This policy explains what the WinHouse white-label sportsbook ("the Service") collects, why, and what you can do about it. It covers two different relationships, and the difference matters:
You, our customer. We are the controller of your account data — the company details you register with, your billing, your embed configuration.
Your players. You are the controller; we are your processor. Their accounts exist inside your network, we hold them on your instructions in order to run the book, and we do not use them for anything of our own.
| Data | Why |
|---|---|
| Company / brand name, email, username, password (hashed) | To create and secure your account |
| Account slug, locale, embed key, allow-listed domains | To serve your book on your sites |
| Theme tokens, logo URL, widget layout, embed dimensions | To paint your skin |
| IP address at signup | Rate-limiting abusive registrations |
Prepaid credit balance, lifetime funded total, plan tier, top-up records, the credit ledger, and monthly GGR invoices (stakes, payouts, ticket counts and the rates applied). We do not hold your card or wallet details — see processors below.
The managers, agents, shops and players you create beneath your boss account, their balances and credit movements, and the tickets they write — selections, stakes, prices, timestamps and settlement outcome. If you run the seamless wallet model, your players' money stays on your platform and we hold only the reference of each call we make to your endpoint.
Server logs (request paths, status codes, timestamps, IP), session identifiers, and error traces. These exist to keep the Service running and secure.
We set no tracking cookies and carry no advertising tags. Your signed-in
session is held in your browser's sessionStorage and ends when you close the
tab; your light/dark preference and sidebar state are kept in localStorage on
your own device. The embedded book uses only what it needs to keep a player signed in.
Our public pages use Plausible Analytics, which is deliberately cookieless. It records a page view — the URL, the referring site, the country, and the broad device and browser type — and nothing that identifies you. It sets no cookie, assigns no persistent identifier, and cannot follow you to any other website. That is why this site shows you no cookie banner: there is nothing to consent to.
Analytics does not run on the account portal or the agent panel, so nothing you do while signed in is measured. If you would still rather not be counted, any tracker blocker or a browser's "block third-party scripts" setting stops it, and the site works exactly the same without it.
We do not sell personal data, and we do not use your players' data to market anything to them or to anyone else.
Every customer's network is scoped to their own account. No other operator on the platform can see your tree, your players, your tickets or your reports, and you cannot see theirs. Our own staff access production data only where needed to run or support the Service.
| Processor | Purpose |
|---|---|
| NOWPayments | Cryptocurrency top-ups. They handle the checkout and the blockchain confirmation; we receive the amount and a reference, not your wallet credentials. |
| Plausible Analytics | Aggregate traffic measurement on the public pages. EU-hosted and cookieless; it receives a page view with no identifier attached and never sees the portal or the panel. |
| Odds and results providers | Supply the trading feed and settlement data. They receive no information about you or your players. |
| Hosting and infrastructure | Run the servers the Service is delivered from. |
Where we act as your processor for your players' data, your own lawful basis applies and we act on your documented instructions.
Subject to applicable law you may request access to, correction of, export of, or deletion of your personal data, object to processing, or withdraw consent where consent is the basis. Write to the address below and we will respond within the period the law allows.
Requests from your players should be sent to you, not to us — you are their controller. We will support you in answering them.
Account and billing records are kept for as long as your account is open and afterwards for the period required for tax, accounting and regulatory purposes. Settled tickets and ledger entries are retained as the financial record of the Service. Server logs are kept for a short operational window. On closure and request we delete or anonymise what we are not required to keep.
Passwords are stored hashed, never in plain text. Traffic is served over TLS. The book is embeddable only on origins you have explicitly allow-listed — no wildcards, because an abandoned subdomain would otherwise become a valid host for your book. Your embed key is public by design and grants no access to data and no ability to place bets; rotating it takes effect immediately.
No system is perfectly secure. If we become aware of a breach affecting your data we will notify you without undue delay.
Our infrastructure and processors may be located outside your country. Where data leaves the EEA we rely on an appropriate transfer mechanism, such as standard contractual clauses.
The Service is not offered to anyone under 18, and no part of it is directed at children. If you believe a minor has been registered as a player in a network on our platform, tell us and tell the operator of that network immediately.
We may update this policy. Material changes will be sent to the email on file and posted here with a new "Last updated" date.
Privacy questions and data requests: sales@winhouse.bet
See also our Terms of Service.