raksasaPrivacy Policy

This page describes what we collect when you use raksasa and how we keep that data protected. We at raksasa collect personal information to verify your identity, process deposits and withdrawals, detect fraud, and comply with anti-money-laundering law. Your data includes your email, name, government ID, proof of address, phone number, and payment details (DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, or bank account).

We store your data on encrypted servers and limit access to our compliance, support, and engineering teams. We do not sell your personal information to third parties. Our servers may sit outside your jurisdiction (including outside Indonesia); your data may be transferred to data processors in other countries. We retain your information for as long as your raksasa account remains active, plus two years after account closure for regulatory compliance.

This policy explains your rights, how to contact us about your data, and how we handle cookies and third-party processors.

What we collect and why

We at raksasa collect data in two categories: account registration and transaction history. During registration, we ask for your email, full name, date of birth, and country of residence. You create a password; we salt and hash it using industry-standard encryption. We do not store your password in plain text.

Before your first deposit, we require Know Your Customer (KYC) verification. We collect a scan of your government-issued ID (passport, national ID, or driver's licence), a live selfie, and proof of address (utility bill, bank statement, or lease agreement from the last three months). These documents verify your identity, confirm your age (legal requirement), and prevent fraud and account takeover.

• Account data: Email, name, date of birth, country, phone number (optional).
• KYC documents: ID scan, live selfie, proof of address. Stored separately on encrypted servers.
• Payment methods: DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, or bank account (mobile banking, local payment, online payment, e-wallet) details. We tokenise payment data — we do not store your full card or account number in plain text.
• Game history: Spins, bets, outcomes, deposits, withdrawals, account balance snapshots. Logged with timestamps for account transparency.
• IP address and device info: We log your IP address and device type (browser, mobile OS) to detect suspicious login attempts and fraud.
• Cookies: We use session cookies to keep you logged in and analytics cookies to understand how users navigate raksasa.

We collect this data to: verify your identity and age, process deposits and withdrawals, detect fraud and money-laundering activity, provide customer support, comply with anti-money-laundering (AML) and data-protection law, and improve raksasa's functionality.

How we protect your data on raksasa

We at raksasa use encrypted connections (HTTPS / TLS) for all communication between your device and our servers. Payment data is tokenised — third-party payment processors (mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment) receive your transaction request but never see your full account credentials stored on our servers. Your account balance and game history are stored on encrypted databases accessible only to authorised staff.

Access to your data is restricted to raksasa employees who need it to serve you — compliance officers reviewing KYC, support staff handling account issues, engineers fixing bugs. We implement role-based access control: a support agent cannot access payment information; a compliance officer cannot view your game history. All access is logged; suspicious queries are flagged for investigation.

Data retention and deletion on raksasa

We retain your account data for as long as your raksasa account remains active. After you close your account, we keep your records for two additional years to comply with anti-money-laundering regulations and tax law. During this two-year period, your account cannot be reactivated; your data is archived but remains encrypted.

After two years, we delete your personal information (name, email, ID scan, payment details) from our active systems. We retain aggregate, anonymised statistics (e.g. "5,000 withdrawals processed in Jakarta during Idul Fitri") for business analysis, but these cannot be traced back to you.

You may request deletion of your data before the two-year retention window. Submit a deletion request through your raksasa account dashboard or email our support team. We will review your request and respond within 30 days. If deletion conflicts with an active AML investigation or pending withdrawal, we may delay deletion until the investigation closes or the withdrawal settles.

We at raksasa encrypt your data in transit and at rest, limit staff access to verified personnel, and delete your information after the legally required retention period.

Third-party processors and data transfers on raksasa

We use third-party service providers to operate raksasa. These include cloud hosting companies (for server infrastructure), payment processors (online payment, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, e-wallet), anti-fraud vendors, and email providers (to send you account notifications). These processors access only the data needed to provide their service — a payment processor sees your transaction; an email provider sees your email address.

Our servers are hosted in multiple geographic regions. Your data may be stored on servers outside Indonesia, including in Singapore, Australia, or the European Union. We select data processors who meet internationally recognised data-protection standards. We sign data processing agreements with each vendor requiring them to encrypt your data, limit access, and notify us of any breach within 24 hours.

We do not sell or rent your personal information to third parties for marketing. We may share anonymised, aggregated data (e.g. "non-specific info of raksasa users in Surabaya use mobile banking") with business partners for market research, but this data cannot identify you.

Your rights and contact information

You have the right to request access to your personal data, correct inaccurate information, and request deletion (subject to legal holds). You may opt out of non-essential marketing emails. To exercise these rights, log into your raksasa account or email our compliance team. Response time is typically 10 business days.

1. Access your data

   Request a copy of all personal information we hold about you. We provide it in a portable, machine-readable format.

2. Correct inaccuracies

   Update your name, email, or address through your account settings or by contacting support.

3. Request deletion

   Ask us to delete your account and personal information (subject to a two-year legal hold for AML compliance).

4. Opt out of marketing

   Disable promotional emails through account settings or by clicking "Unsubscribe" in any raksasa email.

We at raksasa take data breaches seriously. If we discover that your personal information has been accessed without authorisation, we will notify you within 72 hours via email to the address on file. We will explain what information was affected, what steps we are taking to secure it, and what you can do to protect yourself (e.g. password change, credit monitoring).

If you have concerns about how raksasa handles your data, contact our support team in English at any time. If you are not satisfied with our response, you have the right to lodge a complaint with your local data-protection authority.

This privacy policy was last updated in 2024. We may update it occasionally to reflect changes in our practices or law. We will post updates here and notify you via email if material changes occur. Your continued use of raksasa after any update constitutes acceptance of the updated policy.