18bet: Privacy Policy and Data Protection
This page describes how the domain 18bet.online handles personal data in the web environment identified as /privacy/. The content below has been organized for clear reading, transparency, and compliance with the LGPD. Where verifiable facts are missing, the point remains marked for review.
Quick read to understand the essentials
The site brings together registration, account access, balance, deposit, withdrawal, PIX, promotions, VIP, rebate, FAQ, and contact. In these journeys, some personal data may be processed for authentication, account operation, fraud prevention, support, and compliance with legal obligations.
One should not assume the collection of CPF, ID document, date of birth, email, or banking data unless this appears expressly in the actual form, in the user area, or in the official policy.
Useful site routes
The pages below help locate additional information within the domain itself.
What this policy covers
The policy exists to explain, in plain language, which data enter the site flow, why they are used and with whom they may be shared. It also organizes processing in scenarios such as registration, browsing, support, PIX operations, and use of the account's internal areas.
It does not replace the Terms of Use. The two pages work together: the terms address the rules for using the service, while the privacy policy addresses the processing of personal data.
Visual transparency and usage context
The presence of visual elements on the page does not change the obligation to state, with precision, what is collected, for what reason, and on what legal basis. On privacy pages, textual clarity remains the central point.
Whenever there is an update to the layout, form, or account flow, the policy must be reviewed to reflect the service's actual operation.
Which personal data may be collected
The form and site routes indicate use of +55 for phone, password, and password confirmation in registration. From there, processing may vary depending on whether the user logs in, deposits, withdraws, participates in campaigns, or contacts support.
| Category | Verified or plausible examples in the site flow | Typical purpose | Status in the material |
|---|---|---|---|
| Registration and login | Phone with +55, password, password confirmation, account identifiers | Create account, authenticate access, recover session, prevent unauthorized access | Partially confirmed |
| Account and operation | Profile, balance, deposit, withdrawal, transaction history | Execute account features and track transactions | Confirmed as a product area |
| PIX and payments | PIX flows 1 to 4, amounts displayed between R$ 10 and R$ 50,000 | Process deposit or withdrawal and validate the operation | Confirmed as interface |
| Promotions and VIP | Participation in bonuses, rebate, referral, VIP levels, and associated benefits | Manage eligibility, unlock benefits, and record offer use | Confirmed as business functionality |
| Support and contact | Messages sent to the official channel, support records, user feedback | Respond to requests and resolve incidents | Dependent on the official channel |
| Technical data | IP, date/time, browser, device, cookies, and logs | Security, auditing, stability, and usage analysis | Not detailed in the input |
If CPF, identity document, proof of ownership, PIX key, address, or e-mail is collected, this needs to appear explicitly in the form or official policy. Without this confirmation, it should not be invented.
How data is used in practice
Sign in and authenticate
Phone, password, and technical signals help open the account, maintain access, and reduce unauthorized login attempts.
Manage balance and PIX
Deposit, withdrawal, and movement require operational validation. The system needs to record the request and status.
Support and audit
Support messages, campaign history, and logs can be used to resolve tickets and review inconsistencies.
Most common cases
- create and manage the account;
- unlock internal features, such as balance, withdrawal, and profile;
- process promotions, bonuses, rebate, VIP, and referrals;
- comply with legal, regulatory, or fraud prevention requirements;
- respond to requests on the official support channel.
Legal bases for processing
Not every use of data depends on consent. In account operations and security, other bases may apply. When the purpose is unknown or has not yet been confirmed in the official text, the excerpt must be marked for review.
| Processing | Possibly applicable legal basis | Note |
|---|---|---|
| Registration and authentication | Performance of a contract or preliminary procedures | Depends on the final policy and the actual account creation flow. |
| User support | Performance of a contract and legitimate interest, as applicable | It is necessary to align with the support channel used. |
| PIX and financial operations | Performance of a contract, legal/regulatory obligation, and fraud prevention | The payment provider was not informed in the material received. |
| Promotions, bonuses, and VIP | Performance of a contract, legitimate interest, or consent, depending on the campaign | Offer and opt-in need to be described precisely. |
| Cookies and measurement | Consent for non-essential cookies, if there is a banner or manager | A preferences panel was not proven in the input. |
Information security, retention, and deletion
The submitted material did not confirm measures such as specific encryption, 2FA, backup policy, or profile-based access control. Therefore, it is only safe to say that the site must adopt technical and organizational measures compatible with the risk of processing.
In practice, it is common to keep records for a period compatible with operations, support, anti-fraud, and legal requirements. If there is a retention obligation, it takes precedence over an immediate deletion request. The data subject may request deletion when the legal basis allows it, but not everything can be removed right away.
