ybaji Privacy Policy

1. Introduction

Welcome to the ybaji Privacy Policy. ybaji ("we", "us", "our", or the "Platform") is committed to protecting the privacy and personal data of every player who registers, deposits, or interacts with our services at https://ybaji.io. This Privacy Policy describes how we collect, use, store, share, and protect your personal information in connection with your use of the ybaji online betting and casino platform.

This Policy applies to all users of ybaji, including registered players, prospective players who browse the Platform without registering, and any individual whose data we process in the course of providing our services. By creating a ybaji account, depositing funds, or placing a bet, you acknowledge that you have read and understood this Privacy Policy in full.

ybaji operates exclusively for the Bangladesh market. All services are delivered in English and all financial transactions are denominated in Bangladeshi Taka (৳ BDT). This Policy is written in English and is the authoritative version; no translated version supersedes it.

2. Data Controller

For the purposes of this Privacy Policy, ybaji is the data controller of the personal information you provide to us. As data controller, we determine the purposes and means by which your personal data is processed. Our designated data protection contact can be reached at:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data enquiries: "Privacy / Data Protection"
• Response time: Within 5 business days for general privacy enquiries; within 30 days for formal data rights requests.

3. Personal Data We Collect

3.1 Registration Data

When you create a ybaji account, we collect the following personal information:

• Full legal name (as it appears on your government-issued ID);
• Date of birth (to verify you are 21 years of age or older);
• Mobile phone number (used as a primary contact and for OTP verification);
• Email address (if provided during registration);
• Preferred username and encrypted password;
• Residential address (district, city — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar).

3.2 Identity Verification (KYC) Data

To comply with responsible gaming and anti-fraud obligations, we may request:

• A copy of your National Identity Card (NID), passport, or birth certificate;
• A recent proof of address document (utility bill or bank statement dated within 90 days);
• Proof of your payment method (e.g., a screenshot from your bKash or Nagad app confirming your registered mobile number);
• A selfie or liveness check image where required for enhanced verification.

3.3 Financial Data

When you make a deposit or request a withdrawal, we collect:

• Mobile Financial Service (MFS) account number or alias (bKash, Nagad, Rocket, Upay);
• Bank card details (card number last four digits, expiry — full card numbers are never stored on our servers);
• Transaction amounts, dates, and reference numbers;
• Wallet balance and transaction history within the ybaji platform.

3.4 Betting and Gaming Activity Data

We maintain a record of your activity on the Platform, including:

• Bets placed, markets selected, stake amounts, and outcomes;
• Casino games played, session durations, and bet sizes;
• Slot titles accessed (including Fortune Tiger and other Pragmatic Play, NetEnt, or Microgaming titles);
• Live casino session records (Evolution Gaming, Ezugi);
• Crash game participation history (HRG Live, Spribe Aviator).

3.5 Technical and Device Data

We automatically collect certain technical information when you use the Platform:

• IP address and approximate geolocation (country and city-level);
• Device type, operating system, and browser version;
• Session start and end times, pages visited, and features used;
• Referrer URL (the page from which you navigated to ybaji, if applicable).

3.6 Communications Data

If you contact our support team via live chat or email, we retain a record of the conversation, including any attachments or screenshots shared. These records are used to resolve your enquiry, improve our service quality, and for compliance purposes.

4. How We Collect Your Data

ybaji collects personal data through the following channels:

• Directly from you: Registration forms, KYC submission uploads, deposit and withdrawal requests, and support interactions;
• Automatically: Cookies, server logs, and device-fingerprinting technologies when you access the Platform;
• From payment processors: Transaction confirmation and status updates from bKash, Nagad, Rocket, Upay, Visa, and Mastercard;
• From game providers: Session data, RNG outcomes, and game logs from certified providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, HRG Live, Red Tiger);
• From fraud prevention partners: Risk scoring and device reputation data from third-party fraud detection services.

5. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

Purpose	Data Used
Account creation and management	Registration data, contact information
Age and identity verification (KYC)	NID/passport, date of birth, selfie
Processing deposits and withdrawals	Financial data, payment method details
Delivering betting and gaming services	Betting history, session data
Fraud prevention and security monitoring	Device data, IP address, transaction history
Responsible gaming monitoring	Betting patterns, session duration, deposit frequency
Customer support	Communications data, account history
Personalised promotions (with consent)	Betting preferences, game history
Platform analytics and improvement	Technical data, usage patterns
Legal and compliance obligations	All categories as required

6. Legal Basis for Processing

ybaji processes your personal data on the following legal bases:

• Contract performance: Processing necessary to operate your account, execute transactions, and deliver the services you have registered to use;
• Legal obligation: Processing required to comply with anti-money-laundering (AML) checks, age verification, fraud investigation, and record-keeping requirements;
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and service improvement — where our legitimate interests do not override your fundamental rights;
• Consent: Marketing communications and promotional personalisation, where you have explicitly opted in. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Sharing Your Personal Data

ybaji does not sell your personal data. We share your data only in the circumstances described below, and only with parties who are contractually obligated to protect it:

7.1 Payment Processors

To process deposits and withdrawals, we share necessary financial data with bKash, Nagad, Rocket, Upay, and card processing partners (Visa and Mastercard network processors). These providers operate independently and are governed by their own privacy policies and terms of service.

7.2 Game Providers

To deliver certified game content, session data is shared with game providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, HRG Live, and Red Tiger. These providers receive only the minimum data required to deliver the game session and record outcomes.

7.3 Identity Verification Partners

KYC documents and biometric data (where collected) are shared with our identity verification partners for the sole purpose of confirming your identity and age. These partners are bound by strict confidentiality and data processing agreements.

7.4 Fraud Prevention and Security

Device data, IP addresses, and behavioural signals may be shared with third-party fraud detection and cybersecurity services to identify and prevent account takeover, bonus abuse, and money laundering activity.

7.5 Legal and Regulatory Disclosure

We may disclose personal data to law enforcement agencies, regulatory authorities, or courts when required to do so by applicable law, court order, or in connection with the investigation of suspected illegal activity. ybaji will notify affected users of such disclosures where legally permitted to do so.

8. International Data Transfers

Some of our third-party service partners — including game providers and fraud detection services — may be located outside Bangladesh. Where personal data is transferred internationally, ybaji ensures that appropriate safeguards are in place, including contractual data processing agreements that impose equivalent data protection obligations on the receiving party.

By using the ybaji Platform, you acknowledge that your personal data may be processed in countries outside Bangladesh. In all cases, ybaji remains the responsible data controller and these transfers are conducted solely in connection with delivering the services described in this Policy.

9. Data Retention

ybaji retains personal data for as long as your account remains active or as long as is required to meet our legal, compliance, and business obligations. The following retention periods apply as a general guide:

• Account and registration data: Retained for the duration of the account and for 5 years following permanent account closure;
• KYC and identity documents: Retained for 5 years following account closure or the last transaction, as required for AML compliance;
• Financial transaction records: Retained for 7 years from the date of each transaction;
• Betting and gaming history: Retained for 3 years from the date of each session;
• Support communications: Retained for 2 years from the date of the last interaction;
• Technical logs and device data: Retained for 12 months from the date of collection.

When the applicable retention period expires, data is securely deleted or anonymised so that it can no longer be linked to an individual player.

10. Security Measures

ybaji employs a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, and destruction. Our key security measures include:

• SSL/TLS encryption: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher;
• Data-at-rest encryption: Sensitive data stored in our databases — including KYC documents and payment details — is encrypted at rest using AES-256;
• Access controls: Access to personal data is restricted to ybaji staff who have a legitimate operational need. All access is logged and audited;
• OTP verification: Account login and significant account changes require SMS-based one-time password verification;
• Device recognition: We use device fingerprinting to detect and flag logins from unrecognised devices;
• Regular security reviews: Our platform and data handling practices are reviewed periodically to identify and address vulnerabilities.

