ahtoto takes your privacy seriously. This Policy explains precisely what personal data we collect, why we collect it, how we protect it, and the rights you hold as a Member of our platform.
Last Updated: January 2026 | Effective Date: January 2026
ahtoto operates the online gaming platform accessible at https://ahtoto.cam, offering sports betting, live casino, togel (Indonesia's traditional numbers lottery), and slot-gaming services to adults aged 21 and above, with a primary focus on players located in Indonesia. As the data controller for all personal information collected through the Platform, ahtoto is committed to handling that information responsibly, transparently, and in accordance with internationally recognised data-protection principles.
This Privacy Policy sets out, in clear and accessible language, the categories of personal data ahtoto collects from Members and visitors, the purposes for which that data is processed, the legal bases on which processing rests, the third parties with whom data may be shared, and the rights that Members hold in respect of their personal information. It should be read alongside our Terms & Conditions, which govern the broader contractual relationship between ahtoto and its Members.
This Policy applies to all personal data collected through the Platform, through our customer-support channels (live chat, email at [email protected]), and through any promotional or marketing communications ahtoto issues to Members. It does not apply to third-party websites, payment processors, or game-studio platforms that you may access via links or integrations within the Platform — those services operate under their own privacy policies.
| Term | Meaning in This Policy |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably be used to identify a living individual, whether directly (e.g., full name) or indirectly (e.g., device fingerprint combined with an IP address). |
| "Processing" | Any operation performed on Personal Data, including collection, storage, retrieval, consultation, use, disclosure, erasure, or destruction. |
| "Data Controller" | ahtoto — the entity that determines the purposes and means of processing Members' Personal Data. |
| "Data Processor" | A third party that processes Personal Data on behalf of ahtoto under a written data-processing agreement (e.g., KYC verification providers, payment processors). |
| "Member" / "You" | Any individual who has registered an account on the Platform or otherwise submitted personal information to ahtoto. |
| "Sensitive Data" | A subset of Personal Data that warrants heightened protection, including national identity numbers (KTP), financial account details, and identity-document scans submitted for KYC verification. |
| "Cookies" | Small text files placed on a Member's device by the Platform's web server to enable functionality, remember preferences, and support analytics. |
ahtoto collects the following categories of personal data from Members and, where applicable, from visitors who browse the Platform without registering:
3.1 Registration & Identity Data
3.2 KYC & Verification Documents
3.3 Financial & Transaction Data
3.4 Technical & Usage Data
3.5 Communication Data
ahtoto collects personal data through the following channels:
ahtoto processes your personal data for the following purposes:
| Purpose | Details |
|---|---|
| Account Management | Creating and maintaining your Member account, authenticating your identity on login, and managing your account preferences and settings. |
| KYC & Age Verification | Verifying that you are at least 21 years of age and confirming your identity to prevent fraud, money laundering, and underage access. |
| Payment Processing | Processing deposits and withdrawals through your chosen local bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and maintaining accurate financial records. |
| Platform Operations | Delivering the gaming and betting services you request, recording wager outcomes, calculating winnings, and crediting your account balance. |
| Responsible Gaming | Monitoring gaming patterns to identify signs of problem gambling, enforcing deposit limits and self-exclusion requests, and communicating responsible-gaming resources to at-risk Members. |
| Fraud & Security | Detecting and preventing fraudulent transactions, account takeovers, collusion, bonus abuse, and money-laundering activity across the Platform. |
| Customer Support | Responding to your queries and complaints, maintaining support records, and improving the quality of our assistance over time. |
| Legal & Regulatory Compliance | Fulfilling obligations under ahtoto's international gaming licence, including mandatory record-keeping, suspicious-transaction reporting, and cooperation with competent authorities. |
| Marketing Communications | Sending you promotional offers, bonus notifications, and event information — only where you have given explicit consent and only in relation to ahtoto's own services. |
| Platform Improvement | Analysing aggregated, anonymised usage data to improve the Platform's features, performance, and user experience for all Members. |
ahtoto processes your personal data on the following legal bases under internationally recognised data-protection frameworks:
ahtoto does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose.
The ahtoto Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure experience for every Member. The following categories of cookies may be placed on your device when you access the Platform:
| Cookie Type | Purpose | Can Be Declined? |
|---|---|---|
| Strictly Necessary | Enable core Platform functions: session authentication, account login, shopping-cart equivalents (wager slip), and security token validation. The Platform cannot function without these cookies. | No — these are essential. |
| Functional | Remember your preferences such as language, display settings, and previously selected payment methods to improve your experience on return visits. | Yes — at your discretion. |
| Analytics | Collect aggregated, anonymised data about how Members navigate the Platform (pages visited, session duration, feature usage) to help ahtoto improve its service. | Yes — at your discretion. |
| Security & Fraud Detection | Device fingerprinting and behavioural signals used to detect automated bots, credential-stuffing attacks, and fraudulent login attempts in real time. | No — these protect your account. |
Most web browsers allow you to manage cookies through their settings panel. Disabling strictly necessary or security cookies may impair or prevent your ability to access the Platform. ahtoto does not use third-party advertising cookies or retargeting pixels for commercial advertising campaigns on external networks.
