Privacy Policy

sora89 ("we", "us", "our") operates the online gaming platform accessible at https://sora89.cam and is committed to protecting the privacy and security of all personal data entrusted to us by our users ("you", "your", "Player"). This Privacy Policy sets out in clear, comprehensive terms what personal information we collect, the purposes for which we collect and process it, who we share it with, how long we retain it, and what rights you hold in relation to your own data.

This policy applies to all personal data collected through:

• The sora89 website and any mobile-optimized version thereof;
• The sora89 account registration and login process;
• All transactional activities conducted through the platform, including deposits, withdrawals, and gameplay;
• Customer support interactions conducted via live chat, email, or WhatsApp;
• Promotional and marketing communications to which you have subscribed or consented.

sora89's primary market is Indonesia. Our services are directed at Indonesian residents who are at least 21 years of age. References to applicable data protection principles in this policy are made with regard to internationally recognized standards of personal data protection, including transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — Any information that identifies or can reasonably be used to identify a living individual, either on its own or in combination with other available data.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — sora89, as the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" — Any third-party entity that processes personal data on behalf of sora89 under a contractual arrangement, such as payment processors, analytics providers, and cloud hosting services.
• "Sensitive Data" — A subset of personal data that warrants heightened protection, including identity document details, financial account information, and KYC verification materials.
• "Cookies" — Small text files placed on your device by the sora89 platform for session management, performance analytics, and personalization purposes.
• "KYC" — Know Your Customer — the regulatory identity verification process conducted prior to authorizing withdrawals and as part of ongoing compliance obligations.

sora89 collects only the personal data that is necessary and proportionate to the purposes described in this policy. The categories of data we collect are as follows:

We do not collect special categories of sensitive personal data beyond identity verification materials required for KYC compliance. We do not collect biometric data, health data, political opinions, or religious beliefs.

sora89 collects personal data through the following channels:

• Direct Submission: Information you provide voluntarily when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or subscribing to promotional communications.
• Automated Technical Collection: Data gathered automatically as you interact with the platform, including IP addresses, device identifiers, browser fingerprints, and session activity logs captured via server logs and analytics tools.
• Cookies and Similar Technologies: Data collected via cookies, pixel tags, and local storage mechanisms placed on your device when you visit the sora89 website. See Section 11 for full details on our cookie practices.
• Third-Party Sources: Information received from payment processors, identity verification service providers, and fraud prevention partners as part of our KYC and transaction screening processes.
• Customer Support Interactions: Data generated during live chat sessions, email exchanges, and WhatsApp communications with our support team, which may be recorded for quality assurance and training purposes.

sora89 processes your personal data only where a valid legal basis exists. The bases upon which we rely are as follows:

• Contractual Necessity: Processing required to perform our obligations under the user agreement, including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable anti-money laundering regulations, KYC mandates, and any lawful request from a competent regulatory or law enforcement authority.
• Legitimate Interests: Processing carried out in pursuit of sora89's legitimate business interests — including fraud prevention, platform security, abuse detection, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications, optional personalization features, and non-essential cookies, where we have obtained your explicit prior consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Personal data collected by sora89 is used exclusively for the following purposes:

• Account Creation and Management: To register your account, verify your identity, maintain accurate account records, and provide access to the platform's full range of gaming services.
• Payment Processing: To facilitate deposits and withdrawals via Indonesian bank transfers (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain accurate transaction records.
• KYC and Regulatory Compliance: To verify your identity and age (21+), screen transactions against anti-money laundering requirements, and fulfill any other applicable regulatory obligations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, bonus abuse, multi-accounting, and other prohibited conduct, and to protect the integrity of the platform for all users.
• Customer Support: To respond to your inquiries, resolve disputes, process complaints, and deliver the level of service you are entitled to as a registered sora89 player.
• Platform Improvement: To analyze usage patterns, identify performance issues, conduct A/B testing, and continuously enhance the quality, speed, and reliability of the sora89 platform.
• Responsible Gaming Monitoring: To identify behavioral patterns that may indicate problem gambling and to proactively offer responsible gaming tools, deposit limits, or support resources where appropriate.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to users who have opted in to receive such communications. You may unsubscribe at any time via the link in any marketing email or by contacting our support team.
• Legal and Compliance Functions: To preserve records as required by applicable law, to respond to lawful requests from regulatory authorities, and to enforce our Terms & Conditions.

