Help centre

Privacy policy

Last updated October 17, 2026

Last updated: 17 October 2026

  1. Who we are

Spinatoshi (www.spinatoshi.com) is operated by Spin Reels S.R.L, registration number 455754, with its registered address at San José, Costa Rica. Spin Reels S.R.L is licensed and regulated under licence CRG / 117 / 15.10.2026 – 15.10.2027, issued in Costa Rica.

Spin Reels S.R.L is the data controller of the personal data described in this policy (“Company”, “we”, “us”).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and what rights you have. It applies to the website www.spinatoshi.com, its mobile version and app, and any related services.

For any question about privacy, contact us at support@spinatoshi.com.

The English version of this policy is the original and prevails over any translation.

  1. The personal data we collect

2.1 When you visit our website

Our systems automatically record technical information generated by your browser or device, such as:

IP address and approximate location (country/region); date and time of your visit; device type, operating system and browser; pages visited, referring and exit pages, and clicks; language and time zone settings. 2.2 When you register

To open an account, we collect:

your email address (confirmed with a code); username and password (stored only in an irreversibly encrypted form); country of residence; date of birth, to confirm you are 18 or older.

You may also choose to add your first and last name and other profile details.

2.3 When you use your account Gaming activity: games played, bets, wins, round IDs, bonuses, free spins and loyalty points. Transactions: deposits, withdrawals, refunds and balances, with the payment method used, amounts, currencies and exchange rates (see section 2.6). Security data: login history, devices and sessions, IP addresses, and two-factor authentication settings. Responsible gaming settings: limits, reality checks, breaks and self-exclusion. Communications: emails, messages and support requests you send us, and our replies. Preferences: language, theme, notification and marketing preferences, and cookie choices. 2.4 When verification is required (KYC)

Players who deposit and withdraw only in cryptocurrency normally do not need to verify their identity. Players who use other payment methods, or in the cases described in our KYC Policy, may be asked to verify. When verification is required, we may collect:

full name, date of birth and residential address; copies of an identity document (passport, ID card or driving licence) and a selfie holding it; proof of address (utility bill, bank statement); proof of ownership of a payment method or crypto wallet; information about the source of funds or wealth, in enhanced checks. 2.5 From third parties

We may receive information from:

payment providers, such as transaction status, the payment method or sending wallet used, and fraud-prevention signals; game providers and aggregators, such as game round results; sanctions, PEP and fraud-prevention databases, used to screen players; affiliates, who tell us that you joined through their link (only the referral code, not your personal data from them). 2.6 Payment data

Players can choose to use cryptocurrency only, or other payment methods offered on the website (such as cards, e-wallets or bank transfers).

Cryptocurrency: we process the cryptocurrency and network used, wallet addresses, blockchain transaction IDs (hashes), amounts and exchange rates.

Cards, e-wallets and bank transfers: payments are processed by our licensed third-party payment providers. Depending on the method, we or our providers may process:

the name of the cardholder or account holder; the card brand, the last four digits of the card and its expiry date; the e-wallet account identifier (for example the email or account ID of your Skrill, Neteller, Apple Pay or Google Pay account); for bank withdrawals: the account holder’s name, bank name, IBAN and SWIFT/BIC code.

We do not store full card numbers, CVC/CVV codes or card passwords/PINs. Card details are entered directly in the secure payment page of our payment provider, which is compliant with the Payment Card Industry Data Security Standard (PCI DSS). All payment data is transmitted over encrypted connections (TLS 1.2 or higher).

We never ask for, and never store, the private keys or seed phrases of your crypto wallets. Never share them with anyone, including us.

  1. Why we use your data, and on what legal basis

Purpose Legal basis Creating and managing your account, letting you play, processing deposits, withdrawals, refunds and bonuses Performance of our contract with you (Terms and Conditions) Confirming you are 18+, verifying identity when required, preventing money laundering, terrorist financing and fraud, sanctions screening, record keeping, responding to authorities Compliance with legal and licensing obligations Securing your account, detecting multiple accounts, collusion, bonus abuse, payment fraud and cheating Our legitimate interest in protecting our players and our platform, and legal obligations Responsible gaming tools and protection of vulnerable players Legal obligations and our legitimate interest Customer support and handling complaints Contract and legitimate interest Improving our website, fixing errors, statistics Legitimate interest (using aggregated or pseudonymised data where possible) Personalising your experience (e.g. recently played, recommendations, VIP level) Contract and legitimate interest Marketing emails, push notifications, personalised offers Your consent, which you can withdraw at any time Non-essential cookies (analytics, marketing, affiliate tracking) Your consent via the cookie banner

  1. Profiling and automated decisions

We use your activity to:

calculate your VIP level and loyalty rewards; show you games and offers that may interest you (only with your marketing consent); detect fraud, bonus abuse and suspicious transactions with automated alerts.

