mpochas Platform Privacy Notice

This page describes what we collect when you use mpochas and how we keep that data protected. We at mpochas take your privacy seriously and handle personal information only for purposes essential to account security, payment processing, and fraud prevention. Our data practices comply with applicable financial regulations across supported jurisdictions where our services operate.

When you register on mpochas, you provide personal data—your name, email, government-issued ID, proof of address, and payment information. We use this data to verify your identity, process deposits via DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, or e-wallet, and manage withdrawals back to your original payment method. We also collect behavioral data—which games you play, your betting patterns, your account activity—to detect fraud, enforce our terms, and improve our service.

This notice explains how we collect, use, store, and share your data. We encourage you to read it fully and contact our support team if you have questions about how we handle your information.

What Data We Collect on mpochas

We at mpochas collect several categories of data when you use our platform. Account registration requires your email address, full name, date of birth, and password. Know Your Customer (KYC) verification requires a government-issued ID photo (Indonesian KTP or passport) and proof of address (utility bill, bank statement, or rental agreement). Payment processing requires payment details—for e-wallets, we collect the account identifier; for virtual accounts, we collect your bank account number. We do not store your e-wallet PIN, banking password, or credit-card number—payment gateways handle these credentials outside our systems.

We also collect behavioral data automatically. Our servers log your IP address, device type (Android, iOS, desktop), browser or app session details, and account activity (login times, game selections, bet amounts, withdrawal requests). We use cookies and similar tracking technologies to recognize you on return visits and to analyze site usage patterns. You can disable cookies in your browser settings, though this may limit some functionality on mpochas.

Essential Data: Name, email, ID, address—required for account security and regulatory compliance on mpochas.
Payment Data: E-wallet identifiers and virtual account numbers—handled by secure payment processors outside mpochas systems.
Behavioral Data: IP address, device info, login times, game selections, bet amounts—used for fraud detection and service improvement.
Cookie Data: Session identifiers and tracking codes—stored on your device to recognize you on return visits to mpochas.

How We Use Your Data on Our mpochas Platform

We at mpochas use your data for four primary purposes. First, account security and fraud prevention: we verify your identity against government records and monitor unusual account activity (sudden large withdrawals, login attempts from new locations, rapid bet escalations) to prevent unauthorized access and financial crime. Second, payment processing: we share payment information with our payment processors to execute deposits and withdrawals via DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, or e-wallet. Third, service delivery: we use your behavioral data to personalize your experience on mpochas, recommend relevant games, and troubleshoot technical issues. Fourth, legal compliance: we retain your data to meet financial reporting requirements in Indonesia and other supported jurisdictions including Jakarta, Surabaya, Bandung, Medan, Semarang, and Yogyakarta.

We do not use your data for marketing without your consent. We do not sell your personal data to third parties. We may share aggregated, anonymized data (e.g., "non-specific info of mpochas users prefer live-dealer tables") with analytics partners to improve our platform, but this data cannot identify you individually.

Note: We never share your mpochas login credentials, password, or full payment details with third parties. Payment gateways and our compliance partners access only the minimum data needed to process transactions and verify identity.

Third-Party Data Processors and Our mpochas Infrastructure

We at mpochas work with third-party processors to deliver our platform securely. Our payment processors (e-wallet providers and bank APIs) handle transaction data independent of mpochas systems. Our compliance and anti-fraud vendors receive account data to verify identity and detect suspicious patterns. Our analytics providers receive behavioral data (anonymized where possible) to help us understand how mpochas is used and where we can improve. Our customer support platform logs account inquiries and support chat history so our team can assist you effectively.

All third-party processors sign data-protection agreements requiring them to handle your information confidentially and not to use it for their own purposes. Our data centers may be located outside Indonesia; this means your mpochas data transits and rests on servers in other countries. We encrypt all data in transit (HTTPS) and at rest to protect against interception. Our server infrastructure complies with international security standards.

Your Rights and Data Access on mpochas

We at mpochas acknowledge your rights to your personal data. You have the right to access—you can request a copy of all data we hold about your mpochas account, including your registration information, KYC documents, account history, and transactions. You have the right to correction—if any data in your mpochas account is inaccurate, you can request we update it. You have the right to deletion—under certain circumstances, you can request we delete your data, though we may retain transaction records for legal and financial reporting purposes. To exercise these rights, contact our support team with your request. We will respond within 30 days.

