Privacy Policy

1. Definitions

The following terms carry the meanings assigned below throughout this Privacy Policy:

• "api138," "We," "Us," or "Our" refers to the operator of the api138 platform accessible at https://api138.cam.
• "Platform" means the api138 website, any associated mobile interface, and all services, features, and content offered thereon.
• "User," "You," or "Your" refers to any individual who accesses, registers on, or otherwise interacts with the api138 Platform.
• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, either alone or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, or transfer.
• "KYC" (Know Your Customer) means the identity and document verification process conducted by api138 prior to activating withdrawal functionality on a User's Account.
• "Cookies" means small text files stored on a User's device by a web browser to enable session management, personalization, and analytics.

2. Personal Data We Collect

api138 collects only the data that is necessary to operate the platform, verify your identity, process transactions, and comply with our legal obligations. The categories of personal data we collect are as follows:

2.1 Registration Data

When you create an api138 Account, we collect the information you provide during the sign-up process, including:

• Full legal name (as it appears on your KTP or other government-issued identification)
• Date of birth (to verify you are at least 21 years of age)
• Email address
• Indonesian mobile phone number
• Residential address within Indonesia
• Username and hashed password (passwords are never stored in plain text)

2.2 KYC and Identity Verification Data

Before your first withdrawal, api138 requires you to complete a KYC verification process. This involves the submission of:

• A clear photograph or scan of your KTP (Kartu Tanda Penduduk — Indonesian national identity card)
• A selfie photograph holding your KTP (required in some cases)
• Proof of address (such as a recent utility bill or bank statement) if requested
• Bank account details or e-wallet account details in your registered name

KYC documents are processed by our compliance team and stored securely in encrypted form. They are used solely for identity verification and fraud prevention.

2.3 Financial Transaction Data

When you make deposits or withdrawals, we collect and retain transaction data including:

• Transaction amounts in Indonesian Rupiah (IDR / Rp)
• Payment method used (bank name and account number or e-wallet provider)
• Transaction timestamps and reference numbers
• Transaction status and history

We do not store full credit card numbers. For bank transfers and e-wallet transactions, we retain only the account number suffix and the registered account name to facilitate future withdrawals.

2.4 Gameplay and Betting Data

api138 records all betting and gaming activity conducted through your Account, including:

• Bets placed, game types (e.g., sports betting, togel (Indonesia's traditional numbers lottery), live casino, slot gacor (high-payout slots))
• Wagering amounts, odds, and outcomes
• Session duration and frequency of play
• Bonus claims, wagering progress, and withdrawal requests

This data is used to administer your Account, detect responsible gaming concerns, and comply with anti-money laundering obligations.

2.5 Technical and Device Data

When you access api138, our servers automatically collect certain technical information, including:

2.6 Communications Data

If you contact our support team via live chat, email, or WhatsApp, we retain records of those communications, including the content of your messages, the date and time of contact, and the resolution reached. This allows us to track open cases and maintain service quality.

3. How We Collect Personal Data

api138 collects personal data through the following channels:

• Direct Submission: Data you enter during registration, KYC submission, deposit forms, and support interactions.
• Automated Collection: Technical and behavioral data collected automatically when you access the Platform (see Section 2.5 and Section 9).
• Third-Party Payment Processors: Transaction confirmation data received from your bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, Bank Danamon) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• Identity Verification Providers: In some cases, api138 uses third-party KYC verification services that may cross-reference your submitted data against official databases to confirm identity.

4. How We Use Your Personal Data

api138 processes your personal data for the following purposes:

• Account Administration: Creating, maintaining, and securing your api138 Account, including password recovery and two-factor authentication (2FA).
• Identity Verification (KYC): Confirming your identity and age (21+) in compliance with our security and regulatory obligations before enabling withdrawal functionality.
• Payment Processing: Facilitating deposits and withdrawals via your registered bank account or e-wallet, and maintaining an accurate transaction record for your Account history.
• Service Delivery: Making available sports betting, live casino, togel, and other gaming products; settling bets; applying bonuses; and personalizing your experience on the Platform.
• Fraud Prevention and Security: Detecting and preventing unauthorized account access, bonus abuse, multi-accounting, money laundering, and other prohibited activities.
• Responsible Gaming: Monitoring betting patterns for signs of problem gambling and enforcing deposit limits, cooling-off periods, and self-exclusion requests made by Users.
• Legal Compliance: Meeting our obligations under applicable anti-money laundering (AML) regulations and responding to lawful requests from regulatory authorities.
• Customer Support: Resolving Account disputes, answering queries, and providing technical assistance via our 24/7 Indonesian-language support team.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve the Platform's user experience, performance, and stability.
• Marketing Communications (Opt-In Only): Sending promotional offers, bonus notifications, and platform updates to Users who have expressly opted in to receive such communications.

5. Legal Basis for Processing

api138 processes your personal data on the following legal grounds:

• Contractual Necessity: Processing required to fulfill our obligations under the Terms & Conditions you agreed to upon registration — including account management, payment processing, and bet settlement.
• Legal Obligation: Processing required to comply with applicable law, including identity verification (KYC), anti-money laundering checks, and responding to lawful governmental requests.
• Legitimate Interests: Processing carried out in our legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Processing carried out on the basis of your explicit consent, including the sending of marketing communications. You may withdraw your consent at any time by contacting support at [email protected].

