Last reviewed: 25 September 2026. This is an independent plain-English explanation, not the operator's legal document. Where it differs from the operator's own published policy, the operator's document governs.
What this page is. It explains, in ordinary language, what personal data a real-money platform like this has to hold, why each category is needed, who processes it, how long it is kept, and what rights you have over it. It is not a technical security audit and it is not legal advice.
What this page is not. It is not the operator's official policy. The authoritative document is the privacy policy published by the operator, and where this summary differs from it, theirs governs. We are also unable to verify claims the operator makes about its own practices, and where that matters we say so rather than repeating it as fact.
Table of Contents
What is collected, and why
Data on a platform like this falls into three groups, and the reason each one exists is different. Understanding which is which makes the rest of the policy easier to read and easier to question.
- What you give us. Your mobile number, and identity documents where they are required for a withdrawal.
- What the device reveals. IP address, device type, browser information, and the technical records needed to keep an account secure.
- What the money records. Deposits, withdrawals, bets, bonus activity and the history of everything that happened to the balance.
| Category | Examples | Why it is collected | Required to play? |
|---|---|---|---|
| Account identifier | Registered mobile number, account ID, password hash | To create, identify and secure the account, and to send reset codes | Yes |
| Verification records | OTP requests and confirmations, timestamps, success or failure | To evidence that account access is authorised, and to investigate disputes | Yes |
| Device and network data | IP address, device type, browser, app version | Security, fraud detection, duplicate account checks and troubleshooting | Collected automatically |
| Transaction records | Deposits, withdrawals, payment references, balance history | To process payments and meet financial record-keeping obligations | Required to deposit or withdraw |
| Game activity | Bets placed, results, session times, bonus usage | To operate games, calculate wagering requirements and resolve disputes | Collected automatically |
| Identity documents | Government ID, address proof, selfie or liveness check where used | To verify the account holder for withdrawals and prevent fraud | Required for withdrawals |
| Support correspondence | Messages, ticket references, resolutions | To handle the matter and evidence what was requested and decided | Only if you contact support |
| Technical logs | Login attempts, error records, security events | To detect abuse and investigate unauthorised access | Collected automatically |
| Marketing preferences | Whether you opted in, campaign interactions | To send promotions you asked for, and to measure whether they worked | Optional |
The last two rows are the ones most people do not expect. Game activity is collected whether or not you think of it as personal, and it is what bonus wagering conditions are calculated from. Support correspondence is retained as part of the account record, not as a private note, which is worth remembering before sending anything you would not want to read again.
The legal basis for each use
Personal data should not be collected just because it is useful. Each purpose needs a basis, and in practice these platforms rely on three.
- Performance of the account contract. Verifying your number, holding your account, processing your deposits and withdrawals, calculating bonus conditions and keeping your balance accurate. This is the largest category, and you cannot opt out of it without closing the account.
- Legal obligation. Financial record-keeping, tax reporting, age verification, and responding to lawful requests. This category cannot be varied by request, because it belongs to the law rather than to the operator's discretion.
- Legitimate interests. Fraud prevention, duplicate account detection, network and information security, and improving the service. This is the category where your objection rights are most relevant.
- Consent. Marketing communications and non-essential cookies. This is the only category that can be withdrawn as easily as it is given, and it should be the only category treated as optional.
Where the operator's own policy states its basis for a specific use, that document is the version to rely on. A guide site cannot verify how a basis is applied in practice, and it would be misleading to imply otherwise.
Records kept about verification
It is reasonable to ask what a platform actually stores when it asks for an OTP. The useful answer is narrow: what should be retained is the fact that a code was requested, that it was confirmed, when, and from which device — not the code itself, and not something that would let anyone authenticate as you later.
That record matters for two reasons. It evidences that an account action was authorised, which is what settles a dispute about whether a withdrawal request was genuinely made. And it is the material an operator uses to investigate an account taken over by someone else, which is a far more common problem than people expect on a platform where credentials are valuable.
