Privacy policy

1. Who We Are

This website, www.spinaura.com (the “Site”), is operated by TRONABRIZ LIMITADA, a company lawfully incorporated under the jurisdiction of Costa Rica, with company registration number 3-102-890275 and registered address at Ofident Building, Office 3 Costa Rican North American Cultural Center, 200M North and 50M East, San Pedro, Barrio Dent, San Jose, Costa Rica.

As the data controller for this platform, we are responsible for determining the purposes and means of processing your personal data in accordance with relevant data protection legislation, including the General Data Protection Regulation (GDPR) and PIPEDA (Personal Information Protection and Electronic Documents Act).

We have appointed a Data Protection Officer (DPO) to oversee privacy compliance. You can contact the DPO at [email protected] for inquiries regarding your data rights or this Policy.

You can also contact us via Customer Support email - [email protected] - or reach us via chat service on our website.

2. Scope and Applicability

This Privacy Policy describes how we collect, use, disclose, and protect your personal data when you interact with our Site or use our services.

This Privacy Policy may be amended from time to time to reflect legal, technical, or business changes. All updates will be posted on this page with a revised effective date. We recommend reviewing this Policy regularly to stay informed.

3. Age Limitations

Our services are intended exclusively for users aged 18 and over. We do not knowingly process data of minors. If we discover data belonging to someone under this age, we will act promptly to remove it in line with applicable regulations.

4. What Personal Data We Collect and Why

We process different types of personal data depending on your interaction with our platform. Below is an overview of the categories of personal information collected, processing purposes, legal grounds, and data sources:

Categories of Data:

• Identity & Contact Information – full name, birthdate, ID/passport details, address, email, phone number.
• Financial & Transactional Data – payment card or bank details, deposit and withdrawal history.
• Gaming Activity – game participation, bonuses claimed, responsible gaming actions.
• Technical & Device Data – IP address, location, device identifiers, browser type, OS, and system logs.
• Communication Preferences – marketing opt-ins and correspondence records.
• Documents for Verification – proof of address or income, as required by compliance regulations.
• Google Account Data: where you choose to sign in using Google Sign-In — your email address and its verification status, display name, profile picture, and the unique identifier Google assigns to your account.

Purpose & Legal Basis:

1. Purpose: Account registration & service delivery
   Legal Basis: Contractual necessity
2. Purpose: Compliance with AML/KYC obligations
   Legal basis: Legal obligation
3. Purpose: Detecting fraud & abuse
   Legal Basis: Legitimate interest
4. Purpose: Personalized marketing
   Legal Basis: Consent or legitimate interest (as applicable)
5. Purpose: Security monitoring
   Legal Basis: Legal obligation and legitimate interest
6. Purpose: Improving customer communication with the help of Artificial Intelligence (AI) communication software
   Legal Basis: Legitimate interest
7. Site Analytics: Analytics and UX improvement
   Legal Basis: Legitimate interest

Sources of Data:

• Directly from you (via forms, uploads, or communication)
• Verification services
• Financial institutions
• Public databases (AML, PEP)
• Regulatory bodies
• Affiliated marketing/advertising networks
• Google LLC — where you choose to create an account or sign in using Google Sign-In, and only to the extent you authorise in the Google consent screen.

5. How We Share Your Information

We may share your personal data with the following entities to fulfill service, legal, or business obligations:

• Group Members: We may share your data within our group for fraud prevention, bonus abuse, AML, and Responsible Gaming purposes. If you consent, we may also share your data for direct marketing about other products within the group.
• Game providers, for game facilitation (e.g., username, IP).
• Payment processors, to execute your financial transactions securely.
• Marketing vendors, when you’ve opted in to receive promotions.
• Regulators and authorities, where disclosure is legally required.
• Verification platforms, including AML and age verification tools.
• Professional advisors, such as legal or financial consultants.
• Communication tools, to manage customer support (live chat, email).
• Conversational AI Platform Partners such as Anthropic, OpenAI, Gemini: to support and enhance our customer service.
• Third parties in business restructuring, such as mergers or asset transfers.

All third-party recipients are bound by data protection agreements and may process your data only under our direction.

6. Signing in with your Google Account

Signing in with your Google Account. You may choose to create an account or sign in using Google Sign-In. If you do, Google asks for your permission before sharing any information with us, and we receive only the data covered by the permissions you grant. Using Google Sign-In is optional: you can always register and sign in with an email address and password instead.

