Privacy Policy

This Privacy Policy applies to all services provided by air128 through the website air128.cam and any related mobile interfaces, applications, and communications channels (collectively, the "Platform"). It governs the collection, use, storage, disclosure, and protection of personal data belonging to registered members, prospective members, and visitors to the Platform.

Air128 operates as a data controller in respect of all personal data collected directly from users. Where we engage third-party service providers who process data on our behalf — such as payment processors, identity verification services, and analytics providers — those parties act as data processors and are contractually bound to handle your data in accordance with this Policy and applicable data protection law.

By registering an account on air128, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, you should not create an account or continue to use the Platform. This Policy should be read alongside our Terms & Conditions, which govern the overall contractual relationship between you and air128.

For clarity and consistency, the following terms carry the meanings defined below throughout this Privacy Policy:

• "Personal Data": Any information that identifies or could reasonably identify a living individual, either directly (e.g., full name, national ID number) or indirectly (e.g., IP address, device fingerprint combined with other data points).
• "Processing": Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure, and destruction.
• "Data Controller": The entity that determines the purposes and means of processing personal data — in this context, air128 as the operator of the Platform.
• "Data Processor": A third party that processes personal data on behalf of the data controller under a binding contractual arrangement (e.g., payment gateway providers, KYC verification vendors).
• "KYC": Know Your Customer — the identity and age verification process used by air128 to confirm player eligibility and satisfy anti-money laundering (AML) obligations.
• "Cookies": Small text files stored on a user's device by a web browser, used to maintain session state, remember preferences, and collect analytical data about platform usage.
• "Special Category Data": Sensitive personal data that requires a higher standard of protection, including information about health, biometrics, religion, or political views. Air128 does not intentionally collect special category data, with the narrow exception of health-related disclosures made voluntarily in the context of responsible gaming requests.

Air128 collects personal data across several categories depending on your level of engagement with the Platform. The categories of data we hold are described below:

Air128 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide directly when creating an account, completing KYC verification, submitting a deposit or withdrawal request, contacting our support team, or responding to a promotional offer.
• Automated Collection: Data collected automatically as you interact with the Platform, including IP address, device identifiers, session data, and behavioral analytics gathered via server logs and first-party cookies.
• Payment Processors: Financial transaction data transmitted to air128 by our approved payment partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay) when you initiate a deposit or withdrawal.
• Identity Verification Providers: Confirmation data returned by our third-party KYC partners following document checks, including verification status and any fraud risk signals generated during the review process.
• Third-Party Analytics: Aggregated and anonymized usage statistics from analytics service providers integrated with the Platform, used solely to improve platform performance and user experience.
• Affiliate and Referral Partners: If you access the Platform via an affiliate referral link, we may receive limited technical data (e.g., referral source identifier) from our affiliate partners to attribute registrations and comply with our affiliate agreements.

Air128 processes personal data for the following specific and legitimate purposes only. We do not process personal data in ways that are incompatible with the purposes listed below:

• Account Management: To create, maintain, and administer your player account, including authentication, password management, and communication of account-related notifications.
• Identity and Age Verification: To confirm that you are at least 21 years of age and a resident of Indonesia, and to satisfy our obligations under applicable KYC and AML regulations. Air128 strictly enforces a 21+ policy and uses identity data for no purpose beyond eligibility verification and fraud prevention.
• Payment Processing: To execute deposit and withdrawal transactions accurately and securely, reconcile your account balance, and maintain financial records as required by applicable law.
• Platform Delivery and Improvement: To provide access to our sports betting, live casino, slot, and other gaming services; to diagnose technical issues; and to improve Platform functionality based on usage analytics.
• Fraud and Security: To detect, prevent, and investigate fraudulent activity, money laundering, account sharing, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions. This includes automated risk-scoring and manual review of flagged accounts.
• Responsible Gaming: To monitor gaming behavior for signs of problem gambling, enforce voluntary deposit limits and self-exclusion orders, and comply with responsible gaming obligations. Data used for this purpose is treated with the highest degree of sensitivity.
• Customer Support: To respond to your inquiries, resolve disputes, and maintain records of support interactions for quality assurance and regulatory compliance purposes.
• Marketing Communications: To send you promotional offers and bonus notifications via email or on-platform messages, where you have provided explicit consent to receive such communications. You may withdraw consent at any time by contacting [email protected].
• Legal and Regulatory Compliance: To meet our obligations under applicable law, including anti-money laundering (AML) legislation, data retention mandates, and any lawful requests from regulatory or law enforcement authorities.

Each processing activity carried out by air128 is grounded in one or more of the following legal bases:

Air128 does not sell, rent, or trade your personal data. We share data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Partners: We transmit the financial data necessary to process your deposits and withdrawals to our approved payment partners, including banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay). These parties are independent data controllers in respect of their own processing activities.
• KYC and Fraud Prevention Vendors: Identity documents and verification data are shared with our contracted identity verification providers solely for the purpose of completing KYC checks and fraud risk assessment. These vendors operate as data processors under binding data processing agreements.
• Game Content Providers: Aggregated, anonymized gameplay session data may be shared with third-party game studios (including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and PG Soft) for technical performance monitoring and game audit purposes. No personally identifiable information is shared with game studios.
• Legal and Regulatory Authorities: Air128 will disclose personal data to competent courts, regulatory bodies, law enforcement agencies, or other governmental authorities where required to do so by law, court order, or other binding legal process. We will notify affected users of such disclosure where permitted by law.
• Business Successors: In the event of a merger, acquisition, restructuring, or sale of all or part of air128's business, personal data may be transferred to the acquiring entity as part of the transaction, subject to the same privacy protections as described in this Policy.
• Affiliate Partners (Limited): We may share a minimal technical identifier (e.g., registration confirmation) with affiliate partners solely for commission attribution purposes. No gameplay data, financial data, or identity documents are shared with affiliates.

