app1 Privacy Policy — Your Data, Your Rights, Our Obligations

app1 ("we", "us", "our", or the "Platform") is an online sports betting and casino platform operated under the domain app1.vu, designed specifically for players in Bangladesh. We take the privacy of our users seriously and are committed to protecting the personal information you share with us in the course of using our services.

This Privacy Policy describes the types of personal data we collect from you, the purposes for which we process that data, the parties with whom we may share it, the measures we take to keep it secure, and the rights you hold in relation to your personal information. This policy applies to all data processing activities carried out by app1 in connection with the Platform, including registration, account management, sports betting, casino gaming, payment processing, customer support, and marketing communications.

By accessing or using any part of the app1 Platform, you confirm that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this policy, you must discontinue use of the Platform immediately and contact Support to request Account closure.

app1 collects personal data from you directly, automatically, and in some cases from third-party sources such as payment processors and identity verification providers. The categories of data we collect include:

2.1 Registration and Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify the minimum age requirement of 21 years).
• Email address and mobile phone number.
• Residential address, including city and district (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, or Rangpur).
• Username and encrypted password.
• Copies of identity documents submitted during KYC verification, such as National ID, passport, or driving licence.

2.2 Financial and Payment Data

• bKash, Nagad, Rocket, or Upay mobile wallet numbers used for deposits and withdrawals.
• Bank account details where bank transfers are used (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, or others).
• Transaction history including deposit amounts, withdrawal amounts, dates, and reference numbers.
• Currency: all financial data is recorded in Bangladeshi Taka (BDT).

2.3 Usage and Behavioural Data

• Betting history: sports markets wagered on, stake amounts, odds accepted, and settlement outcomes.
• Casino game history: titles played, session durations, spin values, and win/loss records.
• Login times, session durations, IP addresses, and device identifiers.
• Clickstream data: pages visited, features accessed, and navigation patterns within the Platform.
• Responsible gaming settings: deposit limits, loss limits, self-exclusion history, and session reminder configurations.

2.4 Communications Data

• Content of live chat conversations with the app1 Support team.
• Email correspondence sent to or received from app1 support addresses.
• Records of promotional emails or SMS messages sent to you and whether they were opened or acted upon.

2.5 Technical Data

• Browser type and version, operating system, and device type (smartphone, tablet, desktop).
• Screen resolution and language settings.
• Referring URL — the site or link that directed you to app1.
• Mobile network operator name and connection type (4G, Wi-Fi).

app1 uses the personal data it collects for the following specific purposes:

app1 does not use your personal data to make fully automated decisions that produce legal or similarly significant effects without human oversight. Where automated systems are used (for example, in fraud detection), flagged cases are reviewed by a qualified member of the app1 compliance or security team before any account action is taken.

app1 processes your personal data on the following legal grounds, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our obligations under the Terms and Conditions you entered into when registering your Account — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering obligations, age verification requirements, and fraud reporting duties.
• Legitimate interests: Processing carried out for purposes that are necessary for the legitimate operation of our business, such as fraud prevention, security monitoring, platform analytics, and improving our services — where these interests are not overridden by your data protection rights.
• Consent: Processing for optional purposes, such as sending you personalised marketing communications via email or SMS. You may withdraw this consent at any time by updating your notification preferences in your Account settings or by contacting Support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

app1 does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. We share your data only as described below:

5.1 Payment Processors

To process your deposits and withdrawals, app1 shares the minimum necessary payment data with our payment processing partners, including bKash, Nagad, Rocket, and Upay. These providers operate under their own privacy policies and are bound by contractual data processing agreements with app1.

5.2 Identity Verification Providers

For KYC verification purposes, app1 may share identity document images and personal details with accredited third-party identity verification services. These providers verify the authenticity of submitted documents and confirm that the data matches your registration details. Verification data is used solely for this purpose and is not retained by the provider beyond the verification period.

5.3 Game Providers

Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a session token and anonymised player identifier to facilitate your game sessions. These providers do not receive your full name, payment details, or contact information. Game outcome data is transmitted back to app1 for wallet settlement purposes.

5.4 Legal and Regulatory Disclosure

app1 may disclose your personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction when required to do so by applicable law, court order, or in connection with the investigation of fraud, money laundering, or other criminal activity. In such cases, app1 will disclose only the minimum data necessary to satisfy the legal requirement.