- keep the password in a private environment;
- always check the domain before entering data;
- avoid resending receipts through unofficial channels;
- use trusted devices for PIX and login.
Data subject rights under the LGPD
The user may request confirmation of processing, access, correction, anonymization, blocking, deletion when applicable, portability within the limits of the law, information about sharing, and review of automated decisions, if any exist.
It is also possible to revoke consent when that basis was used. This does not automatically erase data that must be kept due to legal obligation, fraud prevention, or defense in legal proceedings.
Identify the request
Explain whether you want access, correction, deletion, information about sharing, or revocation of consent.
Use the official channel
The request must follow the contact actually published on the institutional page or in the support area.
Wait for analysis
Some data may require identity validation and verification of legal obligations before any final response.
Cookies and similar technologies
Browsing the domain may use cookies, pixels, or technical records to remember the session, measure stability, and understand usage. The input did not confirm a consent manager, so the final text must reflect what actually appears on the page /cookies/.
- Essential: allow login, browsing, and session maintenance;
- Operational: help with account, balance, withdrawal, and internal routes;
- Analytical: measure accessed pages and performance, if enabled;
- Marketing: may be used in campaigns and promotions, if there is a basis and proper notice.
If the visitor wants to review preferences, the cookies page should concentrate that guidance. Without that panel, the user needs clear instructions in the text itself.
Data sharing with third parties
The submitted material did not list specific providers. Therefore, it is not correct to name payment, hosting, analytics, or anti-fraud companies without proof. What can be said is that sharing, when it occurs, usually serves to process payment, maintain the infrastructure, provide support, or comply with the law.
If the user uses PIX, the journey may involve institutions participating in the payment arrangement. If there is an external communication tool, it must also be informed. All of this needs to appear concretely in the final text.
Storage, retention, and international transfer
The retention period was not informed in the received material. The effective text must indicate how long each data group is kept or what criterion defines deletion. Without this, the reader has no practical reference.
There was also no confirmation of international transfer. If there are servers, tools, or suppliers outside Brazil, the policy must declare the flow and the basis used for that transfer, with the appropriate protection.
Minors, policy changes, and contact
Protection of minors
If the site is not intended for minors, this must be stated expressly. If there is accidental collection, the review procedure needs to be described in the official text, without promising automatic blocking that does not exist.
Changes to this policy
This page may be updated to reflect changes in product, suppliers, payment methods, support, or legal requirements. The effective date must appear in the published version.
Privacy contact
Use only the contact channel that is actually confirmed for the domain. If there is a specific support or contact page, it must guide the submission of privacy requests. When there is a data protection officer, the name and official contact method must be inserted based on documentary evidence.
Frequently Asked Questions
What data does the site actually ask for during sign-up?
From what was confirmed in the material, the sign-up flow uses a phone number in +55 format, password, and password confirmation. Other fields, such as CPF or date of birth, should not be assumed unless they appear in the actual form.
What can be used for deposit and withdrawal?
The interface shows operations related to balance, deposit, withdrawal, and PIX, including value ranges displayed between R$ 10 and R$ 50.000. This describes the site journey, but it does not authorize inventing which institutions process the money.
Do user data go into promotions and VIP?
They can, if the offer mechanics require eligibility, usage history, or participation in campaigns. The final text should say which data are used for each bonus, rebate, referral, or VIP level.
Can I request access to or correction of my data?
Yes. The LGPD provides for access, correction, and other similar requests. The request must follow the official channel published by the domain and may require identity confirmation before a response.
Are all cookies mandatory?
Not necessarily. In general, essential cookies keep the session and access working. Analytics or marketing cookies depend on what was actually installed and on the notice shown to the user.
Does the deletion request erase everything right away?
No. Deletion may be limited by legal obligation, defense of rights, fraud prevention, or minimum record retention. What can be removed immediately must be defined case by case.
How do I contact about privacy?
Use the domain's official contact page or the channel indicated in support. Without this confirmed data, it is not correct to publish an invented email or phone number in the policy.
Does the site handle data on mobile the same way?
Data handling on mobile follows the same logic as the site, but there may be differences if there is an app, PWA, or native permissions. Since this detail was not confirmed, the final text should separate mobile web from app, if necessary.
Here is the version for final review
This structure prioritizes clarity, LGPD, and quick reading. Before publishing, confirm the controller, the official privacy contact, the update date, the providers involved in PIX and cookies, and the actual retention periods. Without this check, the page remains an operational draft.