01 Who controls your data
ARIPLEX LIMITED, a private company limited by shares registered in Uganda, is the data controller. We process personal data under Uganda's Data Protection and Privacy Act, 2019 and the regulations made under it.
For any privacy question or request, write to info@ariplexug.com.
02 What we collect
Information you give us
- Phone number, email address, or Google account identifier.
- Your name, date of birth and national identification details, when identity verification is triggered.
- Your mobile money number, for deposits and withdrawals.
- Anything you send us in a support message.
Information created by your use of the service
- Duels you post and join, colours, stakes, outcomes and the cryptographic commitments and seeds attached to them.
- Deposits, withdrawals, fees and every ledger entry.
- Deposit and loss limits, and any self-exclusion you set.
Information collected automatically
- IP address, device and browser characteristics, and session timestamps.
- A device fingerprint used to detect multiple accounts and collusion.
We do not store passwords, because the service does not use them. We never see or store your mobile money PIN — that is entered on your handset with your provider, never on our site.
03 Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Operating your account and settling duels | Contract |
| Processing deposits and withdrawals | Contract |
| Age and identity verification | Legal obligation |
| Anti-money-laundering monitoring and reporting | Legal obligation |
| Detecting fraud, collusion and multiple accounts | Legitimate interest |
| Enforcing responsible gaming limits | Legal obligation |
| Security, rate limiting and abuse prevention | Legitimate interest |
| Marketing messages | Consent |
Marketing is the only purpose that relies on consent, and you can withdraw it at any time without affecting your account. Everything else is either necessary to run the service you asked for, or required of us by law.
05 What other players can see
The public lobby and results feed show a display handle, the stake, the commitment and the outcome of a duel. They do not show your name, phone number, email address, balance or transaction history.
Settled duels publish the game identifier, the revealed colour and the revealed seed, because that is what makes independent verification possible. None of those values identify you.
06 How long we keep it
| Data | Retained |
|---|---|
| Account and identity records | 7 years after closure |
| Financial and ledger records | 7 years |
| Duel and fairness records | 7 years |
| Self-exclusion records | Indefinitely |
| Session and security logs | 12 months |
| Support correspondence | 3 years |
Seven years reflects the retention period expected of a licensed operator and accountable person. Self-exclusion records are kept indefinitely for one reason: so that a self-exclusion cannot be escaped by deleting an account and starting again.
07 Your rights
- Access — request a copy of the personal data we hold about you.
- Correction — have inaccurate data corrected.
- Erasure — have data deleted where we have no lawful reason to keep it.
- Objection — object to processing based on legitimate interest.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — stop marketing at any time.
- Complain — to the Personal Data Protection Office of Uganda.
Write to info@ariplexug.com. We respond within 30 days and do not charge for a reasonable request.
Erasure has limits we cannot waive. Financial, gaming and anti-money-laundering records must be retained for their statutory period even after you ask us to delete your account, and self-exclusion records are never deleted. We will always tell you exactly what we kept and why.
08 How we protect it
- Encrypted in transit and at rest.
- Session tokens stored hashed, never in a form that could be replayed if the database were read.
- Least-privilege database access; administrative actions require a passkey and are individually audited.
- Rate limiting on authentication, one-time codes and withdrawals.
- Nightly encrypted backups with a tested restore procedure.
If a breach occurs that is likely to affect your rights, we will notify you and the Personal Data Protection Office without undue delay.
10 Children
This service is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we discover that we have, we delete it and close the account, retaining only what the law requires us to keep about the closure itself.