Skip to content
Log inSign up

Legal information

Privacy policy

Last updated: October 1, 2026

We only collect the data we need for the games, security, protecting minors, meeting our legal obligations and, with your consent, measuring our ads. We never sell any data.

1. Data controller

Bertini Casino, reachable at contact@casinobertini.com.

2. Data we collect

  • Account: email address, username, date of birth, time zone and acceptance of the terms; with Sign in with Google, the email address and ID provided by Google. Your password is handled by our authentication provider and is never stored in plain text.
  • Language: the language you choose is saved in your profile (to show the site and send you emails in that language) and in the NEXT_LOCALE language cookie.
  • Gameplay: bets and results, verification seeds, progression, missions, avatar items, friends and chat messages (kept for 7 days unless a report is pending).
  • Purchases and refunds: amount, date, status, consent to immediate supply, refund requests and Stripe payment and refund references. Bertini Casino never receives or stores any card details: they're processed by Stripe.
  • Age verification: confirmation that you're an adult before your first purchase, then a check by Stripe Identity using an official ID document, with a selfie compared automatically with the document photo only if you choose that method (the other method, ID document only, uses no biometric data). We keep the result (adult or not), the status, the date and the ID of the check, along with an encrypted fingerprint (HMAC) of your verified last name, first name and date of birth, which stops one person from verifying several accounts; never the images, your name or the date of birth itself.
  • Location and connection security: the country derived from your IP address (provided by our host) is checked on every request to block access from excluded countries; your IP address is sent to our detection provider to spot a VPN, a proxy, a hosting provider or the Tor network. We only keep an encrypted fingerprint of the address and the result.
  • Account security: the countries you connect and play from (one record per day) and the history of email address changes (masked addresses), to detect account selling or sharing.
  • Compliance log: dated proof of acceptance of the terms (with their version), confirmation of age, identity check results, consent to immediate supply, choices and changes of spending limits, geographic blocks, self-exclusions and refunds, with the country and an encrypted fingerprint of the IP address.
  • Responsible gaming: spending limits, self-exclusion, session reminders.
  • Emails: service emails (sign-up confirmation, a reminder sent 3 days before each VIP Club renewal with a cancellation link).
  • Acquisition: where your sign-up came from when it's in the tracked link (utm parameters, gclid or fbclid click IDs, landing page).
  • Referrals: the link between referrer and invited friend, and an encrypted fingerprint of the sign-up IP address (or, for older accounts, of the first visit to the Referrals page), never the address itself, to prevent fake accounts.
  • Cookie consent: your choice and a random ID, with no data that could identify you.

3. Purposes and legal bases

  • Providing the service (account, games, shop, rewards, service emails, VIP Club renewal reminders, refunds): performance of the contract.
  • Verifying age (18 and over) before any purchase and offering responsible gaming tools: our legitimate interest in protecting minors and players.
  • Comparing your selfie with your ID document (biometric data), only if you choose that method: your explicit consent, collected by Stripe at the time of the check (Article 9(2)(a) GDPR). This consent is never a condition for buying: verification with an ID document only is always offered.
  • Blocking access from excluded countries and masked connections (VPN, proxy, Tor): our legitimate interest in offering the service only where it's allowed and in meeting our payment providers' requirements.
  • Securing the service, preventing fraud (especially referral fraud), stopping one person from verifying several accounts or getting around a self-exclusion, detecting account selling or sharing and moderating the chat: legitimate interest.
  • Keeping the compliance log: compliance with our legal obligations (proof of consumer consent and information) and our legitimate interest in being able to establish our rights in a dispute.
  • Measuring which campaigns bring in sign-ups, based on the tracked link: legitimate interest.
  • Measuring ad conversions with the Google Ads and Meta tags: only with your consent.

