Privacy Policy

1.1. This Privacy Policy explains how Grail Technologies Ltd ("Grailbet", "we", "us"), registration number 2025-00264, Rodney Bayside Building, Rodney Bay, Saint Lucia, collects, uses, shares and protects your personal data when you use grailbet.com and our related services (the "Service").

1.2. Grail Technologies Ltd is the controller of your personal data. For any privacy question or request, contact [email protected].

Data you give us

• Account data: name, username, email address, date of birth, country of residence, address, phone number, password (stored in encrypted form).
• Verification data: government-issued ID, selfie and liveness images, proof of address, and source of funds or source of wealth documents.
• Financial data: deposit and withdrawal history, cryptocurrency wallet addresses, transaction hashes, and payment method details processed by our payment providers.
• Communications: messages with our support team, live chat transcripts, emails and complaint records.
• Responsible gaming data: limits, cool-off and self-exclusion settings you choose.

Data we collect automatically

• Technical data: IP address, device identifiers, browser type, operating system, language settings, time zone and approximate location.
• Usage data: pages visited, bets placed, games played, stakes, wins, losses, session times and bonus activity.
• Cookies and similar technologies, as described in our Cookie Policy.

Data from third parties

• Verification, sanctions, politically exposed person (PEP) and adverse media screening results from our KYC and AML providers.
• Blockchain analytics on wallets and transactions used with the Service.
• Referral data from affiliates and marketing partners that sent you to us.
• Fraud prevention data from other operators, payment providers and fraud databases.

We use your personal data to:

• create and manage your account and provide the Service
• verify your identity, age and location, and meet our licence, anti-money laundering and counter-terrorist financing obligations
• process deposits, withdrawals, bonuses and rewards
• detect and prevent fraud, bonus abuse, collusion, multi-accounting and other breaches of our Terms
• apply responsible gaming tools and identify signs of harmful play
• respond to support requests and complaints
• send service messages and, where you have not opted out, marketing about our products and offers
• analyse and improve the Service, including through aggregated statistics
• comply with legal obligations and requests from regulators, courts and law enforcement

Where a law requires a legal basis for processing, we rely on: performance of our contract with you (running your account); compliance with legal and regulatory obligations (verification, AML, record keeping); our legitimate interests (fraud prevention, security, improving the Service, direct marketing to existing customers); and your consent where required (certain cookies and marketing). You may withdraw consent at any time without affecting processing already carried out.

We use automated tools to screen accounts and transactions for fraud, money laundering, bonus abuse and signs of problem gambling. These tools may result in an account being flagged, limited or referred for review. Decisions to close an account or withhold funds are reviewed by a member of our team. You can ask for a human review of any automated decision that affects you.

We share personal data only where needed, with:

• identity verification, KYC and AML screening providers
• payment, cryptocurrency custody, on-ramp and blockchain analytics providers
• game studios and the sportsbook provider that power our products
• hosting, cloud, content delivery and security providers
• customer support, live chat and email delivery providers
• analytics and marketing providers, in line with your cookie choices
• affiliates, limited to the data needed to calculate commission, which is anonymised or pseudonymised where possible
• professional advisers, auditors and insurers
• our licensing authority, regulators, courts, law enforcement and financial intelligence units, where required by law
• a buyer or successor in the event of a merger, acquisition or sale of all or part of our business

We require our service providers to protect your data and to use it only for the services they provide to us. We do not sell your personal data.

Our providers are located in several countries, including outside your country of residence. When we transfer data internationally, we use contractual safeguards and choose providers with appropriate security standards.

We keep account, verification and transaction records for at least 5 years after your account is closed, or longer where required by law or an ongoing investigation. Self-exclusion records are kept for as long as needed to enforce the exclusion. Marketing data is deleted or anonymised when you opt out, except for a suppression record to make sure you are not contacted again.

We protect your data with encryption in transit and at rest, access controls, two-factor authentication for staff systems, and regular security reviews. No system is completely secure, so please protect your own login details and enable two-factor authentication on your account.

Depending on where you live, you may have the right to:

• access the personal data we hold about you
• correct inaccurate data
• delete your data, where we are not required to keep it
• restrict or object to certain processing, including direct marketing
• receive your data in a portable format
• withdraw consent
• lodge a complaint with a data protection authority

To exercise these rights, email [email protected] from your Registered Email Address. We may need to verify your identity. We respond within 30 days. We cannot delete data that we must keep under anti-money laundering or licensing rules.

You can opt out of marketing emails and messages at any time through your account settings or the unsubscribe link in any message. If you self-exclude, we stop all marketing to you.

The Service is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If we find that we hold data about a minor, we close the account and delete the data except where we must keep it by law.

The Service may link to third-party websites. We are not responsible for their privacy practices. Please read their privacy policies.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new date, and notify you of material changes by email or on the Service.

Grail Technologies Ltd, Rodney Bayside Building, Rodney Bay, Saint Lucia. Email: [email protected].