Rollcap — Privacy Policy
Last updated: October 5, 2026
This policy explains what personal data Rollcap collects, why, and what rights you have. It covers two groups of people:
- people who use rollcap.io — visitors, account holders, customers, operators who contact us;
- people whose wallet activity appears in our blockchain analytics — mostly casino players, who never visit our site. Section 3 is written for them.
1. Who is responsible for your data
The controller of your personal data is the operator of Rollcap, based in the Republic of Cyprus ("Rollcap", "we", "us").
For anything about privacy, write to [email protected]. We follow the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018.
2. Data about people who use Rollcap
We collect only what we need to run the Service, sell our reports and keep things secure. We do not sell personal data and do not use it to build advertising profiles.
| What we collect | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email, name, password hash or sign-in provider ID, account settings | To create and run your account | Contract (6(1)(b)) |
| Name, company, job title, email, phone, Telegram handle, messages you send | To answer questions, prepare offers, deliver reports | Contract or steps before one (6(1)(b)) |
| Billing details, company address, VAT number, invoices, payment records, wallet address you pay from | To take payment and keep accounting records | Contract and legal duty (6(1)(b), 6(1)(c)) |
| Correction requests and the evidence attached | To check and fix casino data | Legitimate interest in accurate data (6(1)(f)) |
| IP address, browser, device, pages viewed, clicks, searches, referrer, time of visit | To keep the site working, prevent abuse and scraping, understand how it is used | Legitimate interest (6(1)(f)); consent for non-essential cookies (6(1)(a)) |
| Email for newsletters and product updates | To send news you asked for | Consent (6(1)(a)); you can unsubscribe in every email |
We do not knowingly collect data from anyone under 18. If you think a minor has sent us data, write to us and we will delete it.
Cookies
We use:
- essential cookies — keep you logged in, remember settings, protect against abuse. These do not need consent;
- analytics cookies — count visits and show which pages are used, through a third-party web analytics service. These run only if you agree in the cookie banner.
You can change your choice at any time via the cookie settings link at the bottom of the site, or block cookies in your browser. Blocking essential cookies can break login.
3. Blockchain data about wallet holders
This section is for people whose wallets send money to or receive money from crypto casinos, including players and VIPs. You did not give this data to us directly, so the law requires us to tell you how we use it.
What we process. Public blockchain records: wallet addresses, transactions, amounts, tokens, timestamps, balances, and the links we work out between addresses and casinos. We also derive analytics from them, such as deposit size bands, VIP tiers and which casinos the same wallet uses.
Where it comes from. Public blockchains, read through our own infrastructure and through blockchain data providers (block explorers, indexing and node services, and blockchain intelligence platforms), plus public statements by casinos.
Why it can be personal data. A wallet address does not show a name. But it may be possible to link it to a real person with other information, so we treat it as personal data and protect it accordingly.
What we do not do.
- We do not try to find out the real identity of players behind wallets, and we do not combine wallet data with names, emails, social profiles or KYC data.
- We do not publish profiles of individual players. Public pages show figures about casinos, mostly as totals and groups.
- We do not sell lists of player wallets for marketing, and we do not let customers use our data to target, track or contact individual players.
- We do not use this data to make decisions that have legal or similar effects on you.
Where a page or report shows a single address, it is because of its role in a casino's activity — for example a casino hot wallet, or a very large flow — not to profile the person behind it.
Why we do it and the legal basis. We research and publish market data about the crypto gambling industry: its size, how money moves, how operators compare. This serves our legitimate interest and the interest of the industry, regulators, journalists and researchers in transparency (GDPR art. 6(1)(f)). We have weighed this against your interests: the data is already public, we do not identify people, and we mostly publish totals.
Your rights here. You can object to our use of data about your wallet. Write to [email protected] and prove you control the address, for example by signing a message we send you. We will stop processing it unless we have strong legitimate grounds that override your interests, and we will exclude it from individual-level views. Because we do not know who you are, we cannot contact you directly; publishing this policy is how we inform you (GDPR art. 14(5)(b)).
4. Who we share data with
- Service providers who work for us under contract: hosting, databases, email, analytics, payments, accounting. These include cloud hosting, Google (Gmail) for email, web analytics and payment services. We send the current list on request. They may use the data only to provide their service to us.
- Advisers — lawyers, accountants, auditors — under confidentiality.
- Authorities, when the law requires it or to protect our rights, users or the public.
- A buyer or investor, if we move Rollcap into a company or sell or reorganise all or part of it. They would have to follow this policy.
We do not sell personal data.
5. Transfers outside the EU
Some providers may process data outside the European Economic Area. When they do, we rely on an EU adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. How long we keep data
| Data | How long |
|---|---|
| Account data | While the account is open, then 12 months |
| Customer, order and invoice records | For the period Cyprus tax and accounting law requires, then deleted |
| Messages and correction requests | 3 years after the last contact |
| Server and security logs | Up to 90 days, longer if needed to investigate an incident |
| Analytics data | Up to 26 months |
| Newsletter subscription | Until you unsubscribe |
| Blockchain analytics | As long as needed for historical market data; totals and groups with no single address may be kept indefinitely |
7. Security
We protect data with encryption in transit, access controls, separate access rights for staff and regular backups. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the regulator as the law requires.
8. Your rights
Under the GDPR you can ask us to:
- show you what data we hold about you and give you a copy;
- correct wrong data;
- delete your data;
- limit how we use it;
- give you your data in a portable format;
- stop using it, if we rely on legitimate interest (see section 3 for wallet data);
- withdraw consent you gave, at any time, without affecting what happened before.
Write to [email protected]. We reply within one month. We may ask you to confirm your identity or that you control a wallet.
You can also complain to the Cyprus regulator, the Commissioner for Personal Data Protection (dataprotection.gov.cy), or to the regulator in your own EU country. We would appreciate the chance to fix things first.
9. Changes to this policy
We will update this policy when our practices change and show the new date at the top. For important changes we will also tell registered users by email or in the product.
10. Contact
Rollcap, Republic of Cyprus
Email: [email protected]