Privacy Policy api888 —
Your Data, Our Responsibility

Api888 is an online gaming platform operating in Malaysia, offering a range of digital entertainment products including slot games, Live Casino and sports betting. We understand that privacy is a trust you place in us — and we take that trust seriously.

This Privacy Policy details the types of personal information we collect from you, the purposes of collection, parties who may receive that information, data retention periods, and your rights as a data subject under Malaysian law.

We believe in full transparency. That is why we have written this Privacy Policy in plain, easy-to-understand language rather than complex legal jargon. If any section is unclear, our support team is ready to help explain it to you.

Api888 acts as the data controller for all personal information collected through our platform. We are responsible for ensuring that data processing is carried out lawfully, fairly and transparently in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

Api888 collects various categories of information depending on how you interact with our platform. Below is a detailed breakdown of the types of data we collect:

We not collect credit or debit card numbers directly — all financial transactions are processed through registered and trusted third-party payment providers who handle sensitive payment data in accordance with their own PCI-DSS standards.

Every piece of data we collect has a clear purpose. api888 does not process personal information arbitrarily — each use must be supported by a valid legal basis under PDPA 2010. The following are our primary purposes for using your data:

• Account Management: To register, verify and manage your user account, including secure login and password recovery processes.
• Transaction Processing: To accurately process deposits and withdrawals, and to verify your identity for AML (Anti-Money Laundering) and KYC compliance purposes.
• Service Provision: To operate games, record betting outcomes, calculate wins and ensure a smooth and fair playing experience.
• Platform Security: To detect and prevent fraud, unauthorised access, bonus arbitrage and other unlawful activities that may harm the platform or other players.
• Service Communications: To send important notifications relating to your account, transaction confirmations, security updates and responses to support enquiries.
• Platform Improvements: To analyse aggregated usage patterns in order to improve the design, performance and user experience of the api888 platform.
• Legal Compliance: To fulfil reporting obligations to the relevant authorities as required under Malaysian law.
• Marketing Communications: To inform you of the latest promotions, bonuses and offers — only where you have given consent to receive such communications.

Your data security is api888's top priority. We continuously invest in cutting-edge security infrastructure to ensure your personal information is always protected against unauthorized access, disclosure, alteration, or destruction.

Technical security measures we have implemented:

• Data Encryption at Rest and in Transit: All data is stored in encrypted format using AES-256. All data in transit is protected by TLS 1.3 protocol.
• Strict Access Control: Only authorised personnel with a strict "need-to-know" requirement may access user personal data — protected by multi-factor authentication.
• 24/7 Monitoring: Intrusion detection systems (IDS) and next-generation firewalls monitor our network traffic around the clock.
• Regular Backups: Data is regularly backed up to a separate, geographically distinct secondary data centre to ensure service continuity.
• Security Audit: Penetration testing and independent security audits are conducted regularly by certified cybersecurity firms.

Regarding data retention periods: api888 retains your personal data for as long as your account remains active. Following account closure, we retain transaction records and account information for a minimum period of five (5) years for AML and tax compliance purposes, after which the data will be securely deleted or anonymised.

Api888 does not sell or rent your personal data to any third party for marketing or commercial purposes. However, in the course of operating our services, we may need to share certain data with the following categories of third parties within strict limits:

• Payment Providers: Trusted payment service providers such as FPX, Touch 'n Go, and GrabPay receive only the information required to process your transactions. They are bound by strict confidentiality agreements.
• Game Software Providers: Game development companies may receive anonymized account identifiers for the purpose of recording game results and ensuring RNG integrity.
• Cloud Service Providers: Our hosting and data storage infrastructure is operated by enterprise-grade cloud providers bound by strict data processing agreements.
• Identity Verification Agency: For KYC verification purposes, we work with licensed digital identity verification providers in Malaysia.
• Authorities: We will disclose required information to law enforcement agencies or regulatory bodies when required by court order or applicable law.

All our service provider partners are required to sign data processing agreements that prohibit them from using your information for any purpose other than those specified, and obligate them to maintain data security standards equivalent to our own.

Api888 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions — login, session security, betting slip memory. These cookies cannot be disabled.
• Performance Cookies: Collects anonymized analytics data to help us understand how users interact with the platform and identify areas for improvement.
• Functional Cookies: Stores your preferences such as language selection, display settings, and login details for your convenience.
• Marketing Cookies: Used to display relevant advertisements and measure the effectiveness of our marketing campaigns. Only activated with your consent.

Under Malaysia's Personal Data Protection Act 2010 and api888's internal policies, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you. This request will be processed within 21 working days.
• Right to Rectification: If your data is inaccurate or out of date, you have the right to request a correction. You can update basic profile information directly from your account settings.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your data. Note: We may need to retain certain data for a minimum period for legal compliance purposes.
• Right to Object to Processing: You can object to the processing of your data for direct marketing purposes at any time without providing a reason.
• Right to Data Portability: You have the right to receive your data in a structured, commonly used and machine-readable format for transfer to another data controller.
• Right to Withdraw Consent: For processing that relies on your consent, you may withdraw that consent at any time — this does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our Data Protection Officer by email at [email protected] by clearly stating your request. We will verify your identity before processing any data-related request.

The api888 platform is intended for adult users aged 18 and above only. We do not knowingly collect or process personal data from individuals under the age of 18.

If you are a parent or guardian who discovers that your child who is under age has registered or provided personal information to our platform, please contact us immediately at [email protected]. We will take immediate action to delete that information and close the account in question.

The api888 platform may contain links or integrations with third-party services such as payment providers and game suppliers. This Privacy Policy applies only to information collected by api888 itself.

When you leave our platform to visit third-party websites, we encourage you to read their privacy policies. api888 is not responsible for the privacy practices or content of any third-party website and has no control over them.

Api888 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, technology requirements or legal obligations. Any changes will take effect upon publication of the updated version on our website.

For changes considered significant or material — such as changes to how we use your data or new categories of third parties receiving data — we will provide clear notice to registered users via email or in-account notification at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Privacy Policy will always reflect the date of the current version. We encourage you to review this page periodically to ensure you remain informed of your rights and protections.

If you have any questions, concerns or complaints regarding this Privacy Policy or how we handle your personal data, please contact the api888 Data Protection Officer through the following channels:

• Email: [email protected] — response within 2 business days
• Live Chat: Available 24/7 directly on the api888 platform

Please state "Privacy Policy Inquiry" or "Personal Data Request" in your email subject line so it can be routed directly to the responsible team. Please also include your account username to expedite the process.