You also have the right to data portability—we can provide your data in a portable format (such as CSV) to enable transfer to another service. You have the right to object to certain processing—for example, if we use your data for behavioral analysis, you can object (though this may limit our ability to detect fraud or personalize your mpochas experience). If you believe we have mishandled your data, you may lodge a complaint with your local data-protection authority.

Data Retention and Deletion on Our mpochas Service

We at mpochas retain your personal data for as long as your account is active and for a reasonable period afterward to meet legal obligations. KYC documents and identity verification records are retained for five years minimum (required by financial regulations). Transaction records (deposits, withdrawals, bets, payouts) are retained for seven years to comply with anti-money-laundering standards. Behavioral logs and analytics data are retained for two years unless you request deletion. If you close your mpochas account, we anonymize your profile within 30 days but retain transaction records as legally required.

Special holidays like Idul Fitri, Idul Adha, and Imlek may delay response times to data requests. We will inform you of any delays immediately. For urgent data matters, contact our compliance team directly via the support channel on your mpochas account.

Cookies and Tracking Technology on mpochas

We at mpochas use cookies—small files stored on your device—to recognize you on return visits and to maintain your login session. Our mpochas platform uses both session cookies (which expire when you close your browser) and persistent cookies (which remain for days or weeks). You can delete cookies through your browser settings or disable them entirely; however, disabling cookies may prevent mpochas from functioning properly.

We also use analytics tools (such as Google Analytics) to track aggregate site usage—which pages are visited most, how long users spend on each page, which devices and browsers are used. This data helps us optimize mpochas for mobile and desktop users. You can opt out of analytics tracking by adjusting your browser or device settings.

Data Security and Encryption on mpochas

We at mpochas employ industry-standard security measures to protect your data. All communication between your device and our mpochas servers uses HTTPS encryption—your password, payment details, and behavioral data are encrypted in transit and cannot be intercepted by third parties. Our servers use encryption at rest, meaning data stored on disk is unreadable without the encryption key. We enforce strict access controls—only mpochas staff with a legitimate business need can access your personal data, and all access is logged and audited.

We conduct regular security audits and penetration testing to identify vulnerabilities. If we detect a data breach—unauthorized access to mpochas systems—we will notify you immediately and provide information on steps to protect yourself. We maintain cyber-liability insurance to cover potential harm from data incidents.

Policy Changes and Contacting Us on mpochas

We at mpochas may update this privacy notice to reflect changes in our practices or legal requirements. We will notify you of material changes via email or account notification at least 30 days before they take effect. By continuing to use mpochas after a change, you accept the updated privacy notice. If you have questions about how we handle your data, wish to exercise your data rights, or suspect a privacy violation on our mpochas platform, contact our support team. We will respond within 14 business days. Your privacy and data security are foundational to our commitment to serving your account responsibly on mpochas.

From registration to first session

Your privacy journey on mpochas begins at registration, where you provide an email address and create a password. We encrypt your password immediately and never store it in plaintext. We send you a verification email; you click the link to confirm your address. Next, you complete Know Your Customer (KYC) verification by uploading a government-issued ID photo and proof of address (utility bill or bank statement). Our compliance team reviews these documents and confirms they match your registration details; this typically takes a few hours to one business day. During this verification, we collect and securely store your full name, date of birth, ID number, and residential address. Once verified, your mpochas account transitions to active status and you can proceed to deposit. When you fund your account via DANA, OVO, GoPay, ShopeePay, LinkAja, QRIS, or virtual account (BCA, Mandiri, BRI, BNI), we collect payment identifiers but do not store your e-wallet PIN or banking password—payment processors handle those credentials outside mpochas systems. Our servers log your IP address, device type, and browser information during these transactions for fraud detection. Once your balance is funded, you navigate to the game lobby and select your first category. We record which games you choose and how long you play—this behavioral data helps us detect suspicious patterns (e.g., rapid large bets followed by immediate withdrawal requests) and improve mpochas experience. Your first session generates personal data across multiple categories: identity verification, payment processing, account activity, and behavioral tracking. All of this data is encrypted and stored on secure mpochas servers, with access limited to authorized staff members.

