499but Privacy Policy

499but collects personal data in two primary ways: information you provide directly when registering or using the platform, and information collected automatically as you interact with our services. The table below summarises the categories of personal data we collect and the primary source of each.

499but does not knowingly collect Sensitive Personal Data (including racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) from players. If you voluntarily disclose such information in a support communication, it will be used solely to address your specific query and will not be stored beyond the standard communications retention period.

499but uses the personal data it collects for a defined set of purposes, each of which is grounded in a specific lawful basis. We do not process your personal data for purposes incompatible with those listed below without first obtaining your explicit consent.

• Account Creation and Management: Your identity and contact data are used to create your 499but player account, verify your identity, and manage your account settings throughout the player lifecycle.
• Payment Processing: Your financial data is used to process deposits and withdrawals via bKash, Nagad, Rocket, and Upay, to reconcile transactions, and to investigate and resolve payment disputes.
• Fraud Prevention and Security: Technical and usage data are analysed to detect and prevent fraudulent activity, unauthorised account access, bonus abuse, money laundering, and other platform security threats.
• Regulatory Compliance: Identity and financial data may be used to satisfy Know Your Customer (KYC) obligations, anti-money laundering (AML) checks, and any reporting requirements imposed by competent authorities in Bangladesh.
• Customer Support: Communications data is used by our support team to respond to your queries, complaints, and responsible gaming requests efficiently.
• Platform Improvement: Anonymised and aggregated usage data is analysed to understand how players use 499but and to improve the platform's design, game selection, and performance.
• Responsible Gaming Monitoring: Behavioural and usage data is used to identify patterns that may indicate problem gambling, to trigger self-exclusion reminders, and to support player welfare interventions.
• Promotional Communications: With your consent, your contact data may be used to send you information about bonuses, seasonal promotions (BPL, Eid, Pohela Boishakh), and platform updates. You may opt out of marketing communications at any time by contacting [email protected].

499but will never use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review of such decisions. If you believe an automated decision has been made in error regarding your account, you have the right to request a manual review by contacting our support team.

499but does not sell, rent, or otherwise commercialise your personal data. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose.

• Payment Service Providers: To process transactions, your mobile number and transaction amount are shared with bKash, Nagad, Rocket, or Upay as required to complete the payment. Each of these providers operates under their own published privacy policy and security standards.
• Game Technology Providers: To deliver certified casino games, anonymised session and gameplay data may be shared with licensed game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi). These providers receive only the technical data required to operate the games and are bound by strict data processing agreements.
• Identity Verification Services: During KYC processes, identity documents may be shared with third-party verification partners who are contractually obligated to process such data exclusively for identity verification and anti-fraud purposes.
• Legal and Regulatory Authorities: We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts in Bangladesh where we are legally required to do so, or where we have a good-faith belief that disclosure is necessary to prevent imminent harm, fraud, or criminal activity.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of the assets of 499but, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer via email or a prominent notice on the platform prior to the transfer taking effect.

499but uses cookies and similar browser storage technologies to provide a functional, secure, and personalised experience. A cookie is a small text file placed on your device by a website. The table below describes the types of cookies used by 499but and their purpose.

499but does not use third-party advertising cookies or cross-site tracking cookies. Analytical cookies are processed on data that has been anonymised prior to any analysis, meaning no individual player can be identified from the analytical dataset. You may manage or clear cookies through your browser settings at any time, though disabling strictly necessary cookies will prevent you from logging in or using the platform.

499but implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. Our security measures include, but are not limited to, the following:

• Transport Encryption: All data in transit between your device and 499but's servers is encrypted using TLS 1.2 or higher, with a minimum 256-bit key length. Our SSL certificate is maintained and renewed continuously.
• Data-at-Rest Encryption: Sensitive personal data stored in 499but's databases — including identity documents submitted for KYC — is encrypted at rest using industry-standard AES-256 encryption.
• Access Controls: Access to personal data within 499but's systems is restricted on a strict need-to-know basis. Staff access is role-based, logged, and subject to regular review. No employee has unrestricted access to the full player data set.
• Password Security: Player account passwords are stored as salted cryptographic hashes. 499but staff cannot view your password; if forgotten, it must be reset through the verified account recovery process.
• Penetration Testing: 499but engages independent security professionals to conduct regular penetration tests and vulnerability assessments of its platform infrastructure.
• Incident Response: 499but maintains a documented data breach response plan. In the event of a confirmed breach that creates material risk to affected players, 499but will notify impacted players via their registered contact details as promptly as practicable.

While 499but takes all reasonable technical and organisational measures to protect your data, no system connected to the internet can be guaranteed to be entirely free of risk. You play a critical role in account security by keeping your 499but login credentials confidential and by using a strong, unique password for your account.

499but retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with any applicable legal, regulatory, or operational obligations. The following general retention periods apply:

• Active Account Data: Personal data associated with an active player account is retained for the duration of the account's existence on the 499but platform, plus a post-closure period as described below.
• Post-Closure Retention: Following account closure — whether player-initiated, due to inactivity, or as a result of a compliance action — 499but retains identity and financial transaction records for a minimum period of five (5) years. This retention is required to satisfy anti-money laundering obligations and to resolve any disputes that may arise after closure.
• Support Communications: Chat transcripts and email correspondence with the 499but support team are retained for a period of three (3) years from the date of the last communication in each support thread.
• Technical and Usage Logs: Server logs and anonymised usage analytics are retained for up to twelve (12) months, after which they are deleted or permanently anonymised.
• Marketing Consent Records: Records of your marketing consent (or withdrawal of consent) are retained for the duration of your account plus five (5) years, to provide an auditable consent trail.

At the end of each applicable retention period, personal data is securely and irreversibly deleted or anonymised such that it can no longer be linked to any identifiable individual. You may request early deletion of your data by contacting [email protected]; note that requests for early deletion may not be fulfilled where retention is required by law or for the establishment, exercise, or defence of legal claims.

As a player on the 499but platform, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected]. 499but will acknowledge your request within 72 hours and provide a substantive response within 30 days of receipt.

499but reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, platform features, applicable law, or regulatory guidance. The effective date of the most recent revision is displayed at the top of this document. When material changes are made to this policy, 499but will notify registered players via the email address or mobile number on their account at least 14 days before the revised policy takes effect.

Your continued use of the 499but platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should discontinue use of the platform and contact us to close your account.

Contact for Privacy Matters: All privacy-related enquiries, data rights requests, and data breach reports should be directed to the 499but Data Privacy team. We are available around the clock and aim to respond to all privacy communications within two (2) business days. Contact us at:

• Email: [email protected] (plain text — not a clickable link)
• Platform: 499but.app — use the live support chat feature for urgent privacy concerns
• Business Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6)

This Privacy Policy applies solely to data processing activities conducted by 499but in connection with the 499but.app platform. It does not apply to third-party websites or services that may be referenced in our content. 499but is not responsible for the privacy practices of external parties, including payment service providers bKash, Nagad, Rocket, and Upay, whose own privacy policies govern how they handle data shared with them during payment transactions.