Cookies and local storage
| Type | Purpose | Can it be declined? |
|---|---|---|
| Session or authentication cookie | Keeps you signed in and protects the account from being used in two places | No. Required for the account to function |
| Preference storage | Remembers interface choices such as language or game settings | Yes, at the cost of re-setting preferences |
| Security and fraud cookies | Detects unusual login patterns and duplicate sessions | Not advisable; they protect the account |
| Analytics cookies | Measures how the service is used so it can be improved | Yes, where the platform offers a choice |
| Marketing cookies | Measures campaign effectiveness and limits repeated advertising | Yes. Declining must not affect withdrawal eligibility |
Two things to test if the platform offers a choice. Whether declining marketing cookies affects anything to do with withdrawals or bonuses — it should not — and whether the choice actually persists, rather than reappearing on the next visit.
On this website specifically: we use ordinary analytics to understand which pages are read and which are not useful. We do not build an advertising profile, and we hold no gaming account data, because we never ask for it.
Who else processes your data
A platform that moves money by UPI and verifies identities cannot handle everything itself, and pretending otherwise would be less honest than explaining it. The realistic categories of processor are:
- Payment gateways. They process the deposit or withdrawal, hold the payment reference, and return the outcome. Your UPI app and your bank are also involved in any UPI transaction.
- Identity verification vendors. If KYC is outsourced, they check the documents and return a result rather than a copy of your identity.
- Infrastructure and communications providers. Hosting, content delivery, and any SMS or OTP delivery service — which necessarily handles your mobile number to send a message.
- Analytics and support tooling. Depending on configuration, session recording or ticket systems may process content you submit.
- Professional advisers and authorities. Auditors, legal advisers, and public authorities where a lawful request or obligation applies.
The relevant distinction is not who touches the data but on whose instructions. Processors acting for the operator under a written agreement should not use it for their own purposes. The operator's published policy should list its processors, and if it does not, that is a reasonable thing to raise as a question.
How long data is kept
We are not going to invent specific periods for the operator. What we can do is set out the shape a defensible policy has, and what to ask for if the published one is vague.
| Category | Retained for | Why a period is needed |
|---|---|---|
| Account and identity records | While the account is open, then per the published schedule | Needed to operate the account and to answer questions about it later |
| Transaction and financial records | The period required by applicable financial and tax law | Statutory record-keeping, and evidence for disputes long after they end |
| Verification and KYC records | For the period evidencing account ownership | Proves who the account belonged to, including after a compromise |
| Technical and security logs | A short operational window, then deleted or anonymised | Troubleshooting and abuse detection do not need years of history |
| Support correspondence | As part of the account record | Evidences what was requested, promised and decided |
| Unsuccessful registration attempts | Short period | Fraud prevention, without keeping data for people who never joined |
| Marketing preferences | Until withdrawn, then a suppression record | A minimal record is often kept so you are not re-opted-in by mistake |
Security measures
Any platform handling payment references and identity documents is expected to apply a standard set of measures. Listing them is not an audit, and this page does not claim the operator has passed one — it is what to look for.
- Encryption in transit, so credentials and documents are not readable in transit.
- Encryption at rest, so a stolen database or backup is not directly readable.
- Passwords stored as hashes rather than any recoverable form, so a database leak does not hand over usable passwords.
- Access control on staff who can view personal data, with the access logged.
- Multi-factor or OTP verification for sensitive actions, which is the control whose records are described above.
- Processors bound by contract, so a vendor cannot repurpose your data for its own purposes.
- Breach response — a process to detect, contain and notify rather than discovering it later.
Your rights
Rights over personal data exist so that a person is not merely a source of it. In practice, on a platform like this, they look like the following.
| Right | How to exercise it | What limits it |
|---|---|---|
| Access | Written request to the operator's official channel | Should cover the categories of data held, not necessarily every technical log line |
| Correction | Account settings where editable, or support where verification applies | Identity-linked fields need verification before change |
| Deletion or closure | Request through support or the grievance route | Records required for legal, tax, fraud and dispute purposes are retained |
| Withdraw consent | Change marketing preferences or object | Does not apply to processing required to operate the account or meet a legal duty |
| Object to processing | Written objection to the operator | Applies mainly to legitimate-interest uses such as profiling or non-essential analytics |
| Nominate someone | Request recorded with the operator | Useful if something happens to you; not a substitute for a will |
| Raise a grievance | Contact the named grievance contact below | Does not prevent other legal remedies being pursued |
| Portability | Request your data in a structured, machine-readable form | Subject to rights of others and to exclusions for security-sensitive records |
The realistic expectation is worth setting. A deletion request will almost certainly not remove your transaction history, because the operator is obliged to keep it. What it should do is delete what is not required, tell you what is being retained and why, and confirm the rest — and that written response is itself useful evidence if a dispute follows.
