How We Handle Your Account Data
This is the totalwla privacy policy. We've written it the way we'd want to read it ourselves — short paragraphs, plain English, and direct answers about what we...
Our Privacy Posture, Plainly Stated
We collect what we need to run your account and nothing we don't. That means your sign-up details, the device you log in from, the games you open, and the payment references tied to DANA, OVO, GoPay or QRIS top-ups. We store this data on encrypted infrastructure and only share it with the licensing, payment and anti-fraud partners we're contractually bound to,
where local law permits. You can request a copy of your record, ask us to correct it, or close the account and have personal fields purged on the cycle our retention schedule sets. Marketing consent is opt-in only, and you can withdraw it from your account settings at any time without affecting your ability to keep using the lobby.
Service availability is jurisdiction-dependent. Users are responsible for checking local law before access.
How This Policy Is Reviewed
Quarterly Legal Review
Our in-house legal team rereads this policy every quarter against current Indonesian data rules and our licensing obligations, then publishes the revision date at the foot of the page so you can see what shifted.
Plain-Language Audit
Before any update goes live we strip the legalese. If a clause can't be explained in two sentences to a new account holder, we rewrite it until it can, then route it back to counsel.
Vendor Whitelist
Every third party that touches your data sits on a whitelist we maintain internally. Payment processors, KYC partners and analytics tools are reviewed annually for their own privacy posture.
Encryption Standards
Account credentials, payment references and identity documents move over TLS in transit and rest on AES-encrypted storage. Keys rotate on a schedule our security team owns separately from product teams.
Breach Protocol
If something goes wrong we tell you. Our incident playbook commits to notifying affected account holders and the relevant authority within the timelines local law sets, with a clear summary of impact.
Retention Discipline
We don't hoard data. Inactive account fields are minimised on the schedule listed below, and transactional records are kept only as long as financial and licensing rules require, then purged.