Privacy Policy AP777 – Your Data, Protected

The controller of the personal data collected through the ap777.cash platform is the AP777, responsible for defining the purposes and means of processing the information of players registered in Brazil.

For any questions related to privacy and data protection, you can reach our Data Protection Officer (DPO) directly at privacidade@ap777.cash or via the support chat available 24 hours a day on the platform. The AP777 is committed to responding to privacy-related requests within 15 business days.

The AP777 collects only the information necessary to operate the platform securely and in compliance with applicable legal obligations. The data collected falls into the following categories:

2.1 Data You Provide Directly

• Registration data: full name, CPF, date of birth, email address, and password;
• Identity verification data (KYC): photo ID (RG, CNH, or passport), proof of address, and, where applicable, proof of ownership of the payment method;
• Contact details: mobile number (when provided for two-factor authentication or support communications);
• Financial data: Pix key, credit/debit card details (tokenized — ap777 does not store full card data), bank account information for TED transfers.

2.2 Automatically Collected Data

• Platform usage data: betting history, games accessed, login times, markets viewed, and features used;
• Device and connection data: IP address, browser type, operating system, device model, device identifiers, and time zone;
• Approximate geolocation data: derived from IP address for eligibility verification and security purposes;
• Cookie and similar technology data: described in detail in Section 5 of this Policy.

The AP777 uses the collected data exclusively for the following purposes:

• Account creation and management: account registration, authentication, password recovery, and player profile management;
• Provision of betting and casino services: processing of bets, odds calculation, settlement of results, cash out, and access to online casino games;
• Payment processing: deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED; withdrawals and financial reconciliation;
• Identity verification (KYC): compliance with legal identity verification and anti-money laundering obligations under Brazilian law;
• Security and fraud prevention: detection of duplicate accounts, bot usage, suspicious activity, and other behavior that violates the Terms and Conditions;
• Customer support: logging and resolving requests, complaints, and inquiries submitted to ap777 support;
• Responsible gambling: monitoring of gameplay patterns to identify behaviors that may indicate problem gambling and enforcement of the self-control tools configured by the player;
• Operational communications: sending emails about confirmed bets, processed withdrawals, account updates, security alerts, and other communications essential to account operation;
• Promotional communications: sending offers, bonuses, and promotions — only to players who have not opted out of this type of communication (opt-out available in account settings);
• Platform improvement: aggregated usage analysis to identify usability issues, most-accessed features, and opportunities to improve the player experience.

The AP777 does not sell personal data. Sharing with third parties only takes place in the specific situations below, always with appropriate safeguards and, where possible, under data processing agreements:

4.1 Required Processing Partners

• Payment processors: financial institutions and intermediaries required to process transactions via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED. These partners receive only the minimum data necessary to complete each transaction;
• Identity verification (KYC) providers: companies specialized in document verification that assist ap777 in meeting legal customer identification requirements;
• IT infrastructure providers: cloud hosting and cybersecurity providers that operate ap777's servers and systems under strict confidentiality agreements;
• Casino game providers: slots, crash games, and Live Casino system developers operating within the ap777 platform, limited to the data strictly necessary for each game's operation.

4.2 Legal Requirements

The AP777 may share personal data with government authorities, regulatory bodies, and law enforcement when required by law, court order, or applicable regulation — including, but not limited to, requests related to anti-money laundering, terrorism financing, or criminal investigations conducted by Brazilian authorities.

The AP777 uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and meet security obligations. The cookies used fall into the following categories:

• Strictly necessary cookies: essential for the platform to function — authenticated session management, bet slip, and basic account preferences. They cannot be disabled without compromising your use of ap777;
• Security cookies: used for fraud detection, trusted device identification, and prevention of unauthorized access. They are part of the player's account protection system;
• Analytical cookies: collect aggregated and anonymized data on how players navigate the platform — including which pages they visit, session duration, and most-used features. This data helps ap777 identify and resolve usability issues;
• Preference cookies: store settings chosen by the user, such as language, favorite sport, and odds display format.

You can manage non-essential cookie preferences in your browser settings. Disabling analytics and preference cookies does not affect access to ap777's core features. Disabling security cookies may compromise your account protection — this is not recommended.