What we receive. When you sign in with Google, we receive from your Google Account: your email address, whether that address has been verified by Google, your display name, your profile picture, and the unique identifier Google assigns to your account. We do not receive your Google password, and we do not request access to your Gmail messages, Google Drive files, Google Calendar, Google Contacts, or any other Google service.

How we use it. We use this data solely to create and authenticate your account, to recognise you when you return, to contact you about your account, and to meet our legal and regulatory obligations as a licensed operator, including age and identity verification and anti-money-laundering checks. Signing in with Google does not by itself complete account verification: we may still ask you for the identity documents described elsewhere in this Policy. Where we send you marketing communications, we do so on the basis of your separate consent, which you may withdraw at any time in your account settings.

How we store and share it. Data obtained from your Google Account is stored on the same basis and for the same retention periods as the equivalent data you provide to us directly, as described in the data retention section of this Policy. We share it only with the recipients listed in this Policy, and only where necessary for the purposes set out above.

Limited use of Google user data. Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• use data obtained from your Google Account for serving advertisements, including personalised, retargeted or interest-based advertising;
• sell, rent or licence data obtained from your Google Account to any third party;
• transfer data obtained from your Google Account to third parties, except as necessary to provide and secure the service, to comply with applicable law or a lawful request, or in connection with a merger or acquisition with prior notice to you;
• use or transfer data obtained from your Google Account to develop, train or improve artificial intelligence or machine learning models, including the conversational AI tools described elsewhere in this Policy;
• allow humans to read such data, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.

Disconnecting your Google Account. You may unlink your Google Account at any time in your account settings, after which you can continue to sign in with an email address and password. You may also revoke our access directly in your Google Account at myaccount.google.com/permissions. Disconnecting stops any further sharing of data by Google, but does not by itself delete data we have already received. To request deletion, see the section of this Policy describing your rights, bearing in mind the minimum retention periods imposed on us by anti-money-laundering law.

7. Data Transfers

In some instances, we may transfer your personal data to countries outside the European Economic Area (EEA). When we do so, we ensure:

• The destination country offers an adequate level of data protection, as determined by the European Commission; or
• We implement Standard Contractual Clauses (SCCs).

8. Data Retention

We retain your personal data only as long as necessary for the purposes it was collected, including:

• Legal compliance with AML regulations (minimum 5 years post account closure).
• Contractual and business obligations.
• Retention of anonymized data for analytics and service enhancement.

Please note that requests for erasure cannot be fulfilled before the legally mandated retention period expires.

9. Your Privacy Rights

Subject to GDPR and PIPEDA, you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Request erasure, subject to legal exceptions.
• Restrict processing or object to certain data uses.
• Withdraw consent at any time.
• Port your data to another service provider.
• Lodge complaints with a supervisory authority.
• Right to disconnect a linked account: if you signed in using Google, you may unlink your Google Account at any time in your account settings, or revoke our access in your Google Account at myaccount.google.com/permissions.

To exercise any of these rights, contact our DPO at [email protected].

10. Security Measures

• Physical Access Controls: We strictly restrict unauthorized entry to any facilities, rooms, or buildings where systems that handle personal data are located. Our infrastructure is housed in secure data centers that adhere to recognized standards for both physical and cybersecurity. Only personnel with proper authorization can access personal data.
• System Access Management: All systems that handle personal data are protected through robust password policies and authentication protocols. Each user is provided with a unique identifier to ensure secure access and traceability.
• Data Access Restrictions: Access to information and software is governed by a strict need-to-know basis. We enforce policies that prohibit the unauthorized installation or use of hardware and software. Additionally, we’ve established procedures for the secure and irreversible deletion of data that is no longer needed for processing.
• Organizational Safeguards: To prevent the unintended commingling of personal data, we’ve implemented both technical and procedural controls. These include appointing a dedicated Data Protection Officer (DPO) and conducting regular training for employees on privacy and data protection practices.

11. Automated Decision-Making

We do not rely solely on automated decision-making processes, including profiling, to make decisions that could significantly affect you.

While we may use automated tools to assist with certain functions - such as fraud detection, risk assessment, and responsible gaming monitoring - all such processes involve human oversight and intervention.