Automated fraud and AML alerts are always reviewed by a member of our compliance team before any decision that significantly affects you, such as closing an account or withholding funds.

  1. Who we share your data with

We share personal data only when necessary and only with:

Service providers acting on our behalf, under contract and our instructions: website hosting and cloud infrastructure, content delivery and security, email delivery, customer support tools, data storage. Game providers and aggregators, who receive a pseudonymous player ID, currency, language and game activity needed to run the games. They do not receive your name or email. Payment providers, to process deposits, withdrawals and refunds by cryptocurrency, card, e-wallet or bank transfer, and to prevent payment fraud and chargebacks. Verification, sanctions and fraud-prevention services, when checks are needed. Affiliates, who only see anonymised statistics (masked player IDs) and never your personal data. Our licensing authority, law enforcement, courts, financial intelligence units and other competent authorities, when required by law or our licence. Professional advisers (lawyers, auditors), under confidentiality. A buyer or successor, if all or part of our business is sold or merged, under this policy.

We never sell your personal data.

  1. International transfers

Some of our service providers are located, or store data, outside your country, including in the European Union, the United Kingdom and the United States. When your data is transferred abroad, we use appropriate safeguards, such as contractual clauses and providers with recognised security standards, to protect it.

  1. How we protect your data

All connections to our website are encrypted (HTTPS/TLS). Passwords are stored only as irreversible hashes. Card details are handled by PCI DSS-compliant payment providers and are never stored in full by us. Identity documents are stored encrypted, are accessible only to authorised compliance staff, and every access is logged. Staff access is limited by role, protected by two-factor authentication, and recorded in an audit log. Uploaded files are scanned for malware. You can protect your account further with two-factor authentication and by reviewing your active devices in Account → Security.

No system is completely secure. If we become aware of a data breach that affects you, we will inform you and the competent authorities as required by law.

  1. How long we keep your data

Data Retention Account, transaction, payment, gaming and KYC records At least five (5) years after your account is closed, as required by anti-money laundering and licensing rules Complaints and communications Up to five (5) years after the matter is closed Self-exclusion records As long as needed to enforce the self-exclusion Website log files Up to 12 months, unless needed for a security investigation Marketing preferences Until you withdraw consent, plus the time needed to prove consent was respected Cookies See our Cookie Policy

After these periods, data is securely deleted or anonymised. Data needed for an ongoing investigation or legal claim may be kept until it is resolved.

  1. Your rights

Subject to applicable law, you have the right to:

access the personal data we hold about you and get a copy; correct inaccurate or incomplete data; delete your data, except where we must keep it by law (for example AML records); restrict or object to certain processing, including profiling for marketing; data portability, receiving your data in a common machine-readable format; withdraw your consent at any time, for marketing or cookies, without affecting earlier processing; complain to a data protection authority.

How to exercise your rights:

Download a copy of your data or request erasure directly in Account → Your data. Change marketing and notification preferences in Account → Notifications. Change cookie choices at any time via Cookie settings in the footer. Or email support@spinatoshi.com from your registered email address.

We will reply within 30 days. We may ask you to confirm your identity first.

Please note that some details, such as your date of birth, country and username, cannot be changed in your account after registration. Contact support if they are wrong. You must keep your details accurate and update them if they change.

  1. Cookies

We use cookies and similar technologies to run the website, remember your settings, keep your account secure and, with your consent, for analytics, marketing and affiliate tracking. You can accept or refuse non-essential cookies in the cookie banner and change your choice at any time. Read more in our Cookie Policy.

  1. Minors

Our services are only for adults aged 18 or over. We do not knowingly collect data from minors. If we learn that a minor has registered, the account will be closed and the data handled as required by law.

  1. Links to other websites

Our website may contain links to other websites, including game providers, payment providers and help organisations. We are not responsible for their privacy practices. Please read their own privacy policies.

  1. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows the latest version. If the changes are significant, we will notify you by email or on the website.

  1. Contact

📧 support@spinatoshi.com

Spin Reels S.R.L · Registration number 455754 · San José, Costa Rica Licensed under CRG / 117 / 15.10.2026 – 15.10.2027, issued in Costa Rica

18+ · Play responsibly · Gambling can be addictive