grap88 is committed to protecting the privacy and personal data of every player on our platform. This Privacy Policy explains precisely what data we collect, why we collect it, how we use and store it, and the rights you hold as a data subject.
grap88 ("we", "us", "our") operates the online gaming and sports betting platform accessible at https://grap88.cam (the "Platform"). We are committed to handling the personal data of our users — the vast majority of whom are resident in Indonesia — with the highest standards of care, transparency, and security.
This Privacy Policy applies to all personal data processed by grap88 in connection with your use of the Platform, including data collected during account registration, identity verification (KYC), deposit and withdrawal transactions, gameplay activity, customer support interactions, and marketing communications. It applies whether you access the Platform via desktop browser, mobile browser, or any other interface.
This Policy is incorporated by reference into grap88's Terms & Conditions. Where any conflict exists between this Policy and the Terms, this Privacy Policy shall govern with respect to data protection matters. By creating an account on the Platform or continuing to use our services, you acknowledge that you have read and understood this Privacy Policy.
Our Core Commitment: grap88 will never sell, rent, or otherwise commercially exploit your personal data to third parties for their own marketing purposes. Your data is used exclusively to operate, improve, and secure your gaming experience on our Platform.
The following terms have the meanings set out below throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably be used to identify a living natural person, including name, email address, mobile number, IP address, device identifiers, and financial account details. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, storage, use, disclosure, modification, or deletion. |
| "Data Controller" | grap88, the entity that determines the purposes and means of processing your Personal Data. |
| "Data Processor" | A third party that processes Personal Data on behalf of grap88 under a binding contractual agreement (e.g., payment processors, KYC verification providers). |
| "User" / "You" | Any individual who accesses or uses the grap88 Platform, whether as a registered account holder or an anonymous visitor. |
| "Sensitive Data" | A sub-category of Personal Data that warrants heightened protection: national identity numbers (KTP), financial account numbers, and biometric data submitted during KYC verification. |
grap88 collects the minimum data necessary to provide a functional, secure, and legally compliant gaming service. The categories of Personal Data we collect are as follows:
grap88 collects Personal Data through the following channels:
grap88 does not purchase Personal Data lists from data brokers or third-party marketing vendors. All data we hold about you originates from your direct interaction with the Platform or from service providers acting on our instruction.
grap88 processes your Personal Data only where a valid legal basis exists. The table below maps each processing purpose to its corresponding legal basis:
| Processing Purpose | Legal Basis |
|---|---|
| Account creation and management | Performance of a contract — necessary to provide the gaming service you have requested. |
| Processing deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja | Performance of a contract — necessary to execute payment transactions on your behalf. |
| KYC identity verification and AML screening | Legal obligation — required under our international gaming licence's AML compliance framework. |
| Fraud detection and security monitoring | Legitimate interests — protecting grap88, its users, and the integrity of the Platform from fraudulent activity. |
| Responsible gaming monitoring and intervention | Legal obligation and legitimate interests — required to identify at-risk players and apply protective measures, including enforcing the 21+ age policy. |
| Customer support and dispute resolution | Performance of a contract and legitimate interests — resolving queries and fulfilling service commitments. |
| Platform analytics and product improvement | Legitimate interests — understanding how the Platform is used in order to improve its performance, reliability, and user experience. |
| Promotional and bonus communications | Consent — where you have opted in to receive marketing communications, or legitimate interests for service-related notifications directly relevant to your account activity. |
grap88 does not sell, rent, or transfer your Personal Data to third parties for their own commercial purposes. We share data only in the circumstances described below, and only to the minimum extent necessary:
We engage carefully selected third-party service providers who process data on our behalf under contractual data processing agreements. These include:
grap88 may be required to disclose Personal Data to regulators, law-enforcement agencies, courts, or other competent authorities where required or permitted by applicable law — for example, in response to a court order, a subpoena, or a regulatory investigation. We will notify you of any such disclosure to the extent permitted by law.
In the event that grap88 is involved in a merger, acquisition, asset sale, or corporate restructuring, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any change in the data controller's identity and given the opportunity to request account deletion before the transfer takes effect.
What We Will Never Do: grap88 will never sell your Personal Data to advertising networks, data brokers, or third-party marketers. We will never share your financial account details with any party other than the specific payment processor required to execute your transaction.
grap88 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and our international gaming licence obligations. Our standard retention periods are as follows:
| Data Category | Retention Period |
|---|---|
| Account registration data | Duration of the account plus five (5) years after closure, to satisfy AML record-keeping requirements. |
| KYC documents | Five (5) years from the date of submission or from account closure, whichever is later. |
| Financial transaction records | Seven (7) years from the date of each transaction, in line with international AML standards. |
| Gameplay logs and session data | Three (3) years from the date of each session, unless required for an ongoing investigation or dispute. |
| Customer support records | Three (3) years from the resolution date of each support interaction. |
| Marketing consent records | Until consent is withdrawn, plus one (1) year thereafter for audit purposes. |
| Technical and device logs | Ninety (90) days on a rolling basis, unless flagged for security investigation. |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification.
grap88 implements a multi-layered security architecture to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme includes the following controls:
While grap88 applies industry-leading security controls, no digital system is entirely immune to risk. You play an important role in protecting your account by using a strong, unique password and enabling two-factor authentication. Never share your login credentials with any third party.
grap88 uses cookies and similar tracking technologies to operate the Platform, enhance your user experience, and gather aggregate analytics data. The categories of cookies we use are described below:
These cookies are essential for the Platform to function and cannot be disabled. They are used to maintain your authenticated session, remember your security preferences, and ensure the stability of the gaming environment. No consent is required for strictly necessary cookies.