4. Recipients

Your data is processed by Bertini Casino and by the following service providers, solely for the purposes described:
  • Vercel Inc.: Website hosting.
  • Supabase Pte. Ltd.: Database and authentication (data stored in the AWS Paris region).
  • Stripe Payments Europe, Limited: Payments, refunds and identity verification (Stripe Identity); Bertini Casino never keeps any card details or ID document images.
  • ipapi.is: Detection of VPNs, proxies and anonymity networks from the IP address (servers in Germany; looked-up addresses are neither logged nor stored).
  • Google Ireland Limited: Sign in with Google, service emails (Google Workspace) and, with your consent, Google Ads.
  • Meta Platforms Ireland Limited: Only with your consent: Meta Pixel (measuring Facebook and Instagram ads).
For identity verification, Stripe acts as a processor on our behalf and, for its own fraud-prevention and service-improvement purposes, as an independent controller, under its privacy policy (stripe.com/privacy). Under its terms, Stripe may process this data in the United States and, where the law provides for it, disclose it to third parties, including public authorities.
Our masked-connection detection service is ipapi.is (Nikolai Tschacher, Berlin, Germany). Your IP address is sent to its servers in Germany; according to its data processing agreement, reviewed on October 1, 2026, looked-up addresses are neither logged nor stored there.
Some of these providers are based or process data outside the European Union (in particular in the United States and Singapore). These transfers are covered by the safeguards provided for by the GDPR, in particular the European Commission's standard contractual clauses offered by these providers. Your gameplay data is stored in the AWS Paris region.

5. How long we keep data

  • Account, game and purchase history, age verification result: for as long as the account exists. When the account is deleted, everything is erased immediately, except the accounting records of purchases (10 years, accounting obligation), the compliance log (period below) and, if a self-exclusion or suspension is still active, an encrypted fingerprint of the email address until it ends (so it can't be bypassed with a new account).
  • Compliance log: 5 years, then deleted automatically.
  • Chat messages: 7 days (or until a report is handled).
  • Connection check result linked to the IP fingerprint: 2 days at most.
  • Connection and activity countries: 90 days. History of email address changes: 1 year.
  • IP fingerprint used for referrals: 1 year.
  • Consent choice: 6 months in your browser, 13 months in our evidence log.
  • Language cookie (NEXT_LOCALE): 1 year in your browser.
  • Ad source of your first visit (cookie, only with your consent): 30 days in your browser.
  • Inactive account: an account with no sign-in and no purchase for 3 years is deleted, after a warning email sent one month before (signing in once is enough to keep it).
  • Sign-up attempt by a minor: an encrypted fingerprint of the email address until the declared date of birth's 18th birthday, and a record in the compliance log.
Payment records are kept by Stripe in line with its own legal obligations.
Identity check images and data are deleted at Stripe as soon as the result is recorded (Stripe may keep some of it for its own legal obligations, under its policy). The encrypted identity fingerprint is kept for as long as the account exists and, if the account is deleted during a self-exclusion or suspension, until it ends.

6. Automated decisions

Blocking access or a payment from an excluded country or a masked connection, and refusing a purchase after a failed identity check, result from automated checks. You can ask for a person to review your case, share your point of view and contest the decision by emailing contact@casinobertini.com.

7. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions for your data after your death. To exercise these rights, email contact@casinobertini.com. You can withdraw your consent to advertising cookies at any time on the Manage cookies page.
At any time, you can download all of your data (JSON file) and permanently delete your account yourself, from Profile → Settings → My data.
For data that Stripe processes as a controller, or to withdraw your consent to Stripe's use of your biometric data, you can also email privacy@stripe.com.
If you believe your rights aren't being respected, you can file a complaint with the French data protection authority, the CNIL (cnil.fr).

8. Minors

The service is strictly limited to people aged 18 and over. Sign-ups from minors are refused, age is verified before any purchase, and an account found to belong to a minor is closed.

9. Security

Connections are encrypted (HTTPS) and access to data is restricted to the site's server. IP addresses are never stored in plain text: only encrypted fingerprints are. Each player can only read their own private data; usernames, avatars, levels, chat messages and bets in the public feed remain visible to other players.