xbjai Privacy Policy

When you interact with xbjai — whether by registering an account, making a deposit, placing a bet, contacting customer support, or simply browsing the platform — we may collect certain categories of personal data about you. This section describes what we collect and how that information comes to us.

Information you provide directly:

• Registration data: Your full legal name, date of birth, residential address in Bangladesh (including district, division, and postcode), email address, and mobile phone number.
• Identity verification documents: Copies of government-issued identification (national ID card, passport, or driving licence) and proof-of-address documents submitted as part of our KYC process.
• Payment information: Your bKash, Nagad, Rocket, Upay, or bank account details submitted when making deposits or withdrawal requests. We do not store full card numbers; payment data is tokenised and handled securely.
• Communications: The content of messages you send to our support team at [email protected], including any attachments or screenshots you provide.
• Responsible gaming preferences: Deposit limits, time-out periods, and self-exclusion requests you make through the platform or via support.

Information collected automatically:

• Device and technical data: Your IP address, browser type and version, operating system, device model, screen resolution, and time zone (Bangladesh Standard Time, UTC+6).
• Usage data: Pages visited on xbjai, games played, bet amounts and outcomes, session duration, click patterns, and navigation paths through the platform.
• Transaction data: A complete record of all deposits, withdrawals, bonus credits, and wager transactions associated with your account.
• >Cookies and tracking data: Information collected via cookies, local storage, and similar technologies as described in Section 4 of this Policy.

xbjai uses the personal data we collect for specific, legitimate purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The following table summarises the primary purposes for which we process your personal data and the legal basis for each.

Where we rely on your consent as the legal basis for processing (for example, to send you promotional emails about bonus offers, new games, or seasonal promotions such as BPL and Eid specials), you may withdraw that consent at any time by emailing [email protected] or by using the unsubscribe link in any marketing message. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to that withdrawal.

xbjai does not sell, rent, or otherwise commercially exploit your personal data to unrelated third parties. However, in order to operate the platform and comply with our legal obligations, we do share certain data with a limited set of trusted parties in the following circumstances:

• Payment processors: We share the minimum necessary payment information with our payment partners — including bKash, Nagad, Rocket, Upay, and relevant banking institutions — solely to process your deposits and withdrawals. These partners are contractually bound to handle your data securely and in accordance with their own published privacy policies.
• Identity verification providers: To fulfil our KYC obligations, we may use third-party identity verification services to cross-check the documents you provide. These services are bound by strict confidentiality agreements and may only use your data for verification purposes.
• Game technology providers: Our casino and sports betting games are supplied by established providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may collect anonymised technical data (e.g., game session logs) to ensure fair play and game integrity. They do not receive your full personal profile.
• Analytics providers: We use privacy-conscious analytics tools to understand how players use the platform in aggregate. Any data shared with analytics providers is anonymised or pseudonymised and cannot be used to identify you individually.
• Legal and regulatory authorities: xbjai may disclose your personal data to law enforcement agencies, government bodies, or other regulatory authorities in Bangladesh or relevant jurisdictions where we are legally required to do so — for example, in connection with an anti-money-laundering investigation or a court order.
• Business transfers: In the event that xbjai undergoes a corporate restructuring, merger, or acquisition, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer in advance.

All third parties with whom we share your data are required to implement appropriate technical and organisational security measures and to process your data only for the specific, agreed purposes. We conduct regular due diligence on our third-party partners to ensure ongoing compliance with data protection standards.

xbjai uses cookies and similar tracking technologies to operate the platform effectively, remember your preferences, maintain your session security, and analyse how players interact with our site. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies do not contain executable code and cannot access other data stored on your device.

We use the following categories of cookies on the xbjai platform:

• Strictly necessary cookies: These are essential for the platform to function. They manage your login session, maintain security tokens, and remember your language and currency preferences. You cannot opt out of strictly necessary cookies without also being unable to use the platform.
• Performance and analytics cookies: These cookies help us understand how players navigate xbjai — for example, which pages are most visited, how long sessions last, and where players encounter difficulties. The data collected is aggregated and anonymised.
• Functional cookies: These remember your personalised settings, such as your preferred payment method, responsible gaming limits you have set, and your most recently played games, so that your experience is consistent across sessions.
• Security cookies: Used to detect and prevent fraudulent activity, enforce account session limits, and protect against cross-site request forgery (CSRF) and other security threats.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies; however, blocking strictly necessary cookies will prevent you from logging in to your xbjai account. For detailed guidance on managing cookies in your specific browser, please refer to your browser's help documentation.

