Privacy Policy

This Privacy Policy explains how Grailbet, operated by Grail Technologies Ltd, collects, uses, stores, and protects personal information belonging to players who register an account or otherwise interact with the site at grailbet-ca.ca. It applies to all visitors and registered account holders located in Canada and describes the categories of data processed, the purposes for that processing, how cookies are used, how information may be shared with third parties, how long data is retained, and the rights available to users regarding their own information. Grailbet operates under a licence issued in Anjouan, Union of Comoros, and handles personal data in line with the obligations attached to that licence as well as generally accepted data protection practices for online gambling operators serving Canadian residents.

By creating an account, depositing funds, or using any feature of the site, a user acknowledges that personal data will be processed as described in this policy. Anyone who does not agree with the practices described here should refrain from registering an account or should contact support to discuss available options, including account closure.

Who This Policy Applies To

This policy applies to anyone who visits grailbet-ca.ca, registers for an account, deposits or withdraws funds, plays casino games or places sports and esports wagers, or otherwise communicates with support. It covers information collected directly from users, information generated through use of the platform, and information received from third parties such as payment providers or identity verification services. Access to the platform is restricted to individuals who meet the minimum legal age for gambling in their province, which is 19 in most of Canada and 18 in Alberta, Manitoba, and Quebec. Age verification is part of the account registration and know-your-customer process described later in this document.

Categories of Data Collected

Grailbet collects several categories of information in order to operate accounts, process payments, meet regulatory obligations, and maintain a secure platform. The table below summarizes the main categories and their general purpose.

Some of this information is provided directly by the user during registration or when contacting support. Other information is generated automatically as the account is used, such as records of gameplay or login timestamps. Financial and identity data may also be received from third-party payment processors or verification providers engaged to confirm that deposits, withdrawals, and account holders meet applicable requirements.

How Personal Data Is Used

Personal data is processed for a defined set of purposes connected to operating the platform responsibly and lawfully. These purposes include verifying that an account holder meets the minimum age requirement and is not accessing the service from a restricted territory, processing deposits and withdrawals through the payment methods available in the cashier, screening transactions for signs of fraud or money laundering, and maintaining records required for regulatory or accounting purposes. Data is also used to operate responsible gambling tools such as deposit limits and self-exclusion requests, to respond to support enquiries, and to maintain the security and stability of the platform, including detecting unauthorized access attempts.

Where a bonus or promotional mechanic forms part of an account’s activity, transaction and gameplay data connected to that mechanic may be reviewed to confirm eligibility and correct application of wagering rules. For example, records showing which deposits and game rounds count toward wagering on a welcome package, or which weekly losses qualify for cashback, are retained as part of normal account activity data and may be reviewed if a query or dispute arises. This processing is administrative and does not involve using personal data for purposes beyond operating the account and the terms attached to it.

Cookies and Similar Technologies

Grailbet uses cookies and similar tracking technologies to operate the website, remember login sessions, and understand how the site is used. Cookies are small text files placed on a device when the site is visited. Some cookies are strictly necessary for core functions such as staying logged in during a session or maintaining cart-style cashier steps, while others are used for analytics purposes to understand which pages are visited and how the platform performs across different devices and browsers.

Users can typically control or delete cookies through their browser settings, although disabling certain cookies may affect how parts of the site function, including login persistence or saved preferences. Where the site works with third-party analytics or advertising partners, those partners may also set their own cookies subject to their respective privacy practices. A more detailed cookie policy, covering categories of cookies and retention periods, may be made available separately from this Privacy Policy.

Sharing of Data With Third Parties

Personal data is shared with third parties only where necessary to operate the platform or comply with legal obligations. This includes payment service providers and financial institutions that process deposits and withdrawals, including Interac-based transfers, card processors, and crypto payment infrastructure providers who screen blockchain transactions using analytics tools. Identity verification providers may also receive data submitted during know-your-customer checks in order to confirm a user’s identity and age.

Grailbet may share data with regulatory bodies or law enforcement where required by law, with professional advisors such as auditors where necessary for compliance, and with service providers who support technical operations such as hosting or game content delivery, including the certified game studios and providers that supply the platform’s casino and live casino content. Data is not sold to third parties for independent marketing purposes. Where information is shared with a processor acting on Grailbet’s behalf, that processor is expected to handle the data only for the purposes instructed and to apply appropriate security measures.

