Your privacy matters to us. This Privacy Policy explains in clear, plain English exactly what personal data api66 collects, how we use it, how we protect it, and what rights you hold as a data subject — in accordance with applicable data protection principles.
Our Privacy Commitments
We apply industry-standard technical and organisational measures to keep your personal information secure at every stage — from account registration through to withdrawal processing.
All data transmitted between your device and the api66 Platform is encrypted using Transport Layer Security (TLS) with 256-bit encryption. Your credentials, financial details, and personal information are never transmitted in plain text.
Personal data stored in api66's systems is encrypted at rest. Access to production databases containing player information is restricted to authorised personnel only, and all access events are logged and audited.
api66 does not sell, rent, or trade your personal data to third-party marketers, data brokers, or advertising networks. Your information is used solely for platform operations, legal compliance, and service improvement.
We collect only the personal data that is strictly necessary for delivering the api66 service, completing KYC verification, processing payments, and meeting our regulatory obligations. We do not collect data speculatively.
You retain the right to access, correct, export, and request deletion of your personal data held by api66 at any time. Requests are processed within a reasonable timeframe in accordance with applicable data protection law.
You may withdraw consent for marketing communications at any time through your account preferences or by contacting our support team. Withdrawal of marketing consent does not affect your access to the Platform or core services.
This Privacy Policy ("Policy") is issued by api66 ("api66", "we", "us", "our") and governs the collection, use, storage, disclosure, and protection of personal data obtained from users ("you", "Player", "User") of the api66 online gaming platform accessible at api66.asia and all associated services, features, and communications.
api66 is committed to protecting the privacy of all persons who interact with our Platform. We process personal data in accordance with applicable data protection legislation and the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.
By registering an account on api66, depositing funds, or otherwise accessing the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue your use of the Platform immediately.
Malaysian Players: api66 serves players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. Your personal data is handled with care and in compliance with applicable data protection standards. You have the right to request access to, correction of, or deletion of your personal data at any time by contacting our support team.
For the purposes of this Privacy Policy, the following definitions shall apply:
| Term | Definition |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably identify a natural person, directly or indirectly, including name, identification number, contact details, financial data, and online identifiers. |
| "Processing" | Any operation performed on personal data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction. |
| "Data Controller" | api66, which determines the purposes and means of processing personal data collected through the Platform. |
| "Data Processor" | A third party that processes personal data on behalf of api66 under a contractual agreement, such as payment service providers, KYC verification services, and hosting providers. |
| "Data Subject" | The natural person to whom the personal data relates — in this context, you as a registered or prospective api66 player. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose. |
| "KYC Data" | Identity verification documents and information collected in connection with Know Your Customer obligations, including government-issued identification, proof of address, and related materials. |
api66 collects personal data through several channels in the ordinary course of providing the Platform. The categories of personal data we collect are as follows:
3.1 Registration Data
When you create a player account on api66, we collect: your full legal name, date of birth, email address, mobile telephone number, residential address (including city, state, and postcode within Malaysia), username, and password (stored in hashed form — never in plain text).
3.2 Identity Verification (KYC) Data
To comply with applicable anti-money-laundering and know-your-customer obligations, we collect: copies of government-issued photo identification (MyKad, Driver's Licence, or Passport), proof of residential address (utility bill, bank statement, or official correspondence dated within three months), and a selfie photograph of you holding your identification document where required.
3.3 Financial Data
We collect transaction records associated with your account, including deposit amounts, withdrawal requests, payment method references (e-wallet account identifiers, bank account names), and transaction timestamps. We do not store full payment card numbers. For e-wallet transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX, only the transaction reference and confirmation status are retained by api66. For USDT TRC20 cryptocurrency transactions, wallet addresses and transaction hashes are recorded.
3.4 Platform Usage Data
We automatically collect technical and behavioural data when you access the Platform, including: IP address, device type and operating system, browser type and version, screen resolution, referring URL, pages visited, session duration, game activity logs, and click-stream data. This data is used for security monitoring, platform optimisation, and fraud prevention.
3.5 Communications Data
When you contact api66 customer support via live chat, email, or any other channel, we retain records of those communications, including the content of messages, timestamps, and the support agent's responses. This data is used for quality assurance, dispute resolution, and training purposes.