Payment options and processing windows

We at mpochas accept ten payment methods, each involving different data flows and privacy considerations. E-wallets (DANA, OVO, GoPay, ShopeePay, LinkAja) and QRIS are processed through third-party payment gateways that handle your payment credentials outside mpochas systems. When you authorize a DANA deposit, for example, you confirm the transaction on the DANA app; DANA's servers transfer funds to mpochas and send us a confirmation code. We never see your DANA PIN or full card details—only an identifier confirming the transfer succeeded. Our mpochas system records the deposit amount, timestamp, and payment method for your account history and financial reporting. Virtual accounts (BCA, Mandiri, BRI, BNI) require you to transfer funds from your personal bank to the virtual account number we provide. Your bank logs the transfer; our mpochas system detects the incoming transfer and credits your account. We retain the transaction record for regulatory compliance (typically seven years for anti-money-laundering purposes). When you withdraw, we route funds back to your original payment method; if you funded via OVO, your withdrawal goes to OVO. We collect minimal data during withdrawals—just your mpochas account ID, withdrawal amount, and target payment method. All withdrawal requests pass through fraud verification; our system reviews your account history, checks for unusual patterns (sudden large withdrawals from new locations), and confirms your identity before processing. Special holidays like Idul Fitri, Idul Adha, or Imlek may delay payment processing because banks and e-wallet providers operate on reduced schedules. We do not process data any faster during these periods because external payment infrastructure controls timing, not mpochas. We retain all transaction data securely encrypted on our servers and do not share detailed payment histories with third parties except where required by law.

Choosing a game category

When you select a game category on mpochas, we collect behavioral data that shapes how we understand your preferences and detect fraud. Live-dealer tables (blackjack, roulette, baccarat, Dragon Tiger) record which table you join, your stake amounts, play duration, and outcomes. We use this data to ensure game fairness (confirming no unexpected patterns), to comply with financial reporting (tracking total wagers), and to detect potential problem activity (e.g., repeated large bets in short windows). Our mpochas system logs table selections with timestamps; if you jump between tables rapidly or escalate stakes dramatically, our fraud system flags this for review. Slot games (Mahjong Ways, Aviator, Sweet Bonanza, Gates of Olympus, Fortune Tiger) generate similar data: which slot you select, your bet amount per spin, total spins, total wagered, and total won. This data helps us understand game popularity and identify users at potential risk (e.g., very high wager-to-balance ratios). Sports betting on Liga 1, Piala Indonesia, Champions League, and Premier League records your bet selections, odds chosen, stake amounts, and outcomes. Esports markets (Mobile Legends, Free Fire, PUBG Mobile) function identically. We use sports and esports betting data to verify fair odds, detect match-fixing attempts, and comply with sports-betting regulations in jurisdictions where we operate. All game-category data is stored in your mpochas account history; you can review your activity anytime. We analyze aggregate data (anonymized, without your name attached) to improve mpochas game offerings and detect system anomalies. We never share your individual game history with third parties except where required by law enforcement or financial regulators.

Service availability and jurisdiction

We at mpochas operate under strict privacy principles tied to jurisdiction. Your data collection, retention, and sharing practices depend partly on which supported region you access mpochas from. If you register from Jakarta, Surabaya, Bandung, Medan, Semarang, or Yogyakarta, your data is subject to Indonesian financial and privacy regulations. If you travel to or relocate in a region where online gaming is prohibited, your mpochas account and data handling may change—we may suspend access or flag your account for additional verification. Before opening an mpochas account, verify that accessing our platform is legal in your jurisdiction. If you are unsure, consult your local authorities or legal counsel; we cannot provide legal advice, only confirm that our privacy practices comply with applicable law where we operate. Our data centers may be located outside Indonesia; this means your mpochas data transits international networks and rests on foreign servers. We encrypt all data to protect it during transit and storage. If you object to your data being stored on non-Indonesian servers, you may request account closure; we will delete your data within 30 days (except transaction records retained for legal compliance). When you close an mpochas account, we anonymize your profile immediately but retain encrypted transaction records for seven years to comply with anti-money-laundering standards. Your privacy rights on mpochas include the right to access, correct, delete, or port your data; to opt out of analytics; and to object to certain data uses. We respect these rights and will respond to data requests within 30 business days. If you believe we have violated your privacy on mpochas, you may lodge a complaint with your local data-protection authority or contact our compliance team directly.