OnlineCasinoSites.com Privacy Policy

What This Policy Covers

If you identify yourself by sending us an email containing personal information, we use what you tell us to respond to your message and for nothing else. For site security purposes, and to ensure that this service remains available to all users, we run software that monitors network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage. Beyond those two things, this policy does not yet set out the full list of what this site collects when one of its pages loads, and we would rather tell you that than publish a list we have not checked.

Who Handles Information About a Visit to This Site

Two companies handle data about a visit to this site, and no third one does. Vercel serves every page and keeps the request logs that serving a page produces; its privacy notice says that where it hosts someone else's site it acts as a processor rather than on its own account — “We act as a data processor on behalf of our Customers for the personal information contained in Customer Data.” — and it states what those traffic records hold: “We collect information about traffic to and from Customers' websites, such as End User IP address, location information derived from IP address, and system configuration information.” Supabase holds the database these pages are built from and serves the operator logos and other images on them, so a browser loading a page reaches it directly; its privacy notice puts it on the same footing, saying of the data a customer entrusts to it that “we process such Customer Data on behalf of and under the instructions of the relevant customer”.

No analytics processor and no advertising processor handles anything on this site today. These pages load no third-party script at all: the two analytics scripts this site's code can render are each gated on an environment variable; neither variable is set, so neither script is served. Nothing here measures a visit, builds a profile of a reader, or passes anything to an advertising network. If analytics is switched on later, this policy is updated to name the processor and what it collects before the script runs.

What This Site Records When You Follow a Link to an Operator

This is the one thing the site collects deliberately, so it is set out in full. When a reader follows a link to an operator, the redirect writes a row recording which operator was clicked, the destination address, the page context, the referring page, the browser user agent string, and a coarse location — country, and for the United States the state. The location is worked out from the network address and the address itself is not stored.

These records are kept for 24 months and then deleted. The deletion is a scheduled job that runs inside the database every day rather than a step somebody has to remember, so it keeps running whether or not the site is deployed.

Two smaller things, for completeness. A counter records which addresses on this site returned a "page not found", so broken links can be fixed; it holds the address and a count and nothing about the reader, and an entry nobody has hit for 90 days is deleted. And the light or dark theme preference is stored by the browser on the reader's own device and is never sent to this site at all.

What this policy still does not state is a lawful basis for the click records, or the rights a reader holds over them. Those are not written here because they have not been settled, and a privacy notice is the wrong place to guess.

What the Law Requires of a Site That Stores or Reads Information on a Visitor’s Device

This section states what the law requires of such a site. It does not state that this site complies, and no compliance claim is made anywhere on this page. In the United Kingdom the relevant rule is in secondary legislation: “Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.” The Information Commissioner’s Office describes the same rules in plain terms — “The rules on cookies are covered by the Privacy and Electronic Communications Regulations 2003 (PECR).” — and sets out the duty: “Organisations have to provide clear and comprehensive information about the way they use cookies, and ensure that for any cookie not strictly necessary for their website, they give you an appropriate means of consenting to that cookie being set on your device.” Its guidance for organisations puts the information duty first: “You must tell people if you set cookies, and clearly explain what the cookies do and why.” There is a carve-out, and it is narrow: “There is an exception for cookies that are essential to provide an online service at someone’s request (eg to remember what’s in their online basket, or to ensure security in online banking).” On timing, the ICO is specific: “Similarly, you cannot set non-essential cookies on your website’s homepage before the user has consented to them.”

The second thing the law does not leave to a 2000s-era reading is what counts as personal information. The ICO states that “The UK GDPR specifically includes the term ‘online identifiers’ within the definition of what constitutes personal data.”, and that “Using cookies or similar technologies to track an individual across websites involves the processing of personal data if this tracking involves online identifiers that are used to create a profile of the individual.” An earlier version of this policy said it obtained nothing personally identifying because it logged only domains, times and referrers. That is not how the regulator defines personal data, and it is not the position taken here.

This policy does not state a legal basis, who the controller is, or the rights you hold over information about you. None of that is published anywhere on this site, and we will not invent it, so the plainest thing we can tell you is that those statements are not here yet. If you want to know what we hold about you, email us at the address on our contact page.