Children's data
The platform is 18+ because real money is involved, and knowingly collecting data from a child is not acceptable in any framework. The practical provisions should be age verification at registration, a route for a parent or guardian to report an account held by a minor, and prompt deletion of that account's data when it is identified.
If you believe a minor has an account, request its removal through the official support channel and keep the response. This is also the clearest example of a data request with an obvious answer: an account that should not exist should not be holding data.
Complaints and the grievance route
A data complaint that has no named recipient is not really a complaint route. The operator's policy document should identify a Grievance Officer or equivalent named contact, with an address or email for data-related matters specifically.
[Operator to insert: grievance officer name, designation, email address, postal address and response window before publication.]
Until that is filled in, the official support channel is the route, and the escalation path in the terms applies if the response is unsatisfactory. What to include in a data complaint is not complicated:
- Your account identifier, so the matter can be located.
- The specific question or problem, framed as a request rather than a complaint where possible — what you want deleted, corrected, or explained.
- The category of data you are asking about, if you know it, using the table earlier on this page.
- Any relevant dates, including when you first raised it elsewhere.
- What you have already received, so the recipient does not repeat a step.
30 questions about your data
Real questions from people asking what happens to their information, not thirty rephrasings of one. Account mechanics are on the common questions page, and who we are on the about page.
1. What data does Jalwa Game collect?
Your registered mobile number, OTP verification records, account and transaction history, device and network identifiers, and KYC documents where a withdrawal requires them. Each category has a stated purpose and retention period in the tables above.
2. Why do you need my mobile number?
It is the account identifier and the channel for verification codes including password resets. It is also what duplicate account detection works on, which is why it cannot be transferred or shared.
3. Does Jalwa Game share data with third parties?
With providers who need it to do their job — payment gateways, identity verification vendors, hosting, SMS delivery and analytics — acting on the operator's instructions. The processor list is in the operator's own policy document.
4. How long is my data kept?
Per category rather than one blanket period: financial records for as long as the law requires, verification records to evidence ownership, technical logs for a shorter operational window. We do not invent figures for the operator; ask for the published schedule.
5. How do I request deletion of my data?
Through the official support channel with your account identifier. Deletion is subject to records the operator must retain for legal, tax, fraud and dispute purposes, so transaction history normally remains. Ask what is deleted, what is retained and for how long, and keep the response.
6. Can I correct my personal information?
Yes, in account settings where the field is editable, or through support where verification applies. Identity-linked fields such as your registered number need support, because changing them affects account security and withdrawal eligibility.
7. What are cookies and what do they do here?
Small files your browser stores. The platform uses them mainly to keep you signed in and remember preferences, and not to build an advertising profile. This site uses ordinary analytics cookies about page reading, and nothing connected to a gaming account.
8. What is a grievance officer?
A named individual who handles data-related complaints separately from general support, so a data question is not treated as an ordinary ticket. The appointment details should be published in the operator's policy; the section above marks where they belong.
9. Do you collect data from children?
No. The platform is 18+, and knowingly collecting from a child is not acceptable. Accounts found to belong to minors are removed, and a deletion request for a minor's account should be made promptly through the official channel.
10. Is my data stored in India?
The operator's residency position is in its own policy, and we cannot verify it. Payment and identity verification providers may process data outside India. Check the published position rather than assuming, and raise it as a grievance if it is unclear.
11. Is my data encrypted?
Encryption in transit and at rest is the expected standard for a platform handling payment references and identity documents, along with access control and logging. The specific measures are described by the operator; this page explains categories and purposes, not a security audit.
12. Jalwa game meri personal data kahan use hota hai?
Number — account banane aur OTP bhejne ke liye. Transaction data — deposits aur withdrawals record karne ke liye. Device aur network data — fraud detection aur duplicate account check ke liye. KYC documents — withdrawal verify karne ke liye. Har category ka apna purpose aur retention period hai.