We do not use your personal data for fully automated decision-making processes that produce legal or similarly significant effects without human oversight.

sora89 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following limited and controlled circumstances:

• Payment Service Providers: We share necessary financial and identity data with our payment processing partners — including Indonesian bank networks and e-wallet operators — solely to execute deposit and withdrawal transactions on your behalf.
• Identity Verification Providers: We engage specialist KYC and identity verification providers who process your identity documents and biographic data on our behalf, strictly under data processing agreements that prohibit secondary use of your data.
• Fraud Prevention and Security Services: We may share technical data (such as IP addresses and device fingerprints) with fraud detection services to identify and prevent fraudulent activity on the platform.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive limited session and gameplay data necessary to deliver their games via the sora89 platform. These providers process data under their own privacy policies and are contractually bound to data security standards.
• Cloud Hosting and IT Infrastructure: Your data is stored on secure cloud servers operated by our infrastructure partners. These providers act as data processors under binding contractual terms and do not use your data for their own purposes.
• Legal and Regulatory Authorities: We will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by applicable law, court order, or binding regulatory directive. Where legally permissible, we will notify you of such disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of sora89's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained. You will be notified of any such transfer in advance.

All third parties with whom sora89 shares personal data are required to maintain appropriate technical and organizational security measures and are prohibited from using your data for any purpose other than those explicitly authorized by sora89.

8.1 Cross-Border Processing. As an internationally operated online gaming platform, sora89 may transfer your personal data to service providers and infrastructure partners located outside Indonesia. Such transfers are necessary to deliver the platform's services, process payments, and maintain platform security.

8.2 Safeguards. Where personal data is transferred internationally, sora89 ensures that appropriate safeguards are in place, including contractual data protection clauses with recipient entities that impose data handling obligations equivalent to those described in this policy.

8.3 Your Rights. You may request information about the safeguards applied to international transfers of your personal data by contacting our support team using the details provided in Section 16.

9.1 Retention Periods. sora89 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, including satisfying legal, regulatory, accounting, and reporting requirements. Key retention periods are as follows:

• Active Account Data: Retained for the full duration of your account's active status and for a minimum of five (5) years following permanent account closure.
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years following the completion of the KYC process or account closure, whichever is later, in compliance with anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer Support Communications: Retained for a minimum of two (2) years from the date of the interaction.
• Marketing Preference Data: Retained until you withdraw consent or request deletion, plus a short suppression period to ensure your opt-out preference is honored across all systems.
• Technical and Log Data: Typically retained for up to twelve (12) months for security and fraud investigation purposes, unless a longer period is required in relation to an active investigation.

9.2 Secure Deletion. Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with industry-standard data destruction practices.

sora89 implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• SSL/TLS Encryption: All data transmitted between your device and the sora89 platform is encrypted using industry-standard Transport Layer Security (TLS) protocols, ensuring that your personal and financial data cannot be intercepted in transit.
• Data Encryption at Rest: Sensitive data stored on our servers — including identity documents, financial account details, and account credentials — is encrypted using AES-256 or equivalent industry-standard encryption algorithms.
• Access Controls: Access to personal data is strictly limited to sora89 employees and authorized service providers who require it to perform their job functions. All personnel with access to personal data are bound by confidentiality obligations.
• Two-Factor Authentication (2FA): We offer two-factor authentication for player accounts to provide an additional layer of protection against unauthorized login attempts.
• Penetration Testing and Security Audits: The sora89 platform undergoes regular security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential security risks proactively.
• Incident Response: sora89 maintains a documented data breach response procedure. In the event of a security incident that poses a risk to your personal data, we will notify affected users and relevant authorities within the timeframes required by applicable law.

While sora89 takes all reasonable steps to protect your data, no digital system can guarantee absolute security. You also play an important role in keeping your account secure — please ensure that you use a strong, unique password and do not share your login credentials with anyone.

11.1 What Are Cookies. Cookies are small text files stored on your device when you visit the sora89 platform. They allow us to recognize your browser, maintain your session, and remember your preferences between visits. We also use similar technologies such as pixel tags and local storage for analogous purposes.

