Privacy Policy

This Privacy Policy ("Policy") is published by Nanastoto ("we", "us", "our", "the Platform"), the operator of the online gaming platform accessible at nanastoto.cam. This Policy describes how Nanastoto collects, processes, stores, and protects personal data relating to registered users ("you", "User", "Player") and visitors to the Platform.

By accessing the Nanastoto website, creating an Account, or otherwise using any of the Platform's services, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. This Policy forms an integral part of Nanastoto's Terms & Conditions and should be read alongside that document.

Nanastoto is committed to handling personal data responsibly, lawfully, and with full transparency. We recognise that Malaysian users are entitled to understand exactly how their information is used — particularly given that data submitted for KYC verification includes sensitive identity documents such as MyKad information.

The following definitions apply throughout this Policy:

• "Personal Data" — any information that directly or indirectly identifies a living individual, including name, identification number, contact details, payment information, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, and destruction.
• "Data Controller" — Nanastoto, as the entity that determines the purposes and means by which Personal Data is processed.
• "Data Processor" — a third party that processes Personal Data on behalf of Nanastoto, such as payment processors or KYC verification providers.
• "KYC" — Know Your Customer; the mandatory identity and age verification process required before any withdrawal is processed.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the User's agreement to the processing of their Personal Data for a stated purpose.
• "Account" — a registered user account on the Nanastoto Platform.

Nanastoto collects the following categories of Personal Data:

Nanastoto collects Personal Data through the following means:

• Directly from you: Information you provide during account registration, KYC submission, payment processing, promotional opt-ins, and customer support communications.
• Automatically: Technical data collected via cookies, server logs, and analytics tools when you access and interact with the Platform. See Section 10 (Cookies) for details.
• From third-party providers: Identity verification results from KYC service providers; fraud risk scores from anti-fraud platforms; payment transaction data from payment processors including FPX, DuitNow, and e-wallet providers.
• From regulatory and compliance sources: Sanction screening results and politically exposed person (PEP) checks, as required under applicable anti-money laundering obligations.

Nanastoto processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions — including account management, payment processing, and KYC verification.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering requirements, age verification obligations, and regulatory reporting duties.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gambling programme administration — where these interests do not override your rights.
• Consent: Processing for direct marketing communications and optional analytics personalisation — where you have expressly opted in. Consent may be withdrawn at any time.

Nanastoto uses your Personal Data for the following specific purposes:

• Creating, managing, and maintaining your Account on the Platform.
• Verifying your identity and age (21+) as required prior to account activation and withdrawal processing.
• Processing MYR deposits via Maybank2u, CIMB Clicks, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX, and processing withdrawal requests to your nominated account.
• Administering promotional offers, bonuses, cashback programmes, and VIP tier benefits.
• Detecting, investigating, and preventing fraud, money laundering, underage gambling, and other prohibited activities.
• Providing customer support through live chat and email correspondence.
• Administering responsible gambling tools including deposit limits, session limits, and self-exclusion programmes.
• Sending service communications (account notifications, security alerts, withdrawal confirmations) and, where you have consented, promotional communications.
• Improving Platform functionality, game selection, and user experience through anonymised analytics.
• Complying with applicable legal and regulatory obligations.

Nanastoto does not sell, rent, or trade your Personal Data to third parties for commercial purposes. Data is shared only in the following limited circumstances:

7.1 Service Providers (Data Processors)

We engage third-party service providers who process data on our behalf under strict contractual data processing agreements, including:

• KYC verification providers: For identity and age verification processing.
• Payment processors: For facilitating MYR deposits and withdrawals via FPX, DuitNow, and e-wallet infrastructure providers.
• Fraud prevention platforms: For real-time risk assessment and anti-money laundering screening.
• Cloud infrastructure providers: For secure hosting of Platform data.
• Customer support platforms: For managing live chat and support ticket systems.

