bolacashPrivacy Policy

We encrypt your data when it travels to our servers and when it sits at rest. This page describes what we collect when you use bolacash, how we keep that data protected, and your rights to access or delete it. We collect only the information needed to run your account, process deposits and withdrawals, and comply with anti-fraud requirements.

When you open a bolacash account, we ask for email, phone number, and date of birth. During identity verification (KYC), we ask you to upload a government ID and selfie. When you deposit or withdraw, we know your payment method (DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, or bank account), the amount, and the timestamp. All this data is encrypted and never shared outside the bolacash team except where required by law or to process your transaction.

We do not sell your information. We do not rent it to advertisers. We do not use your game activity to profile you for marketing purposes. Your data exists to serve you—to protect your account, process your funds safely, and help you access services available in your jurisdiction.

What Data We Collect and How We Use It

Account Information

When you sign up for bolacash, we collect your email address, phone number, date of birth, and username. We use email to send account notifications (login alerts, payment confirmations, password resets). We use phone number to enable two-factor authentication (2FA) and to send verification codes during account recovery. We use date of birth to verify you are of legal age and to identify you if you need account support. Your username is publicly visible to other players on bolacash (in tournaments or live-table lobbies) but is not linked to your real name.

Identity Verification Data

We collect government-issued ID (KTP, SIM, Paspor, or equivalent) and a selfie during account verification. We use this data to comply with anti-money-laundering regulations and to prevent fraud. We store these documents encrypted in a separate, access-restricted database. We do not share them with any third party. We delete ID and selfie uploads after 7 years, unless we are legally required to retain them longer for compliance. You can request deletion of your ID and selfie anytime by contacting our support team, though withdrawal and account access may be restricted until re-verification is complete.

Payment and Transaction Data

When you deposit or withdraw via DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, or bank transfer, we know the payment method, amount, timestamp, and transaction status (pending, completed, failed). We do not store your wallet PIN, bank password, or card number—payment providers (mobile banking, your bank, etc.) handle authentication. We keep transaction history for 7 years for accounting and dispute resolution. You can view your complete transaction history anytime in the bolacash app.

Game and Betting Activity

We record every bet, spin, live-table hand, and esports wager you place on bolacash. We record the game title, your stake, the outcome, and your balance change. We use this data to detect fraud (unusual patterns, rapid account drains, impossible win rates). We also use aggregated, anonymized game data to improve our platform and detect technical issues. Your individual game history is private and never shared with other players or third parties. You can access your complete game history in the bolacash app under Account > History.

Login and Security Data

We log every login to your bolacash account—device type, timestamp, approximate location (derived from IP address), and login status (success or failure). We use this to detect unauthorized access. If we see a login from an unexpected location (e.g., Jakarta one minute, then Bandung subject to verification later, which is impossible by car), we may flag the login or request additional verification. You can view your login history anytime in Account Settings > Security > Login History and log out other active sessions.

Data Protection, Third Parties, and Your Rights

We store your data on encrypted servers located outside Indonesia (usually Singapore or Australia). We use TLS encryption in transit and AES-256 encryption at rest. Our servers are backed up daily and isolated from the public internet. Only bolacash staff with explicit access permissions can read your data. We audit our infrastructure monthly and conduct annual third-party security reviews.

We work with third-party processors: payment providers (DANA, e-wallet, mobile banking, etc.) to process deposits and withdrawals; email service providers to send account notifications; and hosting providers (Amazon Web Services, Google Cloud) to run our infrastructure. We have data-processing agreements with all third parties that require them to protect your data and use it only to serve you. We do not sell your data to data brokers, advertisers, or any other company.

Cookies and Tracking

Our website and mobile app use essential cookies to keep you logged in, remember your preferences (language, theme), and track sessions. We do not use cookies for marketing or advertising. We do not track your activity across other websites. If you disable cookies in your browser, you may not be able to log into bolacash. Our mobile app does not use cookies but stores a session token securely on your device.

Data Retention and Deletion

We retain your account data as long as your bolacash account exists. If you close your account, we anonymize your data after 30 days and delete it after 7 years (to comply with financial regulations). Transaction and bet history are retained for 7 years for accounting and dispute resolution. You can request early deletion, but we may retain aggregated, anonymized data indefinitely for statistical and compliance purposes.

Jurisdiction and Legal Compliance

bolacash operates only in jurisdictions where online gaming is legal. Your data may be processed and stored outside your home country (Singapore, Australia, or other regions where we host infrastructure). By using bolacash, you consent to this cross-border data processing. We comply with applicable data-protection laws (including Indonesia's Law No. 27 of 2022 on Personal Data Protection, if applicable to your use). If we receive a legal request to disclose your data (court order, government subpoena), we comply only if legally required and, where possible, notify you first.

We regularly update this policy. We notify you of material changes via email at least 30 days in advance. Continued use of bolacash after the update date means you accept the revised policy. If you have questions about our privacy practices, contact [email protected] or use the Help Centre in the bolacash app.