xbjai Privacy Policy — How We Protect Your Personal Data

1 Introduction

This Privacy Policy ("Policy") describes how xbjai ("we", "us", "our", "the Platform") collects, uses, stores, and protects the personal data of players and visitors who access the xbjai website at https://xbjai.io ("the Site"). It applies to all personal data collected through your use of our gaming, sports betting, payment, and customer support services.

By registering an account on xbjai, depositing funds, placing bets, or otherwise using any feature of the Site, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the xbjai platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, all of which together govern your relationship with xbjai.

2 Data We Collect

xbjai collects personal data from you in three ways: data you provide directly, data generated automatically by your use of the platform, and data received from third-party payment and identity verification partners.

2.1 Data You Provide Directly

When you register an account or interact with our platform, you may provide the following categories of personal data:

2.2 Data Generated Automatically

When you use the xbjai platform, certain technical data is generated and recorded automatically:

• Device & Technical Data: IP address, browser type and version, operating system, device type, screen resolution, and device identifiers.
• Usage Data: Pages visited, games played, bets placed, session duration, click paths, and feature interactions.
• Transaction Data: Deposit history, withdrawal history, wagering records, bonus claims, and game round outcomes.
• Location Data: Approximate geographic location derived from your IP address (country and city level only). xbjai does not access precise GPS location data.

2.3 Data from Third Parties

We may receive limited personal data about you from the following third-party sources:

• Payment Processors (bKash, Nagad, Rocket, Upay): Transaction confirmation references and tokenised payment identifiers.
• Identity Verification Partners: Results of automated document verification and age-check services used during the KYC process.
• Fraud Prevention Services: Risk scores and flags associated with your device or IP address from recognised fraud detection partners.

3 How We Use Your Data

xbjai uses the personal data it collects for the following purposes:

xbjai will not use your personal data for any purpose not listed above without first obtaining your explicit consent or being required to do so by applicable law.

4 Legal Basis for Processing

Where data protection law requires xbjai to identify a lawful basis for processing your personal data, we rely on the following grounds depending on the specific processing activity:

• Contractual necessity: Processing required to perform our obligations to you under the Terms & Conditions — including account creation, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws, including age verification (21+), anti-money laundering (AML), and fraud prevention requirements.
• Legitimate interests: Processing necessary for our legitimate business interests, such as fraud detection, platform security, analytics, and responsible gaming monitoring — where these interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, informed consent — principally for direct marketing communications and personalised promotional offers. You may withdraw this consent at any time.

5 Data Sharing & Disclosure

xbjai does not sell or rent your personal data to any third party. We share your data only in the following limited circumstances:

5.1 Service Providers

We engage trusted third-party service providers who process personal data on our behalf under strict contractual obligations. These include payment processors (bKash, Nagad, Rocket, Upay), identity verification and KYC partners, IT infrastructure providers, fraud detection services, and customer support platform providers. All service providers are required to implement appropriate security measures and may only process data for the purposes we specify.

5.2 Game Content Providers

Game studios and software providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive limited technical data necessary to deliver their games, such as your session token and stake amounts. These providers do not receive your full identity data and are bound by their own data protection obligations.

5.3 Legal & Regulatory Disclosure

xbjai may disclose personal data to law enforcement authorities, regulatory bodies, or courts where required to do so by law, court order, or to protect the safety, rights, or property of xbjai or third parties. We will notify you of any such disclosure where legally permitted to do so.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of xbjai's business, your personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection commitments being in place.

6 Cookies & Tracking Technologies

xbjai uses cookies and similar tracking technologies on the Site to enable essential platform functionality, maintain your login session, remember your preferences, and analyse how players interact with the platform so we can make improvements.

6.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that keep you logged in and security cookies that prevent cross-site request forgery. These cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: Used to collect aggregate, anonymised information about how players navigate the Site. This data helps us identify popular games, improve page load times, and optimise the user experience.
• Functional Cookies: Used to remember your preferences, such as your preferred currency display or language setting, so you do not need to re-enter them on each visit.
• Marketing Cookies: Used only where you have provided explicit consent, to deliver personalised promotional content relevant to your gaming interests. You may withdraw consent for marketing cookies at any time.

6.2 Managing Cookies

You may control and manage cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies from specific websites. Please note that disabling strictly necessary cookies will impair your ability to use the xbjai platform, including the ability to log in and place bets.