ahtoto employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security controls include:
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Members, ahtoto will notify those Members without undue delay and take immediate remedial action to contain the breach and prevent recurrence.
ahtoto retains personal data only for as long as is necessary to fulfil the purposes set out in this Policy, to satisfy our legal and regulatory obligations, and to resolve any disputes that may arise. The following general retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account & Registration Data | Duration of account activity plus 5 years following account closure, to satisfy gaming-licence record-keeping requirements. |
| KYC & Identity Documents | Duration of account activity plus 5 years following account closure, in compliance with anti-money-laundering obligations. |
| Financial Transaction Records | 7 years from the date of each transaction, in accordance with standard financial record-keeping requirements. |
| Wager & Game History | 5 years from the date of each wager, for dispute resolution and licence compliance purposes. |
| Support Communications | 3 years from the date of the most recent communication in a support thread, for quality assurance and dispute resolution. |
| Technical & Usage Logs | 13 months from the date of capture, sufficient for security analysis and performance monitoring. |
| Marketing Consent Records | Duration of consent plus 3 years, to demonstrate lawful processing in the event of a complaint. |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.
As a Member of ahtoto, you hold the following rights in respect of your personal data. To exercise any of these rights, please submit a request to [email protected] with the subject line "Data Rights Request". ahtoto will acknowledge your request within 48 hours (WIB) and respond substantively within 30 calendar days.
Request a copy of the personal data ahtoto holds about you, along with information about how it is processed.
Request correction of any inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
Request that we limit how we use your data while a dispute about its accuracy or lawfulness is being resolved.
Receive your personal data in a structured, machine-readable format and transfer it to another service provider where technically feasible.
Object to processing based on legitimate interests — in particular, direct marketing — and we will cease that processing unless we can demonstrate compelling grounds.
The ahtoto Platform is strictly for adults aged 21 and above. ahtoto does not knowingly collect, process, or retain personal data relating to individuals under the age of 21. All account registrations are subject to age verification, and accounts where the Member's age cannot be confirmed will be suspended pending KYC review.
If ahtoto becomes aware that personal data has been collected from an individual under the age of 21 — whether through a failed KYC check, a third-party report, or any other means — that data will be deleted immediately, the associated account will be permanently closed, and any funds deposited will be returned to the originating payment method after deduction of any applicable processing fees.
If you are a parent or guardian and believe that a person under 21 in your care has created an account on the Platform, please contact us immediately at [email protected] so that we can take prompt action.
The Platform may, from time to time, contain references to or integrations with third-party services — for example, game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) or payment networks. While ahtoto takes care to engage reputable third-party partners, we do not control those parties' privacy practices and cannot accept responsibility for their data-handling policies.
When you interact with a third-party service through the Platform, you do so subject to that service's own privacy policy. ahtoto encourages you to review the privacy policies of any third-party service you access via the Platform before submitting personal data to them.
ahtoto operates as an internationally licensed gaming platform, and as a result, your personal data may be processed in countries other than Indonesia. Where personal data is transferred outside Indonesia, ahtoto ensures that appropriate safeguards are in place to protect the data, including:
For more information about the international transfer safeguards ahtoto applies, please contact us at [email protected].
ahtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, updates to our international licensing obligations, or developments in applicable law. When material changes are made, ahtoto will publish the revised Policy on this page with an updated "Last Updated" date and will notify registered Members via email or an on-screen notification upon their next login to the Platform.
Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with a material change to this Policy, you may request voluntary account closure as described in our Terms & Conditions. ahtoto recommends that Members review this Policy at least once every 90 days to remain informed of any updates.
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about how ahtoto has handled your personal data, please contact us using the details below:
If you are not satisfied with ahtoto's response to your privacy complaint, you may escalate the matter to the data-protection authority or supervisory body responsible for overseeing the jurisdiction in which ahtoto holds its gaming licence. ahtoto will cooperate fully with any such authority investigation.
Our Privacy Policy reflects the concrete commitments we make to every Member regarding the responsible handling of their personal information.
Every byte of data exchanged between your device and the ahtoto Platform is protected by industry-standard 256-bit SSL/TLS encryption. Your personal and financial data is never transmitted in plaintext.
ahtoto does not sell, rent, or trade your personal data to any third party for commercial purposes — ever. Data shared with partners is shared only to the extent strictly necessary to deliver the services you have requested.
You hold the right to access, correct, delete, restrict, and port your personal data at any time. Submit a request to our support team and we will respond within 30 calendar days, verified and acted upon without charge.
Identity documents submitted for KYC verification are encrypted at rest using AES-256 encryption, access-controlled on a need-to-know basis, and retained only for the period required under our licensing obligations.
We retain your data only as long as legally necessary — and no longer. Defined retention periods for every data category are published transparently in this Policy, giving you full visibility into our data lifecycle practices.
Our Indonesian-speaking support team is available around the clock to answer privacy questions, process data rights requests, and handle formal complaints — with a 48-hour acknowledgement commitment on all privacy enquiries.
Our FAQ covers common questions about account security, data verification, and payment privacy. For anything beyond that, our support team is here 24/7.