dafatoto Platform Privacy Notice

This page describes what we collect when you use dafatoto and how we keep that data protected. We at dafatoto collect personal information only to verify your identity, process your deposits and withdrawals, and comply with local law in the jurisdictions where we operate. We do not sell your data, and we do not share it with marketing partners or advertisers.

Our platform operates primarily on mobile—Android APK and iOS browsers in supported regions. When you install our app or access dafatoto through a browser, we collect minimal information: your email, phone number, government ID for verification, payment account details for DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, and bank transfers (mobile banking, local payment, online payment, e-wallet), and your account activity. We store all of this securely and encrypt it in transit.

We do not track your location, collect your browsing history outside dafatoto, or use cookies for marketing. Our servers may sit outside your jurisdiction—if you're in Jakarta, Surabaya, Bandung, or Medan, your encrypted data may be processed by third-party hosting providers in other countries, but we control access and never disclose it to unauthorized parties.

What we collect and why we need it

We collect your email and phone number when you register with dafatoto. We use these to log you in, send account notifications (deposit confirmations, withdrawal approvals, match alerts), and help you reset your password if you forget it. Your phone number is also used to verify your identity via SMS during KYC (Know Your Customer) verification.

For deposits and withdrawals, we collect your payment account details—your DANA, e-wallet, mobile banking, local payment, or online payment mobile-wallet account identifier, or your bank account number and routing code if you use e-wallet, mobile banking, local payment, or online payment. We store these securely and use them only to process transactions. We also collect your full legal name and government ID (national ID, passport, or driver's licence) to comply with anti-money-laundering regulations and verify you are who you claim to be. This verification happens once per account and protects both you and dafatoto.

We log your account activity: login timestamps, deposit and withdrawal requests, settlement notifications, and account settings changes. We keep these logs to help you review your account history, detect unauthorized access, and investigate disputes. If something looks wrong—an unusual withdrawal or login from a new city—we can review your activity history and help secure your account.

How we share your data

We share your data only where necessary to operate dafatoto. Your payment account details are shared with your payment provider (e-wallet, mobile banking, local payment, etc.) to process deposits and withdrawals—your bank sees that you are paying dafatoto, and dafatoto sees the confirmation your bank returns. This data exchange is encrypted and handled by secure APIs.

We do not share your ID document with payment processors or any third party. Your ID is stored only on dafatoto's servers and used only for our internal KYC verification. If local law requires us to disclose your information (e.g., if a court issues a legal order), we will comply and will notify you unless the law forbids notification.

We may employ hosting providers and data-processing vendors outside Indonesia to store and process your data securely. These vendors are bound by confidentiality agreements and are forbidden from using your data for their own purposes. You remain in control: if you request deletion of your account, we delete your personal data within 30 days, except where we are required by law to retain records (e.g., transaction histories for tax or compliance purposes).

Cookies and tracking

We use session cookies to keep you logged in on dafatoto. We do not use tracking cookies or third-party advertising pixels. Clearing your browser cookies will log you out but does not delete your account.

Data retention

We keep your personal data for as long as your dafatoto account is active. After you delete your account, we retain transaction records for seven years as required by law, but we delete your ID and payment details within 30 days.

Your rights

You can request a copy of all data we hold about you, correct inaccurate information, or request deletion of your account. Contact our support team to exercise these rights.

Our dafatoto privacy commitments

We take your privacy seriously. We do not sell, trade, or rent your personal information. We do not use your data to build advertising profiles or sell targeted ads. We do not use your name, email, or ID outside the context of operating dafatoto. If we change this privacy notice, we will notify you by email and give you 30 days to review the changes before they take effect.

Our servers are protected with firewalls, encryption, and regular security audits. We limit access to your data to employees and contractors who need it to operate dafatoto. All dafatoto staff are required to sign confidentiality agreements. If a data breach occurs, we will notify you within 48 hours and outline what information was exposed and what steps we are taking to address it.

If you have questions about how we handle your data on dafatoto, or if you want to exercise your right to access, correct, or delete your information, contact our support team through your account settings. You can request deletion of your dafatoto account anytime, and we will process your request within 30 days. This privacy notice applies to all users of dafatoto on Android APK, iOS browsers, and any future platforms we may launch. We update this notice periodically; the date of the last update is listed at the top of this page. If you continue to use dafatoto after changes take effect, you accept the updated terms.