7 Data Retention

xbjai retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

When personal data is no longer required and the applicable retention period has expired, xbjai will securely delete or anonymise that data in accordance with our internal data destruction procedures.

8 Data Security

xbjai implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data in transit between your browser and our servers.
• Access Controls: Strict role-based access controls ensuring that only authorised xbjai personnel can access personal data, and only to the extent required for their specific role.
• Penetration Testing: Regular third-party security assessments and penetration testing of our platform infrastructure.
• Secure Data Centres: All player data is stored in geographically redundant, physically secured data centres with 24/7 monitoring.
• Incident Response: A documented data breach response procedure that includes notification to affected players within 72 hours of discovering a significant breach.
• Staff Training: All xbjai personnel who handle personal data receive regular data protection and security training.

While xbjai takes every reasonable precaution to protect your data, no internet transmission or electronic storage system is 100% secure. You are also responsible for maintaining the security of your own account credentials. If you suspect your account has been compromised, contact us immediately at [email protected].

9 Your Rights Over Your Personal Data

As a player on xbjai, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact us at [email protected]. We will respond to all verified data rights requests within 10 business days.

9.1 Right of Access

You have the right to request a copy of all personal data xbjai currently holds about you, along with information about how it is being used. This is commonly known as a Subject Access Request (SAR).

9.2 Right to Rectification

If any personal data xbjai holds about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

9.3 Right to Erasure

You may request that xbjai delete your personal data in circumstances where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other legal basis for processing; or the data has been unlawfully processed. Note that erasure requests may be declined where xbjai is required to retain data for legal, regulatory, or fraud prevention purposes.

9.4 Right to Restrict Processing

You have the right to request that xbjai restrict the processing of your personal data in certain circumstances, for example while a rectification request is being assessed, or where you have objected to processing and a decision is pending.

9.5 Right to Data Portability

Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that we transmit this data to another data controller where technically feasible.

9.6 Right to Object

You have the right to object at any time to the processing of your personal data where xbjai relies on legitimate interests as its legal basis. You also have an unconditional right to object to the processing of your data for direct marketing purposes. Upon receiving a valid marketing objection, xbjai will cease all marketing communications immediately.

9.7 Right to Withdraw Consent

Where xbjai processes your personal data based on your consent (e.g., for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. You can withdraw marketing consent by contacting [email protected] or using the unsubscribe link in any promotional email.

10 Children & Minors

xbjai is strictly an adults-only platform. We do not knowingly collect, use, or store personal data from any person under the age of 21. Our platform employs automated and manual age-verification procedures during registration to prevent underage access.

If xbjai discovers that personal data has been collected from a person under the age of 21 — whether through fraudulent registration or any other means — that account will be immediately closed, all associated funds forfeited, and all personal data permanently deleted within 30 days, except where retention is required for legal purposes such as fraud investigation.

If you believe that a person under 21 has registered on xbjai using false information, please contact us immediately at [email protected] so we can investigate and take appropriate action.

11 Third-Party Links & Services

The xbjai platform may contain links to third-party websites, services, or content — for example, links to game provider studios or payment partner portals. This Privacy Policy applies exclusively to data processed by xbjai. Third-party sites and services have their own privacy policies, and xbjai accepts no responsibility for the data practices of any external third party.

We strongly recommend reviewing the privacy policies of any third-party service you access through or in connection with the xbjai platform, particularly those of your chosen payment provider (bKash, Nagad, Rocket, or Upay), as their own data handling practices may differ from those described in this Policy.

12 Changes to This Privacy Policy

xbjai may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will notify registered players via email and/or a prominent notice on the Site at least 14 days before the changes take effect, where reasonably practicable.

The effective date at the top of this Policy indicates when the current version came into force. Archived versions of previous Privacy Policies are available on request by contacting [email protected]. Your continued use of the xbjai platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

13 Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or the way xbjai handles your personal data, please reach out to us through any of the following channels:

• Live Chat: Available 24/7 directly within the xbjai platform. Our support team handles data queries in English for all players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.
• Email: [email protected] — responses within 24 hours. For data rights requests, use the subject line "Data Rights Request".

xbjai takes all privacy complaints seriously and will acknowledge your query within 2 business days, with a full resolution typically provided within 10 business days. If you are not satisfied with our response to your privacy concern, you may escalate the matter to your local consumer protection authority.