The security of your personal data is a core operational priority for xbjai. We implement a multi-layered approach to data security that covers network infrastructure, application security, access controls, and staff training. The following measures are in place to protect your data at all times:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and xbjai servers is encrypted using industry-standard 256-bit SSL/TLS encryption, preventing interception by unauthorised parties.
• Data encryption at rest: Sensitive personal data stored on our servers — including identity documents, payment details, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Only authorised xbjai personnel with a specific operational reason may access player data, and all access events are logged and audited.
• Password security: Account passwords are hashed using a strong cryptographic hashing algorithm. xbjai staff cannot view your password in plain text under any circumstances.
• Regular security audits: We conduct periodic security assessments and penetration tests to identify and remediate vulnerabilities in our systems before they can be exploited.
• Incident response: In the event of a data security incident that poses a risk to your rights and freedoms, xbjai will notify affected users as promptly as reasonably practicable and take immediate steps to contain and investigate the incident.

While xbjai takes all reasonable precautions to protect your data, no digital system can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us immediately at [email protected] if you believe your account has been compromised.

As a player on the xbjai platform, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please submit a written request to [email protected] from the email address registered to your xbjai account. We will respond to all valid requests within 30 calendar days.

• Right of access: You may request a copy of the personal data xbjai holds about you, together with information about how it is being used and with whom it has been shared.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to erasure: In certain circumstances, you may request that we delete your personal data. This right is not absolute — for example, we may be required to retain certain data for legal, regulatory, or anti-money-laundering compliance purposes even after your account is closed.
• Right to restrict processing: You may request that we limit how we use your personal data in certain circumstances — for example, if you contest the accuracy of the data while we investigate your concern.
• Right to data portability: Where technically feasible, you may request a copy of the personal data you have provided to xbjai in a structured, machine-readable format.
• Right to object: You may object to our processing of your personal data where we rely on legitimate interest as the legal basis, including objecting to receiving direct marketing communications.
• Right to withdraw consent: Where we process your data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

xbjai retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the main categories of data we hold:

• Active account data: Retained for the duration of your account's active status plus a minimum of five years following account closure, in line with standard AML record-keeping requirements.
• Transaction records: All deposit, withdrawal, and wagering records are retained for a minimum of five years from the date of the transaction to satisfy financial record-keeping obligations.
• Identity verification documents: KYC documents are retained for five years from the date of submission or from the date of account closure, whichever is later.
• Customer support communications: Retained for two years from the date of the most recent interaction, unless the communication relates to a dispute or investigation, in which case it is retained until the matter is fully resolved.
• Marketing consent records: Retained for the duration of your consent plus three years after you withdraw consent, to demonstrate compliance with consent requirements.
• Self-exclusion records: Retained indefinitely to prevent re-registration during an exclusion period and to maintain the integrity of our responsible gaming programme.

When the applicable retention period expires and there is no longer a legal basis for continued processing, xbjai will securely delete or anonymise the relevant data. Anonymised data (from which you cannot be identified) may be retained beyond these periods for aggregate statistical analysis and platform improvement purposes.

xbjai reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or the services we offer. When we make material changes to this Policy, we will notify registered players by email to the address associated with their xbjai account and by posting a prominent notice on the platform for a minimum of 30 days following the change.

The "Last Reviewed" date displayed at the top of this page will always indicate when the Policy was most recently updated. We encourage you to review this Policy periodically to stay informed about how xbjai protects your personal data.

If you continue to use the xbjai platform after a revised Privacy Policy has been published and the notice period has elapsed, your continued use constitutes acceptance of the updated Policy. If you do not agree with any changes to this Policy, you should discontinue use of the platform and contact [email protected] to request account closure.

For any questions, concerns, or requests relating to this Privacy Policy or xbjai's data protection practices, please contact our dedicated privacy team at [email protected]. We aim to respond to all privacy-related enquiries within five business days.