99ab Privacy Policy – How We Protect Your Data in Pakistan

99ab is an online gaming platform operating at https://99ab.io and through associated mobile applications. The platform offers a range of real-money games and services to players in Pakistan, including Ludo tournaments, Aviator, live casino tables, card games and cricket score tracking with in-play betting.

For the purposes of this Privacy Policy, 99ab acts as the data controller — meaning we are the entity that determines what personal data is collected, why it is collected and how it is used. This policy applies to all data collected through the 99ab website, mobile app, customer support channels and any other touchpoint you use to interact with the platform.

If you have questions about this Privacy Policy or wish to exercise any of your data rights, you can contact us at support@99ab.io. We aim to respond to all privacy-related enquiries within 5 business days.

99ab collects personal data in three main ways: information you provide directly, information generated by your use of the platform, and information from third-party services that help us operate (such as payment processors and identity verification services).

We do not collect sensitive personal data such as biometric information, health data, religious beliefs or political views. We do not record voice calls unless you are explicitly told the call is being recorded for quality and training purposes.

Every piece of data that 99ab collects serves a specific purpose. We do not collect data out of habit or to build profiles we do not need. The main reasons we process your data are:

• Account operation: To create your account, maintain your balance, record your game history and provide you with a personalised platform experience.
• Payment processing: To handle deposits and withdrawals in PKR via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card transactions. Payment data is passed to our payment processors under strict data-sharing agreements.
• Identity verification (KYC): To confirm that you are who you say you are, that you are at least 18 years old, and that your payment methods belong to you. This is both a legal requirement and a fraud prevention measure.
• Fraud and security: To detect suspicious activity, prevent account takeovers, identify bonus abuse and comply with anti-money laundering (AML) obligations.
• Customer support: To respond to your queries, resolve disputes and maintain records of previous interactions so that support agents have context when you contact us again.
• Responsible gaming: To monitor gaming behaviour for signs of problem gambling, enforce self-exclusion requests and deliver responsible gaming tools based on your account activity.
• Platform improvement: To understand how players use the platform, which features are popular, where technical issues occur and how the mobile experience can be improved for Pakistani devices and networks.
• Legal compliance: To comply with applicable laws and to respond to lawful requests from regulatory or law enforcement authorities.

Every data processing activity at 99ab rests on one of the following legal bases. We process your data only where we have a valid reason to do so:

• Contract performance: Processing your identity, contact and financial data is necessary to fulfil the agreement you entered into when you registered on 99ab. Without this data, we cannot operate your account or process your transactions.
• Legal obligation: KYC verification, AML monitoring and transaction record-keeping are required by applicable law. We must perform these activities regardless of your preferences.
• Legitimate interests: Platform security monitoring, fraud detection, responsible gaming monitoring and platform analytics are carried out under our legitimate interest in maintaining a safe, fair and functional platform for all players.
• Consent: Where we send you promotional communications beyond your active bonus activity (such as newsletters or promotional SMS), we do so only with your explicit consent. You may withdraw this consent at any time by updating your communication preferences in your account settings or by contacting support.

99ab does not sell your personal data to any third party. We do not share your data with advertisers, data brokers or marketing platforms. The only parties who receive your data are those who need it to help us operate the platform for you:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay and card payment gateways receive the minimum data required to process your transactions. All are bound by their own regulatory obligations and data-handling standards.
• Identity verification providers: KYC checks may be processed by a third-party identity verification service. Your CNIC or passport data is transmitted under encryption and is not retained by the verification provider beyond their contractual obligations.
• Fraud prevention services: Technical data including IP addresses and device fingerprints may be shared with fraud detection tools to identify account takeover attempts and coordinated abuse.
• Customer support platforms: Live chat and email support is facilitated through third-party software. Support transcripts are stored on these platforms under data-processing agreements with 99ab.
• Regulatory and law enforcement authorities: Where we are legally required to disclose data — for example, in response to a court order or a lawful AML investigation — we will comply. We will notify you of such disclosure where we are legally permitted to do so.
• Business transfers: In the event of a merger, acquisition or asset sale involving 99ab, player data may be transferred to the acquiring entity. You will be notified of any such transfer and given the opportunity to close your account if you do not wish to proceed under the new ownership.

All third parties who receive data from 99ab are required to handle it in accordance with this Privacy Policy and applicable data protection principles. We do not permit third-party data processors to use your data for their own commercial purposes.