5.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of app1's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any resulting change to the applicable privacy policy with a minimum of 30 days' advance notice.

app1 uses cookies and similar tracking technologies on its Platform to deliver a functional, personalised, and secure user experience. The categories of cookies we use are as follows:

• Essential cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Used to remember your preferences, such as your preferred language, deposit method, and responsible gaming settings, so you do not have to re-enter them at each visit.
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate the Platform — which pages are visited most, where users drop off, and how features are used. This data helps app1 improve the Platform over time. No personally identifiable information is included in analytics reports.
• Marketing cookies: Used to identify your visit to app1 from a referral source and to personalise promotional offers displayed within the Platform based on your activity history. These cookies are only set after you have consented to marketing communications.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling essential cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions. Disabling functional and analytics cookies will not prevent you from using the Platform but may reduce personalisation quality.

app1 does not use cross-site tracking technologies to follow your activity on websites other than app1.vu.

app1 retains your personal data only for as long as is necessary for the purposes described in this Privacy Policy, or as required by applicable law. The following retention periods apply:

When the applicable retention period expires, app1 will securely delete or anonymise your personal data so that it can no longer be linked back to you. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.

The specific security measures app1 implements include:

• Transport encryption: All data transmitted between your device and app1 servers is protected by 256-bit TLS/SSL encryption, preventing interception during transit.
• Data-at-rest encryption: Sensitive data stored on app1 servers, including identity documents and financial records, is encrypted using AES-256 encryption.
• Access controls: Access to personal data is strictly limited to app1 staff and contractors who require it to perform their job functions. All such access is logged and audited.
• Password security: User passwords are hashed using a one-way cryptographic algorithm. app1 employees cannot read your password in plain text and will never ask you to disclose it.
• Intrusion detection: app1's infrastructure is monitored continuously for signs of unauthorised access or anomalous activity. Alerts are reviewed by our security team in real time.
• Penetration testing: app1 engages independent security specialists to conduct regular penetration testing of its platform and infrastructure.

Despite these measures, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a risk to your rights and freedoms, app1 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

You are responsible for maintaining the security of your Account credentials. You should use a strong, unique password for your app1 Account and must not share your login details with any third party. If you suspect your Account has been compromised, contact Support immediately via live chat.

As a player on the app1 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our Support team via live chat or email at support at app1.vu. We will respond to all verified requests within 30 days.

• Right of access: You may request a copy of the personal data app1 holds about you, together with information about how it is being processed.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it.
• Right to erasure: In certain circumstances, you may request that app1 delete your personal data. This right is subject to limitations where we are required to retain data by law (for example, to comply with financial record-keeping obligations) or where retention is necessary for the establishment, exercise, or defence of legal claims.
• Right to restrict processing: You may request that we limit the processing of your personal data in specific circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being considered.
• Right to data portability: Where processing is based on your consent or on a contract with you, you may request a copy of the personal data you provided to app1 in a structured, machine-readable format.
• Right to object: You may object to the processing of your personal data where app1 relies on legitimate interests as its legal basis, unless app1 can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent — such as for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Identity verification may be required before we can action a data rights request, to ensure that we do not disclose, amend, or delete personal data at the request of an unauthorised person.

The app1 Platform integrates third-party services for the delivery of games, payment processing, and analytics. While app1 carefully selects its third-party partners and requires them to operate to appropriate data protection standards, each third-party provider is governed by its own privacy policy. app1 is not responsible for the privacy practices of third-party providers.

The third-party service categories integrated into app1 include:

• Game studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and Hacksaw Gaming deliver game content via API integration. Game session data is processed by these providers' certified game servers.
• Payment processors: bKash, Nagad, Rocket, and Upay process mobile wallet transactions. Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank process bank transfer transactions. These institutions operate under the regulatory oversight of Bangladesh Bank.
• Analytics providers: Aggregated, anonymised usage data is processed by analytics platforms to help app1 understand Platform performance. No personally identifiable data is included in these analytics streams.

app1 does not embed social media plugins, external advertising networks, or cross-site tracking pixels on its Platform pages. No data collected on app1 is shared with social media platforms for targeting or profiling purposes.

The app1 Platform is strictly intended for adults aged 21 years and above. app1 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person below the minimum age, we will immediately close the associated Account and securely delete all personal data collected from that individual.

If you are a parent or guardian and you believe that your child has registered an Account on app1 without your knowledge, please contact our Support team immediately via live chat. We will investigate and take appropriate action within 24 hours of receiving a verified report.

app1 encourages all adults in shared households to use device-level parental controls to prevent minors from accessing online gambling platforms. Further guidance on parental controls and responsible gaming tools is available on our Responsible Gaming page.

app1 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When material changes are made to this policy, app1 will notify registered players by email and via an in-Platform notification at least 7 days before the changes take effect.

The effective date and version number at the top of this document will be updated each time a new version is published. The most current version of this Privacy Policy is always available at app1.vu/privacy-policy. We encourage you to review this policy periodically to stay informed about how app1 protects your data.

Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to any change in the Privacy Policy, you must cease using the Platform and contact Support to request Account closure.

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data app1 holds about you, please contact our Support team at: support at app1.vu. Our data protection queries team aims to respond to all written enquiries within 2 business days (Bangladesh Standard Time, UTC+6).