1. Overview and Who This Policy Applies To
This Privacy Policy applies to all users of the ShahSpin platform at shahspin.click — including anyone who registers an account, visits the website without registering, or contacts ShahSpin through any communication channel including live chat or email. "ShahSpin", "we", "us" and "our" refer to the ShahSpin platform and its operating company.
ShahSpin is committed to handling your personal data responsibly, transparently and in line with applicable law. This policy is written in plain English specifically because ShahSpin's primary audience is Pakistani players, and you deserve to understand exactly what is happening with your information without needing to interpret dense legal language.
By registering a ShahSpin account or using the platform, you acknowledge that you have read this Privacy Policy and consent to the data practices described in it. This policy forms part of ShahSpin's Terms and Conditions. If you have questions about anything in this policy before registering, please contact ShahSpin support — contact details are at the end of this page.
2. Personal Data We Collect
ShahSpin collects personal data through several channels: directly from you when you register an account or complete identity verification; automatically when you use the ShahSpin platform; and from payment processors when you make deposits or withdrawals.
Data You Provide Directly
When you register on ShahSpin, you provide your name, email address, date of birth, phone number and a password. This is the minimum required to create a functional account. You may optionally provide additional profile information such as your city of residence.
When you complete identity verification — which is required before withdrawals can be processed — you provide a copy of your CNIC (Computerised National Identity Card) and may be asked for a recent utility bill or bank statement as proof of address. These documents are processed securely and stored only for as long as required by applicable law and ShahSpin's AML compliance obligations.
When you contact ShahSpin's customer support team, the content of your communication — whether via live chat or email — is stored to help resolve your query and for quality assurance purposes.
Data Collected Automatically
When you use ShahSpin, our systems automatically collect certain technical information. This includes your IP address, the type of device you are using, your browser and operating system version, and your general location based on your IP address. This data is used for security purposes — particularly to detect potentially fraudulent access attempts — and to ensure the ShahSpin platform performs correctly on your device.
ShahSpin also collects usage data — information about how you use the platform. This includes which games you play, how long your sessions last, the value and frequency of bets placed, and which pages you visit. Usage data helps ShahSpin's responsible gaming team monitor for signs of problem gambling behaviour and helps the product team improve the platform.
ShahSpin does not collect data about your ethnicity, religion, political views or health status. CNIC details are collected solely for age verification and KYC compliance — not for profiling or targeting purposes.
3. How ShahSpin Uses Your Personal Data
ShahSpin uses your personal data for specific, legitimate purposes. We do not use your data for any purpose beyond what is described in this policy. The main purposes for which ShahSpin processes your personal data are:
- Account management: Creating and maintaining your ShahSpin account, verifying your identity, processing your login and keeping your account secure.
- Payment processing: Processing your PKR deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card channels. ShahSpin needs your payment information to complete financial transactions and to match incoming deposits to the correct account.
- Legal and compliance obligations: Anti-money laundering (AML) and Know Your Customer (KYC) requirements mean ShahSpin is legally obligated to verify your identity and maintain records of your transactions. This is not optional — it is a legal requirement that applies to all online gambling and payment service operators.
- Security and fraud prevention: Monitoring login activity, transaction patterns and device data to detect and prevent unauthorised access, fraud and money laundering.
- Customer support: Responding to your queries, resolving disputes and maintaining records of communications to ensure consistent service.
- Responsible gaming: Monitoring your play patterns to identify signs of problem gambling behaviour and ensuring that self-exclusion and deposit limit requests are honoured.
- Platform improvement: Analysing aggregated and anonymised usage data to understand how players use ShahSpin and to improve the product. This analysis does not involve identifying individual players.
- Service communications: Sending you account-related notifications — deposit confirmations, withdrawal status updates, security alerts and important policy changes. These communications are essential for your account and cannot be opted out of while your account is active.
ShahSpin does not use your personal data for automated decision-making or profiling in ways that produce legal or similarly significant effects on you, except where required by law or where you have given explicit consent.
4. Data Sharing and Disclosure
ShahSpin does not sell your personal data to any third party under any circumstances. We share your data only in the specific, limited circumstances described below:
- Payment service providers: When you make a deposit or withdrawal, your payment details are shared with the relevant payment service provider — such as Easypaisa or JazzCash — to complete the transaction. These providers operate under their own privacy policies and are bound by applicable financial services regulations.
- Identity verification services: ShahSpin may use a third-party identity verification service to assist with CNIC verification during KYC checks. These services are contractually bound to use your data only for verification purposes on ShahSpin's behalf.
- Legal and regulatory authorities: ShahSpin will disclose your data to law enforcement, regulatory bodies or government agencies when legally required to do so — for example, in response to a valid court order, legal process or AML reporting obligation. ShahSpin will not voluntarily share your data with authorities beyond what is legally required.
- Professional advisors: ShahSpin's legal, accounting and compliance advisors may have limited access to player data where strictly necessary for their professional services. These advisors are bound by confidentiality obligations.
- Business continuity: In the event of a merger, acquisition or sale of the ShahSpin business, player data may be transferred to the acquiring entity. ShahSpin will notify affected players before any such transfer and the acquiring entity will be bound by the same privacy obligations as ShahSpin.
Every third party that handles ShahSpin player data on our behalf is contractually required to maintain appropriate security standards and to use your data only for the specific purpose for which it was shared. ShahSpin regularly reviews its third-party data processing relationships.
5. Data Storage and Security
ShahSpin stores player data on secure servers. All data in transit between your device and ShahSpin's servers is protected using TLS (Transport Layer Security) encryption. Personal data stored on ShahSpin's servers — including identity documents, payment information and account details — is encrypted at rest using industry-standard encryption.
Access to player personal data within ShahSpin is strictly controlled on a need-to-know basis. Only staff with a legitimate operational need — such as the payments team processing a withdrawal or the support team resolving a dispute — can access relevant player data, and all such access is logged.
ShahSpin maintains security incident response procedures. In the unlikely event of a data breach that affects your personal information, ShahSpin will notify you by email within a reasonable timeframe after the breach is confirmed, and will take immediate steps to contain and remediate the incident.
Despite these measures, no internet-based platform can guarantee 100% security against all possible threats. You can help protect your ShahSpin account by using a strong, unique password and not sharing your login credentials with anyone.
6. How Long We Keep Your Data
ShahSpin retains your personal data for as long as your account is active and for a period after closure as required by applicable law and regulation. The specific retention periods that apply to ShahSpin data categories are:
- Account and identity data: Retained for the duration of your account and for a minimum of 5 years after account closure, in line with standard AML record-keeping requirements.
- Transaction records: Retained for a minimum of 5 years from the date of each transaction, as required for financial compliance purposes.
- Identity verification documents: Retained for the duration of the account and for the period required by applicable AML regulations after closure.
- Communication records: Customer support chat logs and email correspondence are typically retained for 2 years for quality assurance and dispute resolution purposes.
- Technical and usage data: Typically retained for 12 months in identifiable form, after which it may be retained in anonymised, aggregated form indefinitely for platform analytics.
When data is no longer required for the purposes for which it was collected and is outside its mandatory retention period, ShahSpin securely deletes or anonymises it.
7. Cookies and Tracking Technologies
ShahSpin uses cookies and similar technologies on the shahspin.click website. Cookies are small text files stored on your device that help the platform remember your preferences, keep you logged in and understand how you use the site. Here is a breakdown of the cookies ShahSpin uses: