa, or Mastercard, the relevant transaction metadata is recorded automatically in your account wallet.
• Platform activity: Your betting activity, casino game sessions, and navigation behaviour are logged automatically by our platform systems as part of normal service operation.
• Cookies and tracking technologies: Our website uses cookies, local storage, and similar technologies to maintain your session, remember preferences, and gather analytics data. See Section 7 for full details.
• Customer support interactions: When you contact us via live chat or email, the content of those communications is collected and stored for support quality and dispute resolution purposes.
• Third-party identity verification providers: We may receive identity verification results and fraud-risk signals from third-party KYC providers who process your documents on our behalf.
• Payment processors: Our payment processing partners may share transaction confirmation data and fraud-screening results with ai77 in order to complete your deposit or withdrawal.

ai77 uses your personal data for the following specific purposes:

ai77 processes your personal data on one or more of the following legal bases, depending on the specific purpose:

• Contract performance: Processing that is necessary to provide the services you have requested when you register an account — including account management, payment processing, game delivery, and customer support. Without this processing, ai77 cannot operate your account.
• Legal obligation: Processing that is required to comply with applicable laws and regulations, including anti-money laundering obligations, KYC/identity verification requirements, responsible gaming mandates, and lawful requests from regulatory authorities.
• Legitimate interests: Processing carried out for ai77's legitimate business interests, where those interests are not overridden by your fundamental rights. This includes fraud prevention, network and information security, platform analytics, and improvement of our services.
• Consent: Processing that relies on your freely given, specific, informed, and unambiguous consent — primarily marketing communications and the use of non-essential cookies and tracking technologies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

ai77 does not sell your personal data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, and card scheme processors (Visa, Mastercard) receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to applicable financial data protection regulations.
• Identity verification providers: Third-party KYC and liveness-check service providers receive your identity documents and biometric check data solely to verify your identity on ai77's behalf. These providers are contractually bound to process data only for verification purposes and to delete documents once verification is complete or after the legally required retention period.
• Game content providers: Platform game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive your session token and an anonymised player identifier in order to deliver game content. They do not receive your name, contact details, or financial data.
• Fraud prevention and security services: We may share technical identifiers (IP addresses, device fingerprints, session data) with fraud detection service providers who help us identify suspicious activity and protect the integrity of the Platform.
• Legal and regulatory authorities: ai77 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where we are legally required to do so, or where disclosure is necessary to protect the legal rights of ai77 or the safety of our players.
• Professional advisers: Lawyers, auditors, and accountants who provide professional services to ai77 may have access to personal data to the extent necessary for those services, subject to strict confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of ai77's business assets, your personal data may be transferred to the acquiring entity. We will notify you via your registered email address before your data becomes subject to a different privacy policy.

ai77 uses cookies and similar tracking technologies (including local storage and session storage) on ai77.io. Cookies are small text files placed on your device that help the Platform function correctly and allow us to understand how you interact with our services.

Categories of cookies we use:

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to refuse non-essential cookies, delete existing cookies, and be notified when new cookies are set. Please note that disabling strictly necessary cookies may prevent parts of the Platform from functioning correctly.

Detailed cookie names, their specific purposes, and their expiry periods are available on request by contacting [email protected].

ai77 retains your personal data for as long as necessary to fulfil the purposes described in this policy, and in accordance with applicable legal and regulatory retention obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account relationship with ai77, plus a minimum of five years following account closure, as required by anti-money laundering regulations.
• KYC documents: Retained for a minimum of five years from the date of account closure or the date the document was submitted, whichever is later, in compliance with applicable financial regulations.
• Transaction and financial records: Retained for a minimum of five years from the date of each transaction, as required by tax and anti-money laundering obligations.
• Betting and gaming history: Retained for five years to support dispute resolution, responsible gaming monitoring, and regulatory audit requirements.
• Customer support communications: Retained for three years from the date of the most recent communication in a support thread, to support dispute resolution and service quality review.
• Marketing consent records: Retained for the duration of the consent plus three years, to demonstrate compliance with consent obligations.
• Analytics and technical logs: Retained in identifiable form for up to 13 months, after which they are aggregated and anonymised.

When a retention period expires, ai77 will securely delete or irreversibly anonymise the relevant data. Where deletion is not technically possible due to backup systems, the data will be isolated and protected from further active processing until deletion becomes possible.

ai77 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption in transit: All data exchanged between your browser or mobile device and ai77.io is encrypted using TLS 1.2 or higher (256-bit SSL). The Platform enforces HTTPS on all pages.
• Encryption at rest: Sensitive personal data and financial records stored in ai77's databases are encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to systems holding personal data is restricted on a strict need-to-know basis. All administrative access requires multi-factor authentication. Access rights are reviewed regularly and revoked promptly when no longer required.
• Intrusion detection and monitoring: ai77's infrastructure is monitored continuously for suspicious activity, unauthorised access attempts, and anomalous data flows.
• Vulnerability management: Regular security assessments and penetration tests are conducted on the Platform to identify and remediate vulnerabilities before they can be exploited.
• Staff training: All ai77 personnel who handle personal data receive regular training on data protection obligations, phishing awareness, and secure data handling practices.
• Incident response: ai77 maintains a documented data breach response procedure. In the event of a security incident that poses a risk to your rights and freedoms, we will notify affected players and relevant authorities in accordance with our legal obligations.

While ai77 takes every reasonable precaution to protect your data, no internet-based platform can guarantee absolute security. You are also responsible for protecting your own account credentials and notifying us promptly if you suspect any unauthorised access to your account.

As a data subject, you have the following rights in relation to the personal data ai77 holds about you. To exercise any of these rights, please contact [email protected] with your full name, registered email address, and a clear description of your request. We will respond within 30 days of receiving a verified request.

• Right of access: You have the right to request a copy of the personal data ai77 holds about you, together with information about how it is being used.
• Right to rectification: If any personal data ai77 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed.
• Right to erasure ("right to be forgotten"): You may request that ai77 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the processing is unlawful. This right is subject to legal retention obligations — we cannot delete data that we are required by law to retain.
• Right to restriction of processing: In certain circumstances, you may request that ai77 restrict the processing of your data — for example, while we are verifying the accuracy of data you have contested.
• Right to data portability: Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling, where you believe your fundamental rights and freedoms override ai77's interests. You also have an unconditional right to object to direct marketing at any time.
• Right to withdraw consent: Where ai77 processes your data on the basis of consent (for example, for marketing communications or non-essential cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The ai77 Platform is strictly for adults aged 21 and over. ai77 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step during the KYC process, and we apply age-screening measures at registration to prevent minors from accessing the Platform.

If ai77 becomes aware that it has inadvertently collected personal data from an individual under 21, we will immediately close that account, void all associated bets, and securely delete the personal data collected, returning any deposited funds (net of amounts already withdrawn) to the original payment source.

If you believe that a minor may have accessed ai77.io using fraudulent information, please contact us immediately at [email protected] so we can take appropriate action. ai77 recommends that parents and guardians use parental control software to prevent minors from accessing gambling websites. A list of parental control tools is available on our Responsible Gaming page.

ai77 operates primarily to serve players in Bangladesh. However, some of our service providers — including identity verification partners, fraud detection services, and cloud infrastructure providers — may process data in jurisdictions outside Bangladesh.

Where personal data is transferred outside Bangladesh to a jurisdiction that does not have equivalent data protection standards, ai77 implements appropriate safeguards to ensure that your data remains protected to a standard consistent with this Privacy Policy. These safeguards may include:

• Contractual clauses with service providers that impose data protection obligations equivalent to those described in this policy.
• Use of service providers that are certified under internationally recognised data security standards (such as ISO 27001 or SOC 2 Type II).
• Data processing agreements that restrict the purposes for which transferred data may be used.

By using the ai77 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Bangladesh as described in this section. If you have questions about specific international transfers, please contact [email protected].

ai77 reserves the right to update or amend this Privacy Policy at any time. We will always post the revised version on this page with an updated effective date at the top. Where changes are material — meaning they significantly affect your rights or the way we use your data — we will notify you by email to your registered address and display a prominent notice on the Platform for a minimum of 30 days before the changes take effect.

Your continued use of the ai77 Platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree with any changes, you should close your account and cease using the Platform before the changes take effect. To close your account, contact [email protected].

We encourage you to review this Privacy Policy periodically to stay informed about how ai77 protects your personal data. The version history below records the dates of material updates:

• 1 January 2026 — Initial version published. Covers data collection, retention, third-party sharing, cookies, and player rights.

If you have any questions, concerns, or complaints about this Privacy Policy or about how ai77 handles your personal data, or if you wish to exercise any of your privacy rights as described in Section 10, please contact our privacy team using the details below.

All contact details must be used as plain text only and are not clickable links:

• Privacy requests and data subject rights: [email protected]
• General support enquiries: [email protected]
• KYC and verification queries: [email protected]

We will acknowledge your request within 5 business days (Bangladesh Standard Time, UTC+6) and provide a substantive response within 30 calendar days. If your request is complex or you have submitted multiple requests, we may extend the response period by a further 30 days, in which case we will notify you of the extension before the initial deadline expires.

Please include the following information in all privacy-related correspondence to help us process your request efficiently:

• Your full name as registered on your ai77 account.
• Your registered email address.
• A clear description of the right you wish to exercise or the matter you wish to raise.
• Any relevant account reference numbers or transaction IDs, if applicable.