We keep your data for as long as it is needed for the purpose it was collected — and no longer. The following retention periods apply to the main categories of data held by 99ab:

• Active account data: Retained for the lifetime of your account plus 5 years after closure. This covers your identity documents, contact details and account history.
• Financial transaction records: Retained for 7 years from the date of each transaction, in compliance with standard financial record-keeping requirements.
• KYC documents: Retained for 5 years after account closure or the last transaction, whichever is later.
• Customer support communications: Retained for 3 years from the date of the last interaction, or longer if the interaction is connected to an active dispute or investigation.
• Technical logs (IP addresses, session data): Retained for 12 months from the date of generation, used primarily for security and fraud investigation purposes.
• Marketing consent records: Retained for the duration of the account plus 2 years, to demonstrate consent compliance if questioned.

When data is no longer needed and no legal retention obligation applies, it is securely deleted from 99ab systems. Deletion means permanent removal — not archiving or anonymisation, unless anonymisation is specifically noted.

Protecting your personal data is something 99ab takes seriously — not because a policy says we must, but because a data breach on a gaming platform affects real people's real money. The security infrastructure at 99ab is built and maintained by a team with a fintech background, applying the same standards used in mobile banking products.

The technical and organisational measures we use include:

• TLS encryption: All data transmitted between your device and 99ab servers is encrypted using Transport Layer Security (TLS). This means your login credentials, payment details and account data cannot be intercepted in transit.
• Password hashing: Passwords are stored as cryptographic hashes using bcrypt. Plain-text passwords are never stored anywhere on 99ab systems.
• Two-factor authentication (2FA): 2FA via SMS OTP is available for all accounts and is strongly recommended. It prevents unauthorised access even if your password is compromised.
• Access controls: Internal access to player data is restricted on a need-to-know basis. Support agents can see what they need to help you. They cannot see your password, full payment card numbers or certain KYC document fields.
• Intrusion detection: Automated systems monitor for unusual login patterns, brute-force attempts and suspicious transaction sequences around the clock.
• Regular security audits: The 99ab platform is subject to periodic security reviews and penetration testing. Critical vulnerabilities are patched within 24 hours of discovery.
• Segregated data storage: Player funds and player data are stored in systems that are logically separated from 99ab's operational systems. A breach of one does not automatically expose the other.

99ab uses cookies and similar technologies on its website and mobile app. These are small files stored on your device that help the platform function correctly and allow us to understand how you use it.

The types of cookies used on 99ab and their purposes are as follows:

• Essential cookies: Required for the platform to function. These handle your login session, maintain your account state, and enable payment flows. Without them, the site cannot work. They cannot be disabled.
• Functional cookies: Remember your preferences — such as your preferred game view, language settings and notification preferences — so you do not need to reset them each session. Can be disabled, but doing so will affect your experience.
• Analytics cookies: Help us understand how players navigate the platform — which pages are visited most, where users drop off and which features are used. This data is aggregated and anonymised before analysis. Can be disabled via cookie preferences.
• Security cookies: Detect suspicious activity such as account hijacking attempts and bot access. These are essential and cannot be disabled.

99ab does not use third-party advertising cookies. No advertising network has access to cookies set by the 99ab platform. You will not see retargeted ads from 99ab on other websites as a result of visiting the platform.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to see what cookies are stored, block third-party cookies and clear all cookies on exit. Note that blocking essential cookies will prevent the platform from functioning correctly.

As a user of 99ab, you have rights over the personal data we hold about you. These rights are described below. To exercise any of them, contact us at support@99ab.io with your registered mobile number and a clear description of your request.

The 99ab platform is strictly for users aged 18 and above. We do not knowingly collect personal data from any person under the age of 18. The registration process includes age verification steps, and KYC verification confirms date of birth before large withdrawals are processed.

If you are a parent or guardian and you believe a minor has created an account on 99ab, please contact us immediately at support@99ab.io. We will investigate, close the account and delete all associated personal data as quickly as possible once the underage use is confirmed.

99ab uses automated age estimation checks as an additional safeguard during registration. Accounts that appear inconsistent with the declared age are flagged for manual review before being fully activated. This is an extra layer of protection, not a replacement for parental supervision.

99ab may update this Privacy Policy from time to time. When changes are made, the revised policy will be published at https://99ab.io/privacy-policy with an updated "Last updated" date at the top. For significant changes that materially affect how your data is used, we will notify you directly via your registered mobile number or email address.

Minor changes — such as clarifications, formatting updates or corrections that do not alter the substance of our data practices — may be made without direct notification. We therefore recommend bookmarking this page and reviewing it periodically, particularly around major platform updates.

Your continued use of the 99ab platform after a policy update constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you may close your account by contacting support at support@99ab.io. Any data retained after account closure will be handled in accordance with the retention periods described in Section 6.