11.2 Types of Cookies We Use.

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cannot be disabled without impairing your ability to use the platform.
• Performance and Analytics Cookies: Used to collect aggregate, anonymized data about how users interact with the platform — such as which pages are visited most frequently and where users encounter errors. This data helps us continuously improve platform performance.
• Functional Cookies: Used to remember your preferences, such as your preferred language, display settings, and last-used payment method, to provide a more personalized experience on return visits.
• Marketing and Targeting Cookies: Used, with your consent, to deliver relevant promotional content based on your browsing behavior and gaming interests. These cookies may be set by sora89 or by third-party advertising partners.

11.3 Cookie Duration. Session cookies expire automatically when you close your browser. Persistent cookies remain on your device for a defined period (typically between 30 days and 12 months) or until you delete them manually via your browser settings.

11.4 Managing Cookies. You may control and delete cookies through your browser settings. Please note that disabling certain cookies may affect your ability to use some features of the sora89 platform, including maintaining a logged-in session.

As a user of the sora89 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 16. We will respond to all valid requests within a reasonable timeframe, and in any event within 30 days of receipt.

Please note that certain rights are subject to limitations where legal retention obligations, fraud prevention requirements, or contractual necessity require us to retain or continue processing certain data despite a request for restriction or erasure.

13.1 Age Restriction. The sora89 platform is strictly intended for adults who are at least 21 years of age. We do not knowingly collect, store, or process personal data from individuals under the age of 21. Age verification is a mandatory component of the account registration and KYC process.

13.2 Underage Account Discovery. If sora89 discovers or has reasonable grounds to believe that an account is held by a person under the age of 21, we will immediately suspend that account, halt all associated transactions, and initiate the process of securely deleting any personal data collected from that individual. Any deposits made by an underage user will be returned, less any amounts already wagered, subject to the completion of identity verification.

13.3 Parental Awareness. If you are a parent or guardian and believe that your child has accessed the sora89 platform and provided personal data without your authorization, please contact us immediately using the details in Section 16 so that we can take appropriate action.

14.1 External Links. The sora89 platform may contain references to third-party game studios and payment providers. This Privacy Policy applies solely to data processed by sora89. It does not extend to the data practices of any third-party service, website, or application.

14.2 Game Studios. When you play games provided by third-party studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft, those studios may process limited gameplay data as part of their game delivery infrastructure. Their data handling practices are governed by their respective privacy policies, over which sora89 has no control beyond the contractual terms negotiated with each provider.

14.3 Payment Processors. Deposits and withdrawals processed via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja) involve the transmission of financial data to those institutions. Each institution processes such data in accordance with its own privacy and security policies. sora89 is not responsible for the data practices of these third-party financial institutions beyond the data it directly provides to them.

14.4 Due Diligence. sora89 conducts due diligence on all third-party data processors prior to engagement and requires them to maintain data handling standards commensurate with those described in this Privacy Policy.

15.1 Right to Update. sora89 reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, our business practices, or the services we offer. The "Last Updated" date at the top of this document reflects the date on which the most recent version took effect.

15.2 Notification of Material Changes. Where an amendment materially affects how we process your personal data or significantly changes your rights, sora89 will provide advance notice via email to your registered address or via a prominent in-platform notification, prior to the change taking effect.

15.3 Continued Use as Acceptance. Your continued use of the sora89 platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you disagree with any change, you should cease using the platform and may request account closure in accordance with our Terms & Conditions.

We recommend that you review this Privacy Policy periodically so that you remain informed about how sora89 protects and processes your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy, or wish to exercise any of the rights described in Section 12, please contact the sora89 data protection team through the following channels:

• Email: [email protected]
• WhatsApp: +62-812-3456-7890
• Live Chat: Available 24 hours a day, 7 days a week, directly within the sora89 platform

Our support and data protection team is available around the clock, including during major Indonesian public holidays such as Idul Fitri, Idul Adha, and Hari Kemerdekaan (17 August). We commit to acknowledging all privacy-related requests within 48 hours and resolving them within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by up to an additional 30 days, in which case we will notify you of the extension and its reasons.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to a competent data protection supervisory authority in your jurisdiction.