Privacy Policy

The data controller is CroneBet Entertainment Ltd, 27 Harbour Exchange Square, Canary Wharf, London, E14 9GE, United Kingdom.

Privacy requests, including access, deletion and objection requests, can be made through the in-app support chat and are routed to our data protection contact.

Account data: email address, username, password hash, language preference, security settings and account status.

Verification data, where requested: identity documents, proof of address, date of birth, selfie and source-of-funds evidence.

Activity data: bets, stakes, results, balances, bonuses, transactions, deposit addresses, withdrawal requests and blockchain transaction hashes.

Support data: the content of support conversations, including any attachments and the language they were written in.

Technical and analytics data: IP address (stored in hashed form for analytics), approximate country and region, device and browser information, referring source such as a search engine or campaign link, pages visited and session timestamps.

Performance of a contract: operating your account, settling rounds, processing deposits and withdrawals, and providing support.

Legal obligation: age verification, KYC, anti-money-laundering checks, sanctions screening, tax and accounting records.

Legitimate interests: fraud and multi-account detection, platform security, service improvement and aggregate analytics.

Consent: optional communications and any non-essential cookies. Consent may be withdrawn at any time.

To create and operate your account, settle game rounds, credit deposits and process withdrawals.

To detect fraud, bonus abuse, duplicate accounts, collusion and unlawful use, and to keep the platform secure.

To comply with AML, KYC, sanctions and record-keeping obligations.

To display the interface and communicate with you in your chosen or detected language.

To measure traffic in aggregate: which countries visitors come from, which source referred them, and how many registrations and deposits result.

Support messages written in a language other than English may be translated for our support team using a third-party AI translation service accessed through our platform provider.

Only the text of the relevant support messages is sent for translation. The translated text is shown to staff only; the original message is always retained.

We use automated rules to flag suspected duplicate accounts, bonus abuse, unusual deposit patterns and high-risk blockchain addresses.

These rules can restrict play or hold a withdrawal, but an account closure or forfeiture decision is reviewed by a person. You may ask for human review of any automated outcome.

We do not sell your personal data.

We share data with the providers needed to run the platform: cloud hosting and application infrastructure, the managed database and authentication service, email delivery, blockchain node and explorer services used to detect deposits and send withdrawals, geolocation lookup, and the AI translation service described above.

We may disclose data to regulators, law enforcement, auditors and professional advisers where legally required, and to a buyer or successor in a corporate transaction.

Our providers may process data outside your country, including in the European Union, the United Kingdom and the United States.

Where data leaves the EEA, the UK or Brazil, transfers are covered by adequacy decisions or by standard contractual clauses with equivalent safeguards.

Account, transaction and verification records: kept while the account is active and for 5 years after closure, to meet AML and accounting obligations.

Support conversations: 24 months.

Traffic and visit analytics with hashed IP: 14 months.

Self-exclusion records: retained for as long as needed to enforce the exclusion, which may be indefinite.

Data no longer needed is deleted or irreversibly anonymised.

Passwords are stored hashed and never in readable form. Two-factor authentication is available.

Access to production data is restricted to staff who need it, over encrypted connections, and database access is governed by row-level security rules.

Deposit wallet keys are derived and held server-side and are never exposed to the browser.

If a breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours and inform affected users without undue delay.

You may request access to your data, correction, deletion, restriction of processing, portability in a machine-readable format, and you may object to processing based on legitimate interests.

You may withdraw consent at any time without affecting processing already carried out.

We respond within 30 days. Some data cannot be deleted while legal retention obligations apply, in particular AML records and self-exclusion records.

You may complain to your supervisory authority, such as the Information Commissioner's Office in the UK, your national data protection authority in the EU, or the ANPD in Brazil.

We use cookies and browser local storage to keep you signed in and to remember preferences such as language and sound.

Details of each category and how to control them are set out in our Cookie Policy.

The service is strictly for adults aged 18 or over. We do not knowingly collect data from minors.

If we learn that an account belongs to a minor, we close it, void all play and delete the data except what we must keep by law.

We may update this policy. Material changes are announced on the site, and the date at the top of this page is revised on every update.