Privacy Policy.

What we collect

• Listing data you submit: brand URL, category, description, full details, tags, logo, offers (including bonus codes and terms links), tag suggestions, and the email you give at checkout (for receipts and the manage link).
• Payment data: the amount, currency, network, transaction hash and processor reference. We never see or store card numbers; we do not offer card payments.
• Click data on tracked redirects: timestamp, listing, hashed IP, country, referrer, browser user agent. Used for public click counts and the brand's own statistics. Raw IPs are not stored; raw click rows are deleted after 90 days and only daily totals remain.
• Country: the visitor's country (and, in Canada, the province), derived from the request by our CDN, is used for two things: it is recorded with clicks on outbound links (never together with the IP) so a brand can see where its clicks come from, and it decides what your country's rules ask of the site — a cookie choice, an age question, a notice pointing to the local regulator's register, a mandatory warning line, hidden bonus offers or a directory-only view. It is not stored against you otherwise.
• Site analytics: aggregated page views and live visitor counts via a cookieless analytics provider. The public stats page shows the same aggregates we see.
• Cookies: a session cookie that protects forms against forgery; xc_ref for 90 days when you open a referral link — in the EU/EEA, the UK and Switzerland only after you accept it in the cookie toast (until then the code waits in your session for this visit only); xc_checkouts for 7 days after a checkout so the payment page knows it is yours; your answers to the country prompts — xc_consent (your cookie choice, 12 months), xc_age (the age question, 30 days), xc_notice (the regulator notice was read, 30 days), xc_ads (you switched gambling promotions off, 30 days); during the closed beta, the beta password. No advertising or cross-site tracking cookies.
• Email engagement: our transactional emails (receipts, outbid alerts, daily winner) contain an open pixel and tracked links so we can see whether they are read and clicked. Used only to improve those emails; you can opt out of non-essential ones from the manage link.

Why we process it

• To run the board, assign ranks and show public listings (contract performance).
• To send receipts, manage links and outbid notifications (contract performance; you can turn notifications off).
• To count clicks, prevent abuse and detect bots (legitimate interest).
• To meet accounting, tax and anti-money-laundering obligations (legal obligation).

Who we share it with

Our payment processor (crypto gateway), email provider, hosting and CDN (Cloudflare), and analytics provider — each under a data processing agreement. Public listing data and click counts are, by design, public. We do not sell personal data.

Retention

Listing and payment records are kept for as long as the listing exists plus the statutory accounting period (currently 6 years). Raw click events are kept 90 days, then only as daily aggregates.

Your rights

Depending on where you live you may access, correct, export or erase your personal data, object to processing, or complain to a supervisory authority. Write to privacy@xcasinos.com. Payment records required by law cannot be erased before the retention period ends.

Children

The Service is for adults aged 18+. We do not knowingly collect data from minors. If you believe a minor has used the Service, contact us and we will delete the data.

Changes

We will update the effective date when this policy changes and announce material changes on the board.