6. Sharing Your Personal Data

api138 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data only in the following limited circumstances:

• Payment Processing Partners: Your bank account or e-wallet details are shared with the relevant Indonesian financial institution (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA) solely for the purpose of processing your deposit or withdrawal.
• KYC Verification Services: Your identity documents may be proce ssed by a trusted third-party identity verification provider for the purpose of confirming your identity and age. These providers are contractually bound to process your data solely for this purpose and to maintain appropriate security standards.
• Game Content Providers: Certain game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive anonymized session data to facilitate game delivery and RNG certification. No personally identifiable information is shared with game studios.
• Legal and Regulatory Authorities: api138 may disclose your personal data to law enforcement agencies, regulators, or courts if required to do so by law, or if we believe in good faith that such disclosure is necessary to protect our legal rights, prevent fraud, or respond to a valid legal process.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer via email or a prominent notice on the Platform.

7. Data Retention

api138 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

Once the applicable retention period expires, your data is securely deleted or permanently anonymized so that it can no longer be associated with your identity. Anonymized, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and platform improvement purposes.

8. Data Security

api138 employs a layered, defense-in-depth security architecture to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.3 protocols. You can verify this by checking for the padlock icon and https:// prefix in your browser's address bar.
• Encrypted Data Storage: Sensitive fields — including passwords, KYC document files, and bank account details — are stored using AES-256 encryption at rest.
• Two-Factor Authentication (2FA): api138 supports optional 2FA for your Account login, adding an additional layer of protection against unauthorized access even if your password is compromised.
• Access Controls: Access to personal data within api138's internal systems is restricted on a strict need-to-know basis. Staff members who handle personal data undergo background screening and regular data protection training.
• Penetration Testing: Our platform undergoes regular third-party security audits and penetration tests to identify and remediate vulnerabilities proactively.
• Fraud Detection Systems: Automated systems monitor transaction patterns, login behavior, and betting activity in real time to detect and respond to anomalous activity indicative of fraud or unauthorized account use.
• Incident Response Plan: In the event of a confirmed data breach that poses a risk to Users, api138 will notify affected individuals and relevant authorities within 72 hours of becoming aware of the breach.

While we implement robust security measures, no system is entirely immune to risk. You are responsible for keeping your Account credentials confidential and for notifying us immediately if you suspect unauthorized access to your Account.

9. Cookies and Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device by a web server when you visit a website. They allow the site to recognize your device on subsequent visits and store preferences, session information, and analytics data.

9.2 Types of Cookies Used by api138

9.3 Managing Cookies

Strictly necessary cookies are essential for the Platform to function and cannot be disabled. For all other cookie categories, you may adjust your preferences via your browser settings. Most modern browsers allow you to block or delete cookies; however, disabling functional cookies may impair your user experience on api138 (for example, your session may not persist between pages).

10. Your Privacy Rights

As a User of api138, you have the following rights regarding your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Privacy Rights Request":

• Right of Access: You have the right to request a copy of the personal data we hold about you, including the categories of data, the purposes of processing, and any third parties to whom your data has been disclosed.
• Right of Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it.
• Right of Erasure ("Right to be Forgotten"): You may request that we delete your personal data. Note that this right is subject to overriding legal obligations — for example, we are required to retain KYC and financial transaction data for a minimum of five years under AML regulations, even after account closure.
• Right to Restrict Processing: You have the right to request that we temporarily halt the processing of your data while a dispute or rectification request is being resolved.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) so that you can transfer it to another service provider.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though we may demonstrate compelling grounds to continue.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

api138 will respond to all verified privacy rights requests within 30 calendar days. In complex cases, we may extend this period by a further 30 days and will notify you of the extension.

11. Children's Privacy and Age Restriction

The api138 platform is strictly intended for adults aged 21 years and over. We do not knowingly collect, process, or store personal data belonging to individuals under the age of 21. If we become aware that a User is under 21 years of age, we will immediately suspend the Account, void any associated transactions or winnings, and delete the personal data of the underage individual from our systems, subject to any mandatory legal retention obligations.

If you are a parent or guardian and you believe that a minor in your care has accessed api138 and submitted personal data without your knowledge, please contact us immediately at [email protected]. We will take prompt action to investigate and, where confirmed, to remove the data and close the Account.

12. Changes to This Privacy Policy

api138 reserves the right to update or revise this Privacy Policy at any time. When we make material changes — meaning changes that significantly affect how we collect, use, or share your personal data — we will notify you by:

• Sending a notification to your registered email address
• Displaying a prominent banner on the Platform for a minimum of 14 days following the update
• Updating the "Last Updated" date at the top of this page

Your continued use of api138 following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you must stop using the Platform and may request account closure by contacting our support team.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way api138 handles your personal data, please contact our Data Protection team using the details below:

• Email: [email protected] (subject line: "Privacy Policy Enquiry")
• Live Chat: Available 24/7 directly through the api138 Platform
• Response Time: We aim to acknowledge all privacy-related enquiries within 24 hours and provide a substantive response within 7 business days.

Our support team includes native Indonesian-speaking agents and is fully equipped to assist you in both English and Bahasa Indonesia.