11. Cookies and Tracking Technologies

11.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. ybaji uses cookies and similar tracking technologies (including web beacons and local storage) to deliver a functional, secure, and personalised Platform experience.

11.2 Types of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing cookies. You cannot opt out of these without disabling the Platform entirely.
• Functional cookies: Remember your preferences such as language settings, preferred deposit method, and game lobby filters.
• Analytics cookies: Allow us to understand how players navigate the Platform — which pages are most visited, where players drop off, and how features are used. Data collected is aggregated and anonymised.
• Marketing cookies (with consent only): Used to deliver relevant promotional content about ybaji offers. These are only placed where you have provided explicit consent.

11.3 Managing Cookies

You can control or delete cookies at any time through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, though some personalisation features may be limited. Note that clearing cookies will log you out of your current session.

12. Marketing Communications

With your consent, ybaji may send you promotional communications via SMS or email relating to new games, seasonal offers (including Eid promotions, Pohela Boishakh bonuses, BPL betting specials, and T20 World Cup offers), deposit match bonuses, and other ybaji news.

You can withdraw consent to receive marketing communications at any time by:

• Updating your notification preferences in your ybaji account settings;
• Replying STOP to any promotional SMS from ybaji;
• Emailing [email protected] with the subject "Unsubscribe from Marketing".

Withdrawal of marketing consent does not affect the delivery of transactional messages — you will continue to receive deposit confirmations, withdrawal notifications, OTP codes, and account security alerts regardless of your marketing preferences.

13. Minors and Age Policy

ybaji is strictly an adults-only platform. We do not knowingly collect personal data from any individual under the age of 21. Our registration process includes a mandatory age declaration and date-of-birth verification step. Where our KYC process reveals that an account holder is under 21 years of age:

• The account will be immediately closed;
• All personal data associated with the account will be deleted within 30 days, subject to any legal retention obligations;
• Any deposits made will be returned to the originating payment method.

14. Exercising Your Data Rights

As a ybaji player, you hold the following rights over your personal data. You may exercise any of these rights at any time by submitting a request to [email protected] with the subject line "Data Rights Request":

• Access: Request a complete copy of the personal data ybaji holds about you, including the categories of data, the purposes for which it is processed, and any third parties with whom it has been shared;
• Rectification: Ask us to correct or update inaccurate personal data in your account records;
• Erasure: Request deletion of your personal data. Note that erasure may be limited where we are required to retain data for legal or compliance reasons (see Section 9);
• Restriction: Ask us to temporarily pause processing of your data while a rectification or objection request is being assessed;
• Portability: Request your data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) where technically feasible;
• Objection: Object to processing of your data for direct marketing purposes. This right is absolute — we will stop marketing processing immediately upon receipt of your objection;
• Consent withdrawal: Withdraw any previously given consent to data processing at any time without affecting the lawfulness of prior processing.

We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days. In complex cases, we may extend this period by an additional 30 days, in which case we will notify you of the extension and the reason for it.

15. Changes to This Privacy Policy

ybaji reserves the right to update or revise this Privacy Policy at any time. When we make material changes, we will:

• Update the "Last updated" date at the top of this document;
• Post a notice on the ybaji Platform homepage for a minimum of 14 days prior to the changes taking effect;
• Notify registered players via SMS or email where the changes materially affect how we use their personal data.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree with the revised Privacy Policy, you should discontinue use of the Platform and contact our support team to close your account.

16. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which ybaji handles your personal data, please contact our data protection team using the details below. We are committed to resolving all privacy-related enquiries promptly and transparently.

• Email: [email protected]
• Subject line: "Privacy Policy Enquiry" or "Data Rights Request"
• Response time: Within 5 business days for general enquiries; within 30 days for formal data rights requests
• Operating hours: Monday to Sunday, 09:00 – 23:00 Bangladesh Standard Time (BST, UTC+6)

All correspondence related to data protection and privacy matters is handled by our dedicated support team. We strongly encourage you to contact us directly in the first instance to allow us to address your concern before escalating to any external authority.