Air128 operates infrastructure across multiple jurisdictions. As a result, your personal data may be transferred to and stored on servers located outside Indonesia. Where such transfers occur, air128 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that provided under applicable Indonesian data protection law, including:

• Contractual clauses requiring recipient entities to process data in accordance with the protections described in this Privacy Policy.
• Transfers only to jurisdictions that maintain data protection standards compatible with internationally recognized frameworks.
• Use of encryption in transit (TLS 1.2 or higher) and at rest (AES-256) for all cross-border data flows.

By registering an account on air128, you expressly acknowledge and consent to the transfer of your personal data to processing locations outside Indonesia as described above.

Air128 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or to comply with applicable legal obligations. The following retention schedule applies:

Once the applicable retention period has elapsed, personal data is securely deleted or irreversibly anonymized in accordance with our internal data lifecycle management procedures. Anonymized and aggregated data (from which no individual can be identified) may be retained indefinitely for statistical analysis.

As a data subject, you hold the following rights in respect of your personal data held by air128. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving your request.

Air128 uses first-party cookies and similar tracking technologies to operate the Platform effectively and deliver a consistent user experience. We do not use third-party advertising cookies or behaviorally targeted advertising networks. The cookies we deploy fall into the following categories:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing identifiers. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences, such as your preferred language, last-visited game category, and deposit method. These persist across sessions to reduce friction on repeat visits.
• Analytics Cookies: Aggregate, anonymized data collected to understand how players navigate the Platform — which pages generate the most engagement, where drop-offs occur in registration flows, and how long sessions last. This data informs Platform improvements and does not identify individual users.
• Security Cookies: Used by our fraud prevention and bot-detection systems to distinguish human users from automated traffic, including device fingerprinting tokens and risk-scoring session identifiers.

You may configure your browser to refuse or delete cookies at any time. However, disabling strictly necessary cookies will prevent you from logging into your account and using the Platform. Disabling functional cookies will mean your preferences are not saved between sessions.

Air128 implements a layered security architecture to protect your personal data against unauthorized access, accidental loss, alteration, or destruction. Our security measures include:

• 256-Bit SSL Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.2 or TLS 1.3 with 256-bit AES encryption, preventing interception by third parties.
• Encrypted Data Storage: Sensitive personal data — including identity documents, financial records, and password hashes — is stored using AES-256 encryption at rest on access-controlled infrastructure.
• Access Controls: Personal data is accessible only to air128 staff who require it for their specific job function. Role-based access control policies ensure that no single employee has unnecessary access to sensitive data.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts via our security settings. Internal staff with access to personal data are required to use 2FA for all system access.
• Regular Security Audits: Air128 commissions independent security audits and penetration tests at least annually to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a personal data breach that is likely to result in a risk to affected individuals, air128 will notify impacted players without undue delay and take immediate steps to contain the breach and prevent recurrence.

Air128 operates a strict 21+ platform. We do not knowingly collect or process personal data belonging to individuals under the age of 21. All registration flows include an age declaration, and KYC verification is used to confirm that the age declared matches government-issued identity documents. Any account found to belong to a person under 21 will be immediately suspended and closed, and all associated data and funds will be handled in accordance with applicable law.

If you are a parent or guardian and believe that a minor under your care has accessed the Platform and provided personal data, please contact us immediately at [email protected] with the subject line "Minor Access Report". We will investigate promptly and take all necessary action, including deleting any personal data collected from the minor, within 72 hours of a confirmed report.

The air128 Platform integrates services from third-party providers, including game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, PG Soft, Spribe), payment networks, and analytics providers. When you interact with these integrated services, your data may be processed by those third parties in accordance with their own privacy policies, over which air128 has no direct control.

Air128 is not responsible for the privacy practices of third-party services accessed via links or integrations on our Platform. We encourage you to review the privacy policies of any third-party service with which you interact. Our vetting process for third-party integrations includes a review of their data protection practices and a contractual requirement to meet minimum standards compatible with this Privacy Policy.

Air128 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify registered members via the email address on file and update the "Last Updated" date at the top of this page. Non-material changes (e.g., formatting corrections, clarifications that do not alter the substance of how we process data) may be made without individual notification.

Your continued use of the Platform following publication of an updated Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not agree to the revised Policy, you must cease using the Platform and request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how air128 handles your personal data, please contact our Data Protection team:

Air128 takes all privacy concerns seriously and will engage with complaints in good faith. Where a complaint cannot be resolved through our internal process, you retain the right to escalate to the relevant data protection authority in your jurisdiction.