The AP777 implements appropriate technical and organizational measures to protect players' personal data against unauthorized access, disclosure, alteration, loss, or destruction. The main security measures include:

• 256-bit SSL Encryption across all communications between the user's device and ap777's servers;
• Encryption at rest for sensitive data stored in databases, including KYC documents and financial information;
• Role-based access control (RBAC): only staff members with a legitimate business need are granted access to personal data, and every access is recorded in auditable logs;
• Two-factor authentication (2FA) available to all players as an additional layer of account protection;
• Continuous monitoring of suspicious activity across AP777 systems, with automatic alerts for anomalous patterns;
• Regular security testing and periodic audits by specialized cybersecurity teams.

Despite every effort, no security system is completely foolproof. The AP777 also relies on players adopting good security practices: using strong, unique passwords, not sharing credentials, and keeping their device updated with the latest operating system security patches.

The AP777 retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. The main retention periods are:

• Registration and KYC data: retained for a minimum of 5 years after account closure, as required by Brazilian anti-money laundering legislation (Law No. 9.613/1998 and COAF regulations);
• Betting history and financial transactions: retained for a minimum of 5 years for accounting, tax, and dispute resolution purposes;
• Customer support data: retained for 2 years after the ticket is closed for quality control and future complaint resolution purposes;
• Security logs: retained for 1 year for incident investigation and fraud prevention purposes;
• Analytical cookies: anonymized data retained for up to 2 years for platform usage analysis.

Once the applicable retention periods have expired, data is securely deleted or anonymized so that the individual can no longer be identified. A deletion request from the data subject may accelerate this process for data not subject to mandatory legal retention periods.

The General Data Protection Law (LGPD) grants you, as a personal data subject, the following rights regarding processing carried out by the AP777:

• Access: confirm the existence of processing and obtain a copy of your personal data;
• Correction: request the update or correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability: receive your data in a structured, interoperable format for transfer to another controller, where technically feasible;
• Sharing information: be informed about the public and private entities with which AP777 has shared your data;
• Consent withdrawal: where processing is based on consent, you may withdraw it at any time — without affecting the lawfulness of processing carried out prior to withdrawal;
• Objection: object to processing carried out on grounds other than consent, where there has been non-compliance with the LGPD;
• Review of automated decisions: request human review of decisions made solely by automated means that affect your interests.

To exercise any of these rights, submit a request to our DPO at privacidade@ap777.cash or via live chat on the platform. The AP777 will respond within 15 business days, as required by the LGPD. In some cases, we may request additional identity verification before processing the request to ensure your account's security.

If you believe your rights as a data subject are not being respected, you may file a complaint with the National Data Protection Authority (ANPD), as set out in Art. 55-J of the LGPD.

The AP777 is a platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If you are under 18, you must not use the platform or provide any personal data.

If the AP777 becomes aware that it has collected data from a minor, the following measures will be taken immediately:

• Closure of the account registered by the minor;
• Deletion of all collected personal data;
• Return of any account balance to the original payment method;
• Disclosure to competent authorities when required by Brazilian law.

The AP777 may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or platform improvements. The date of the most recent update is always displayed at the top of this page.

Material changes to this Policy will be communicated to players with an active account via email or a prominent notice on the platform at least 7 days in advance before taking effect. For changes required by immediate legal obligation, implementation may occur without prior notice.

Continued use of the platform after any change takes effect constitutes acceptance of the updated Policy. If you disagree with the changes, you have the right to request account closure and data deletion before the new terms come into force.

The AP777 has appointed a Data Protection Officer (DPO) responsible for overseeing the platform's privacy practices and serving as the point of contact for data subjects and the National Data Protection Authority (ANPD).

To exercise your rights as a data subject, clarify questions about how your data is handled, or submit a privacy-related complaint, please use the channels below:

• DPO email: privacidade@ap777.cash — response within 15 business days;
• General support: suporte@ap777.cash or live chat on the platform — available 24 hours a day;
• Help center: section of Frequently Asked Questions with articles on privacy and data protection.