Functional cookies remember choices you have made — such as your preferred language, display settings, and responsible gaming tool configurations — so that you do not need to reconfigure them on every visit. Disabling functional cookies may degrade your experience on the Platform.
Analytics cookies collect aggregated, anonymised data about how users navigate the Platform — which pages are most visited, where users encounter errors, and how session flows proceed. This data is used exclusively to improve Platform performance and does not identify you individually. We use privacy-respecting analytics tools and do not share raw analytics data with advertising networks.
You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. Instructions for managing cookies are available in the help documentation of all major browsers. grap88 does not serve third-party advertising cookies or cross-site tracking cookies.
As a user of the grap88 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team using the details in Section 15. We will respond to all valid requests within thirty (30) days:
Request a copy of all Personal Data grap88 holds about you, including the purposes for which it is processed.
Request correction of any inaccurate or incomplete Personal Data held in your account profile or records.
Request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
Object to the processing of your data on the grounds of legitimate interests, including profiling for marketing purposes.
Request that we restrict processing of your data while a complaint or rectification request is being resolved.
Receive a copy of your data in a structured, machine-readable format so you can transfer it to another service provider.
Where processing is based on consent (e.g., marketing emails), withdraw that consent at any time without affecting prior processing.
Lodge a complaint with the applicable data protection supervisory authority if you believe your rights have been violated.
Please note that certain rights are subject to limitations — for example, we cannot erase data that we are legally required to retain under AML regulations, and we cannot provide portability of data that is not technically structured in a portable format.
The grap88 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step during account registration and again during KYC review — all users must confirm their date of birth and provide a valid identity document confirming they meet the minimum age requirement.
Where grap88 discovers or has reasonable grounds to believe that a user is under 21 years of age, we will immediately suspend that user's account, block all further access to the Platform, void any Bonus balances, and return any verifiable real-money deposits to the payment method used — after completing any required AML review. Parents and guardians who become aware that a minor has accessed the Platform are encouraged to contact our support team immediately.
21+ Only: grap88 takes underage gambling extremely seriously. We employ automated age-screening tools and manual KYC review processes to enforce this requirement. Attempted access by minors will result in permanent account closure and reporting to relevant authorities where required by law.
grap88 operates globally and your Personal Data may be transferred to, stored on, or processed by systems located outside of Indonesia. This may occur in connection with our cloud infrastructure, game content providers, or KYC verification partners whose servers are hosted in other jurisdictions.
Where such transfers occur, grap88 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required by applicable data protection law. These safeguards may include:
If you would like further information about the specific safeguards applied to any international transfer of your data, please contact our support team using the details provided in Section 15 of this Policy.
The grap88 Platform integrates third-party services that are essential for its operation. While we select all third-party partners carefully and require them to adhere to appropriate data protection standards, each third party operates under its own privacy policy and terms of service for which grap88 is not responsible.
Third-party services integrated into the grap88 Platform include:
grap88 does not embed social media plugins, advertising network trackers, or affiliate tracking pixels that share user data with external advertising platforms.
grap88 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. The "Last Updated" date at the top of this page will be revised whenever a change is made.
For material changes — those that significantly affect your rights or how your data is used — grap88 will provide not less than fourteen (14) days' advance notice by email to your registered address before the updated Policy takes effect. For minor or administrative amendments that do not materially affect your rights, the updated Policy will take effect upon publication and the revised "Last Updated" date will serve as notice.
We encourage you to review this Privacy Policy periodically. If you disagree with any amendment, you may exercise your right to request account closure as described in the Terms & Conditions, and your data will be handled in accordance with the retention obligations described in Section 7.
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how grap88 handles your Personal Data, please contact us through the following channels:
grap88 will acknowledge all privacy-related requests within twenty-four (24) hours and aim to provide a substantive written response within thirty (30) calendar days. Where a request is complex or voluminous, we may extend this period by up to a further thirty (30) days — you will be notified if an extension is required.
If you are dissatisfied with our response to your privacy concern, you have the right to escalate your complaint to the applicable data protection supervisory authority in the jurisdiction governing this Policy. We will provide you with the relevant authority's contact details upon request.
grap88 takes all privacy complaints seriously. Our dedicated data protection team reviews every request personally and strives to resolve concerns promptly, fairly, and transparently. Your trust is the foundation of everything we do.
Every byte of data transmitted between your device and grap88's servers is protected by TLS 1.3 encryption. Sensitive stored data — including KYC documents and financial details — is encrypted at rest using AES-256.
grap88 has a firm, unconditional policy of never selling, renting, or commercially exploiting your personal data. Your information is used only to operate your account and secure your gaming experience.
You have the right to access, correct, delete, or export your personal data at any time. Request a full copy of your data or ask us to erase it — we respond to every request within 30 days.
We collect only the data necessary to operate your account, comply with KYC regulations, and deliver a secure gaming experience. No unnecessary tracking, no invasive profiling.
Every category of data we collect has a defined retention period. Once that period expires, your data is securely deleted or anonymised so it can never be re-identified.
Have a privacy question or want to exercise your rights? Our Indonesian-speaking support team is available around the clock via live chat and email to assist you immediately.
Our support team is standing by 24/7 to answer any question about how we collect, use, store, or protect your personal data. You can also review our Terms & Conditions, Responsible Gaming page, and FAQ for additional context on account security and compliance.