Terms of Service
Our Terms define what you can and cannot do in your account. The Privacy Policy sits alongside it—they work together to protect both you and totomantap.
LEGAL REFERENCE
Your privacy and account security come first
At totomantap, we treat your personal data and payment information with the utmost care. This Privacy Policy explains exactly how we collect, use and protect everything you share...
Data ProtectionAccount TransparencyPayment SecurityIndonesia ComplianceYour Control
Privacy policy scope and jurisdiction
totomantap operates in supported regions of Indonesia where local law permits. This policy governs how we collect, store and use your account details, transaction history, gameplay records and communication preferences. We comply with Indonesian data protection standards and local payment regulations. Your information is encrypted and held on secure servers. We do not sell your personal data to third parties. If you
have questions about how your data is handled or wish to request access, correction or deletion, our support team is available 24/7 to guide you through the process.
Service availability is jurisdiction-dependent. Users are responsible for checking local law before access.
EDITORIAL CLARITY
How we earn your trust on privacy
Transparent Practices
We publish this policy so you know exactly what happens to your data. No hidden clauses, no surprise third-party sharing. What we write is what we do.
Encrypted Transactions
Every DANA, OVO, GoPay and QRIS deposit flows through secure encryption. Your payment details never appear in plain text on our servers or backups.
Local Compliance
We follow Indonesian data protection frameworks and payment gateway regulations. Our infrastructure meets the standards local law requires for account safety.
No Data Broker Sales
Your profile, balance history and gameplay records stay with totomantap. We do not sell, rent or licence your information to advertisers or data brokers.
Regular Security Audits
Our systems undergo routine security testing to identify and close vulnerabilities. We keep our infrastructure current and resilient against emerging threats.
GDPR-Aligned Data Rights
Even as an Indonesia-first brand, we respect global data standards. You can request access, correction and deletion of your personal information anytime.
PLATFORM COMPARISON
Consistency across our policy family
Responsible Gameplay
We offer tools to help you stay in control. Your account settings let you set session limits, pause withdrawals and manage your own gambling boundaries.
Cookie & Tracking Policy
We use cookies to remember your lobby preferences and login state. This policy explains exactly which cookies we set and why—you can opt out at any time.
Payment Terms
DANA, OVO, GoPay and QRIS transfers follow their own terms too. Our Privacy Policy covers how we store your payment details; their policies govern the transfer itself.
Dispute Resolution
If you believe your data has been mishandled, our support team will investigate. This policy explains your right to escalate complaints to local regulators if needed.
Third-Party Partners
We work with payment gateways, hosting providers and live dealer studios. Each partner signs data protection agreements. We don't share your info with them beyond what's necessary.
Policy Updates
We may update this policy as technology or local law changes. We'll announce major changes in your account inbox and give you 30 days to review before they take effect.
PLATFORM SNAPSHOT
What defines our privacy promise
01
Account Data Encryption
Your username, email and account balance are encrypted at rest and in transit. No employee can see your password or plaintext payment details.
02
Two-Factor Authentication
You can enable 2FA in your account settings. If someone tries to log in from a new device, we ask for a second verification step you control.
03
Minimal Data Collection
We ask for only what we need: name, phone, email and payment method. We don't track your location, social media profiles or offline spending habits.
04
Automatic Session Timeout
Your lobby session expires after 30 minutes of inactivity. This protects you if you leave your device unattended at a café or on public transport.
05
Data Retention Limits
We keep your data only as long as your account is active. After closure, we delete personal records within 90 days unless law requires otherwise.
06
Breach Notification Protocol
If a security incident affects your account, we notify you within 48 hours with clear steps to take. We also report to regulators where required by law.
Frequently asked privacy questions
When you request account closure, we flag your records for deletion. Personal data, transaction history and gameplay logs are fully removed within 90 days. Backup copies follow the same timeline unless we're legally required to retain them.
No. We never store full payment credentials. Only a secure token representing your approved payment method stays on file. The e-wallet providers and QRIS networks hold the actual card or bank account data themselves.
Yes. Open a support ticket and request a Data Subject Access Request. We'll compile your account settings, login history, deposit and withdrawal records, and gameplay session summaries in a readable format within 14 days.
Only what's necessary. Game providers receive a session ID and your account level—not your name, email or payment details. Live dealers see only your username and table chat. All partners sign strict data agreements with us.
Log into your account, head to Settings > Profile, and update your phone number directly. If you've lost access to your old number, contact support with ID verification. We'll help you regain access securely.
Contact our support team immediately. We'll review your login history, freeze suspicious transactions, and help you secure your account. Change your password from a different device and enable 2FA to prevent future breaches.
Never. We do not sell, rent or licence your personal information. We use your email only to send account notifications, promo updates you've opted into, and critical security alerts—nothing goes to external advertisers.