3.6 Responsible Gambling Data
If you activate responsible gambling tools such as deposit limits, session limits, or self-exclusion, we record the details of those elections and maintain them for the purpose of honouring your requests and preventing circumvention.
Data Minimisation: api66 applies the principle of data minimisation — we collect only personal data that is necessary for the specific, legitimate purposes described in this Policy. We do not collect sensitive personal data categories (such as racial or ethnic origin, health data, or religious beliefs) unless strictly required by regulatory mandate.
api66 processes your personal data on the following legal grounds, depending on the nature and purpose of the processing activity:
| Legal Basis | Processing Activities Covered |
|---|---|
| Contractual Necessity | Account creation, login authentication, payment processing, withdrawal execution, bonus administration, and customer support delivery. |
| Legal Obligation | KYC identity verification, anti-money-laundering screening, age verification (21+ enforcement), regulatory reporting, and responding to lawful law enforcement requests. |
| Legitimate Interests | Fraud detection and prevention, platform security monitoring, abuse investigation, responsible gambling enforcement, and service quality analytics (where not overridden by your privacy interests). |
| Consent | Marketing communications (email newsletters, promotional offers), optional personalisation features, and any processing activities that are not otherwise covered by the above grounds. |
Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
api66 uses personal data collected from you for the following specific purposes:
api66 does not sell, rent, or trade personal data. We may share your personal data with third parties only in the limited circumstances described below, and only to the extent necessary for the stated purpose:
6.1 Payment Service Providers
We share necessary transaction data with your selected payment service provider (including e-wallet operators such as Touch 'n Go, Boost, and GrabPay, and banking institutions including Maybank, CIMB, Public Bank, and Hong Leong Bank) solely for the purpose of processing your deposit or withdrawal request.
6.2 KYC & Identity Verification Providers
We engage accredited third-party identity verification service providers to assist in the KYC process. These providers process your identification documents in accordance with their own security standards and contractual obligations to api66, and may not use your data for any purpose other than identity verification on our behalf.
6.3 Technology & Infrastructure Providers
api66 engages hosting, cloud infrastructure, security monitoring, and analytics service providers who may process personal data as Data Processors on our behalf. All such providers are engaged under binding data processing agreements that restrict their use of personal data to the purposes for which it was shared.
6.4 Legal & Regulatory Authorities
api66 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or valid legal process. We will endeavour to notify you of any such disclosure request where legally permitted to do so prior to making the disclosure.
6.5 Business Transfers
In the event of a merger, acquisition, sale of all or substantially all of api66's assets, or any other business restructuring, personal data may be transferred to the successor entity as part of the transaction. You will be notified via email and/or prominent Platform notice of any such change and of any choices you may have regarding your personal data.
No Third-Party Marketing: api66 does not share your personal data with third-party advertisers, data brokers, or marketing agencies. We will never disclose your contact details to external parties for the purpose of direct marketing without your explicit consent.
api66 uses cookies and similar tracking technologies to enable essential Platform functionality, improve user experience, and support security operations. The following categories of cookies are used:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, login authentication, security tokens, CSRF protection. These cookies are essential for the Platform to function and cannot be disabled. | Session |
| Functional | Remembering your language preferences, preferred payment method, and interface settings to provide a personalised experience on return visits. | Up to 12 months |
| Analytics | Collecting anonymised usage statistics to understand how players navigate the Platform and to identify areas for improvement. No personal identifiers are included in analytics data shared with third-party tools. | Up to 24 months |
| Security | Fraud detection, bot mitigation, anomalous behaviour monitoring, and rate-limiting to protect the Platform and all players from malicious activity. | Session to 12 months |
You can control cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to log in or use core Platform features. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.
api66 retains personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, anti-money-laundering, and accounting obligations. The following general retention guidelines apply:
Upon the expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that renders individual identification impossible.
As a global online gaming platform serving Malaysian players, api66 may transfer personal data to and process it in countries other than Malaysia, including countries where our technology infrastructure partners and service providers are based. Such transfers may be to jurisdictions that do not provide an equivalent level of data protection to that applicable in Malaysia.