International Data Transfers

Because Grailbet works with payment providers, verification services, and technology partners that may operate outside Canada, personal data may be transferred to and processed in other jurisdictions. Where such transfers occur, reasonable steps are taken to ensure that the receiving party maintains an appropriate standard of protection for the data, consistent with the purposes described in this policy. Users who have concerns about international transfers can contact support for further information about the specific arrangements applicable to their account.

Data Retention

Personal data is retained for as long as necessary to fulfil the purposes described in this policy, including the duration of the account relationship and any additional period required to meet legal, tax, accounting, or anti-money-laundering obligations. Transaction records and identity verification documents are typically retained for a period after account closure to satisfy regulatory requirements, even where a user has requested account closure or self-exclusion. Once retention periods expire, data is either deleted or anonymized so that it can no longer be linked to an identifiable individual, except where further retention is legally required.

Security Measures

Grailbet applies technical and organizational measures designed to protect personal data against unauthorized access, loss, or misuse. These measures include encryption of data in transit using industry-standard protocols, restricted internal access to personal data based on role, and monitoring systems intended to detect unusual account activity. Crypto deposits are screened using blockchain analytics tools as an additional layer of protection against fraudulent or illicit transactions. While these measures are designed to provide a high standard of protection, no system can guarantee absolute security, and users are encouraged to take their own precautions, such as using strong, unique passwords and keeping login credentials confidential.

User Rights Over Personal Data

Users generally have rights in connection with the personal data held about them, which may include the right to request access to the data held, to request correction of inaccurate information, to request deletion of data where retention is no longer required by law, and to object to certain types of processing. Users who wish to exercise any of these rights, or who have questions about how their data is handled, can contact support through the channels available on the platform, including live chat and email, which operate on a continuous basis. Requests are reviewed on a case-by-case basis, taking into account any legal retention obligations that may limit immediate deletion, particularly where financial or identity records must be kept for compliance purposes.

Users also retain control over certain account-level settings connected to responsible gambling, such as deposit limits and self-exclusion, which are described further in the responsible gambling section below and in the platform’s dedicated responsible gaming information.

Responsible Gambling and Data Protection

Data protection and responsible gambling are connected in several practical ways. Account activity data, including deposit patterns and session length, may be used to support responsible gambling tools such as deposit limits, time-based reminders, or the identification of accounts that may benefit from a wellness check-in from support. This use of data is intended to support player protection rather than for marketing purposes. Players in Canada must be at least 19 years old to hold an account, or 18 in Alberta, Manitoba, and Quebec, and age verification data is treated with particular care given its role in preventing underage access. Anyone concerned about their gambling activity, or wishing to set limits or pursue self-exclusion, can contact support to discuss the tools available, which may include deposit limits, temporary account suspension, or full self-exclusion arrangements. Details of these protections are also addressed on the platform’s responsible gaming resource.

Children and Minors

Grailbet does not knowingly collect personal data from individuals under the applicable minimum legal gambling age in their province of residence. Age verification checks are part of the registration and know-your-customer process, and accounts suspected of belonging to an underage individual are subject to suspension pending verification. Parents or guardians who believe a minor has registered an account, or has otherwise accessed the platform, are encouraged to contact support so that appropriate action can be taken.

Marketing Communications

Where a user has agreed to receive marketing communications, such as updates about account features or platform changes, Grailbet may use contact details to send such communications through email or other channels. Users can opt out of marketing communications at any time, typically through a link included in the communication itself or by contacting support directly. Opting out of marketing does not affect essential account or transactional communications, such as messages related to deposits, withdrawals, or security notices, which remain necessary to operate the account.

Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in data handling practices, legal requirements, or the services offered on the platform. Where changes are made, the updated policy will be published on the site, and continued use of the account after such changes take effect will generally be treated as acceptance of the revised terms. Users are encouraged to review this policy periodically to stay informed about how their information is handled.

Contacting Grailbet About Privacy

Users with questions, concerns, or requests relating to this Privacy Policy, or to the handling of their personal data more generally, can reach out through the support channels available on the platform, including live chat and email support, which are available on a continuous basis. Support staff can assist with data access requests, correction requests, questions about cookies, or concerns about how information has been used, and will direct more complex requests to the appropriate internal team where necessary.