13. Privacy policy kya hota hai?
A document setting out what your data is, why it is collected, who it is shared with, how long it is kept and what rights you have. It lets you check where your information goes and how to control it, rather than trusting that someone is looking after it.
14. Data delete karwa sakte hain?
Haan, official support se request karke. Lekin financial, tax, fraud aur dispute records operator ko retain karne padte hain, isliye transaction history account band hone ke baad bhi rahegi. Poochhein ki kya delete hoga aur kitne der tak rahega, aur jawab likhit me lein.
15. Cookies ka kya hota hai?
Browser me chhoti files jo yaad rakhne me madad karti hain — login active rehna, interface preference. Inka use advertising profile banane ke liye nahi hota, aur non-essential cookies aap decline kar sakte hain. Withdrawal eligibility par iska asar nahi hona chahiye.
16. Grievance officer kaun hai?
Data handling ki shikayaton ke liye designated ek nami vyakti, general support se alag, taaki data ka sawaal ordinary ticket ki tarah na treat ho jaaye. Appointment aur contact operator ki policy document me hona chahiye; upar placeholder diya gaya hai.
17. Can I withdraw consent for data processing?
For processing based on consent, yes, and it should then stop. Processing needed to operate the account — verification, anti-fraud, statutory records — is based on legal obligations, so declining it means closing the account rather than continuing to use it.
18. Does Jalwa Game sell personal data?
A gambling operator is not expected to sell personal data, and the operator's policy states its position. We cannot verify it independently, so check the published wording and raise it as a grievance if it is unclear or if contact suggests your details have been sold.
19. Why do you need my KYC documents?
To confirm the person withdrawing is the account holder and that funds go to their own account, required for withdrawals and most often the first or a larger one. Submit through the official channel only. Anyone requesting documents, or a fee, elsewhere is not the operator.
20. Can one mobile number have two accounts?
No — the number is the account identifier, so one number carries one account. Sharing it between adults also means each can receive the other's reset codes, which is a security problem as well as a rule breach.
21. What happens to my data if I close my account?
The account deactivates, but records the operator must keep for legal, tax, fraud and dispute purposes remain for their stated period, and data no longer needed is deleted. Ask for the specific position in writing when you close an account, and keep it with your withdrawal records.
22. Do you track me across other websites?
This site does not build an advertising profile and collects nothing about your gaming account, because we never ask for one. The platform's own position on advertising and analytics is in its published policy, which is the source to check for cross-site behaviour.
23. Can I see what data you hold about me?
A written access request through the official channel is the normal route and should produce the categories of data held about you. Make it in writing, keep the reference and response, and escalate through the grievance route if refused without a stated lawful basis.
24. What security measures protect my data?
Encryption in transit and at rest, hashed passwords, controlled and logged staff access, OTP verification for sensitive actions, contractual obligations on processors, and a breach response process. These are what to look for; this page is not an audit of whether the operator has them.
25. Is my data used to advertise to me?
The platform's policy sets out what advertising data is used. The practical protections are that non-essential cookies can be declined, and that withdrawal eligibility is never conditional on accepting marketing. This site runs no advertising profile at all.
26. How long is support correspondence kept?
As part of the account record, because it evidences what was requested, promised and decided, including disputes. Treat a message to support as account record rather than a private note, and do not send anything you would not want to read again later.
27. Can I use the site without providing personal data?
You can read this site without providing anything, since we collect no account data. On the platform a mobile number is required, because it is the identifier and the verification channel — so browsing is possible without an account, but playing is not.
28. Is this the operator's official privacy policy?
No. It is an independent plain-English explanation on a separate site. The operator's own published document is authoritative, and where this summary differs, theirs governs. We also cannot verify the operator's claims about its own practices.
29. What if I think my data has been misused?
Collect the evidence, screenshot the conversations, and raise it with the operator's grievance contact. If the response is unsatisfactory, the escalation route in the terms applies. We cannot investigate — we have no account access — but we can help you write a clear factual complaint.
30. Do you need my bank details?
No. Deposits are made by UPI through a payment gateway and withdrawals go to a UPI ID in your own name, so full banking details are not required. Anyone asking you to enter bank or card details in a chat to release a withdrawal is attempting theft.