7.2 Legal & Regulatory Disclosure

Nanastoto may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory mandate. In all such cases, we will disclose only the minimum data necessary to satisfy the legal obligation.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Nanastoto's assets, Personal Data held by the Platform may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected users will be notified prior to any such transfer.

Nanastoto retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your Account relationship with Nanastoto.
• Transaction Records: Retained for a minimum of five (5) years following the date of the transaction, as required by anti-money laundering regulations.
• KYC Documents: Retained for a minimum of five (5) years following Account closure or the date of last transaction, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the support interaction.
• Marketing Preferences: Retained until you withdraw consent or close your Account.
• Technical/Log Data: Retained for a maximum of twelve (12) months in identifiable form, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification.

Nanastoto implements comprehensive technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the Nanastoto Platform is encrypted using 256-bit SSL/TLS protocols.
• Encryption at rest: Sensitive data fields including identity document references and financial data are encrypted in our databases.
• Access controls: Internal access to Personal Data is restricted on a strict need-to-know basis, with role-based permissions and audit logging.
• Two-factor authentication: Available for all user Accounts to reduce the risk of unauthorised Account access.
• Security audits: Regular internal and third-party security assessments are conducted to identify and remediate vulnerabilities.
• Incident response: A documented data breach response procedure is in place. In the event of a breach that is likely to result in high risk to your rights, you will be notified without undue delay.

While Nanastoto takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials.

Nanastoto uses cookies and similar tracking technologies to operate the Platform, remember your preferences, detect fraudulent activity, and collect anonymised analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly — including session management, login state, and security tokens. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language, display settings, and responsible gambling limit configurations.
• Analytics Cookies: Collect anonymised information about how users interact with the Platform, used to improve performance and user experience. No personally identifiable information is included in analytics data.
• Security Cookies: Used for fraud detection, bot identification, and session integrity verification.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. Nanastoto does not use cookies for third-party advertising targeting.

Subject to applicable law, you have the following rights in relation to your Personal Data held by Nanastoto. To exercise any of these rights, contact us at the details provided in Section 15.

Requests will be acknowledged within five (5) business days and fulfilled within thirty (30) days, except where an extension is required for complex requests, in which case you will be notified. Note that certain rights are subject to exemptions where retention is required for legal compliance — for example, KYC records must be retained to satisfy anti-money laundering obligations regardless of erasure requests.

Nanastoto is strictly an adult platform. The Services are not directed at, and must not be used by, any individual under the age of 21. We do not knowingly collect Personal Data from individuals under the age of 21. Any Account found to belong to a minor will be immediately closed and all data associated with that Account will be handled in accordance with applicable data protection law.

If you are a parent or guardian and believe that a minor may have registered an Account on the Platform, please contact our support team immediately using the details in Section 15 so that we can take prompt action.

As an online platform operating under international licensing arrangements, some of Nanastoto's data processors may be located in jurisdictions outside of Malaysia. Where Personal Data is transferred to a third country, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection principles. Such safeguards may include standard contractual clauses, data processing agreements, or equivalent protective mechanisms.

By using the Nanastoto Platform, you acknowledge that your data may be processed in jurisdictions outside Malaysia in connection with the services described in this Policy.

Nanastoto reserves the right to update or amend this Privacy Policy at any time. When material changes are made, the updated Policy will be published on this page with a revised "Last Updated" date. Where changes are significant, we may also notify registered users via email or in-Platform notification.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed of how we handle your data.

For any questions, concerns, or requests relating to this Privacy Policy or the Personal Data we hold about you, please contact the Nanastoto Data & Privacy team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line for faster routing.
• Live Chat: Available 24 hours a day, 7 days a week, via the in-Platform live chat widget. Request to speak with a privacy-related agent.

We aim to acknowledge all privacy-related requests within five (5) business days and to resolve them within thirty (30) days. Complex requests may require additional time, and we will communicate any delays to you proactively.

For responsible gambling inquiries, including self-exclusion requests and deposit limit adjustments, please visit our dedicated Responsible Gambling page.