Where personal data is transferred internationally, api66 implements appropriate safeguards to protect your data, including: binding contractual clauses requiring recipient parties to protect personal data to a standard at least equivalent to that applied by api66; engaging only processors who demonstrate adequate data protection commitments; and applying technical security measures to data in transit and at rest.
By using the api66 Platform and providing your personal data, you acknowledge and consent to the transfer of your data to third countries in the circumstances described above, subject to the safeguards outlined in this Policy.
api66 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security programme includes the following controls:
While api66 implements robust security measures, no system is completely impenetrable. You are responsible for maintaining the security of your own account credentials and for notifying us promptly of any suspected unauthorised access.
You hold the following rights in relation to your personal data processed by api66. To exercise any of these rights, please contact our support team using the details provided in Section 15. We will respond to all verified requests within a reasonable period, subject to identity verification requirements.
You have the right to obtain confirmation of whether api66 processes personal data about you and, if so, to receive a copy of that data together with information about how it is processed.
You have the right to request correction of inaccurate or incomplete personal data held about you. Where technically feasible, corrections can be made directly through your account profile settings.
You may request deletion of personal data held about you where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations (e.g., AML record-keeping requirements).
In certain circumstances, you may request that api66 restricts the processing of your personal data while a dispute regarding its accuracy or the lawfulness of processing is being resolved.
Where processing is based on consent or contractual necessity and carried out by automated means, you may request a machine-readable export of the personal data you have provided to api66.
You have the right to object to the processing of your personal data where such processing is based on legitimate interests, including profiling. You may also object to processing for direct marketing purposes at any time without restriction.
Exercising Your Rights: To submit a data subject rights request, please contact our support team in writing via live chat or email at [email protected] (plain text, not a link). Please include your registered username and a description of the right you wish to exercise. We may require identity verification before processing your request.
The api66 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register an account, deposit funds, or use the api66 Platform under any circumstances.
If api66 discovers or is notified that personal data has been collected from an individual below the minimum age of 21, we will promptly take steps to delete all such personal data and permanently close the relevant account. Any funds associated with an underage account may be forfeited in accordance with our Terms and Conditions.
If you believe that a minor may have registered an account on api66 using false information, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.
The api66 Platform does not contain links to third-party websites for commercial or advertising purposes. However, the payment processing workflows for certain payment methods (including Touch 'n Go eWallet, Boost eWallet, GrabPay, and FPX banking portals) may redirect you temporarily to third-party payment interfaces operated by those respective service providers.
api66 is not responsible for the privacy practices or content of third-party payment service interfaces. When you are redirected to a third-party payment interface, the privacy policy of that service provider governs the handling of any personal data you interact with on their platform. We encourage you to review the privacy policies of all third-party services you use.
api66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services offered on the Platform. The date of the most recent revision is displayed prominently at the top of this page.
Where changes to this Policy are material — meaning they significantly affect how we process your personal data or alter your rights as a data subject — api66 will provide advance notice via email to your registered address and/or a prominent notification within the Platform, prior to the changes taking effect.
Your continued use of the api66 Platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with the changes, you may request account closure and deletion of your personal data by contacting our support team prior to the effective date.
If you have any questions, concerns, or complaints about this Privacy Policy, about how api66 processes your personal data, or if you wish to exercise any of your data subject rights, please contact our dedicated support team using the following channels:
If you are not satisfied with api66's response to your privacy complaint, you have the right to escalate the matter to the applicable data protection authority in your jurisdiction or to seek independent legal advice.
For responsible gambling-related queries, including self-exclusion requests and account restriction settings, please visit our Responsible Gambling page or contact support directly.
Data Protection Officer: api66 has designated internal personnel responsible for overseeing data protection compliance. All formal data protection correspondence should be directed to [email protected] with the subject line "Data Protection — Formal Correspondence" to ensure routing to the appropriate team.
Questions About Your Privacy?
Our multilingual support team is available around the clock to answer your privacy questions, process data access requests, and help you manage your account settings — in English, Bahasa Melayu, and Chinese.
Related policies: Terms & Conditions · Responsible Gambling · About Us | 21+ only | Play responsibly.