Privacy Policy

Casino Api Pro is infrastructure sold to businesses. The single most important thing about our handling of personal data is what we never receive in the first place:

• We do not hold your players’ personal data. Operators identify players to us with an opaque identifier of their own choosing. We never ask for names, addresses, dates of birth, payment details or identity documents — and operators must not send them.
• We do not process payments. No card numbers, no bank details, no wallets. Money moves inside the operator’s own systems.
• There are no analytics or advertising trackers on this website. No Google Analytics, no advertising pixels, no session recording, no third-party cookies. We do not track you across the web and we have nothing to sell to anyone who would.
• We never sell personal data. Not to advertisers, not to data brokers, not to anyone.

The rest of this page is the detail behind those four statements.

Casino Api Pro is the controller for the data described in “Data we collect about you” below.

For game data processed on an operator’s instructions — sessions, rounds and transactions — the operator is the controller and we are the processor. If you are a player with a question about your data, your operator is the right place to ask; they hold the account, and we cannot connect an opaque identifier to a person.

Privacy questions: [email protected]. [supervisory authority and any EU/UK representative — to be confirmed]

“You” here means a person at an operator, or a visitor to this website.

We do not collect special category data, and we do not use automated decision-making that produces legal effects about you.

When an operator launches a game, they send us an external player identifier — a string they choose, meaningless to us. Against that identifier we store what running a game requires:

An operator must not send us anything that identifies a player directly. Where an operator chooses to send a nickname or a country code, they are responsible for having a lawful basis for it.

We act only on the operator’s documented instructions for this data, we keep it isolated per operator, and we do not use it to build profiles or for any purpose of our own beyond running and securing the service.

This website sets no cookies and shows no cookie banner, because there is nothing to consent to. It stores a few values in your browser’s local storage, which never leave your device except where noted:

The two random ids are exactly that — random. They are not derived from anything about you, are not shared with anyone, and clearing your browser storage permanently disconnects you from them.

We keep this list short deliberately. In full, it is:

We may also disclose data where we are legally required to, or to establish or defend legal claims. If we are ever compelled to hand over data about an operator, we will tell them unless we are prohibited from doing so.

We will tell you before adding a processor that handles personal data on an operator’s behalf.

The assistant on our documentation sends your question, plus excerpts of our own public documentation, to DeepSeek to generate an answer. It is worth being precise about what that means:

• Only your question and our public docs are sent. No account data, no credentials, no player data, no transaction data.
• Conversations are stored against the random browser id so you can reopen them. You can delete any conversation from the panel’s history at any time, which removes it from our database.
• Do not paste secrets into it. It is a documentation search tool, not a support channel, and anything you type is sent to a third party.

Where an operator terminates, we keep what we are required to keep and delete the rest. Records we are obliged to retain are the exception to any deletion request.

• Everything is served over TLS. There is no unencrypted fallback.
• Passwords are hashed with scrypt. API secrets are stored as keyed hashes and can never be shown again after creation.
• Secrets at rest are encrypted with AES-256-GCM.
• Operator data is isolated per tenant, enforced at the database layer rather than by application checks.
• The origin servers are not reachable directly from the internet; all traffic arrives through Cloudflare.
• Administrative actions are recorded in an audit log.
• Backups are encrypted, and restores are tested rather than assumed.

If you believe you have found a vulnerability, please tell us at [email protected]. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

We operate internationally, and the processors listed above operate internationally. Where personal data moves between countries, we rely on the transfer mechanism appropriate to the data and destination — standard contractual clauses, or an adequacy decision where one exists.

[primary hosting region and transfer mechanisms — to be confirmed with counsel]

Depending on where you are, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable form, or withdraw consent where we relied on it.

Write to [email protected]. We will respond within one month, and will tell you if we need longer or if an obligation to retain records prevents deletion.

If you are a player: contact your operator, not us. We hold an opaque identifier and cannot connect it to you. If you write to us we will do our best to route you to the right operator, but we cannot act on your data ourselves.

You also have the right to complain to your data protection authority. We would rather you told us first, so we get the chance to fix it.

This is a business service. It is not directed at children, and we do not knowingly collect data about anyone under 18. If you believe a child has given us personal data, tell us at [email protected] and we will delete it.

Age verification for real-money play is the operator’s responsibility, as set out in the Terms of Service.

We will update this page when what we do changes, and the date at the top will change with it. For material changes affecting operators we will give notice to the account contact rather than relying on you to re-read the page.

Questions: [email protected].