Here you can read how Riverspin treats personal information when you browse the website, open an account, pay, play or write to support. It applies to the website, the installed web app and all messages from the casino. Carrying on with the service means you accept it, and a link in the footer of every page brings you back whenever you want to check a detail.
Player information is confidential and is never sold. Below you will find what is collected, why, who can see it and how long it is stored.
Requests are limited to data that an online casino needs for a safe account and for its legal duties.
Players who register with Google share only the basic profile details that Google passes on for sign-up, and nothing more from that account.
Essential cookies keep you logged in, remember the chosen language and shield the session from misuse. Further cookies measure how pages perform, which lets us repair errors and speed up loading. Browser settings let you block or delete cookies, although a few features stop working without the essential ones.
Push notifications are optional and begin only after you accept the browser prompt. Turn them off at any time from your browser's notification settings.
Promotional e-mails, bonus news among them, are sent to the verified address on the account until you unsubscribe, and every one includes a way to opt out.
Information leaves the casino only if the service needs it or the law demands it. Payment providers get what a transaction requires, verification partners inspect documents, game studios receive the technical identifiers that a session depends on, and support and security staff see the account data their work calls for. Authorities receive data only on a valid legal request that the casino is obliged to answer.
Anybody who processes personal data for the casino is bound to confidentiality and may use it only for the agreed purpose.
Account and transaction records are kept for five years after your last use of the service, because the law requires that period. Afterwards they are deleted or anonymised. Because of this, a request to wipe everything immediately cannot be met while the period runs, although data that no longer has to be held is removed.
An account with no activity for twelve months turns inactive, and the five years are counted from the last time the service was used.
Connections run over TLS 1.3 and an AI-powered intrusion detection system monitors traffic, while inside the company personal data is open only to the staff whose work requires it. Two-factor authentication with an authenticator app can be enabled in the profile. You help by picking a strong password, keeping it to yourself and signing out of devices that belong to someone else.
The Privacy Act 1988 and the Australian Privacy Principles let you ask what personal information is held about you, request corrections and complain about how it is handled. Unverified details can be edited directly in your profile, while verified ones are changed through support, which guards the account against takeover.
To use any of these rights, or to put a question about this notice, write to [email protected] or open the live chat. If the answer does not satisfy you, a privacy complaint can be taken to the Office of the Australian Information Commissioner. The notice may change when the service or the law changes, and the version on this page is always the current one.
