Slotornado Casino Privacy Policy

Scope of This Privacy Policy

This policy explains how Slotornado collects, uses, stores and protects personal information connected to slotornado1.casino. It covers visitors who browse the site, people who open an account, and account holders who deposit, play or request a withdrawal. It applies to information gathered through our pages, the cashier, account settings, support conversations and any communication sent on our behalf.

We have written it to sit alongside the terms and conditions, not to replace them. Where a specific feature carries its own notice, that notice adds detail for that feature, and the more specific wording governs on that point. Canadian privacy law, at both the federal and provincial level for the private sector, shapes the principles we follow: collect for an identified purpose, limit collection to what is needed, keep information accurate, and protect it with safeguards suited to its sensitivity.

A few limits on scope are worth stating plainly. Real-money play is not open in every province or territory, and some only allow it through authorised operators, so an account may be refused or restricted based on location. Information collected during that assessment is still covered here. Pages from other websites reached through a browser, even when opened from our site, follow their own policies. Nothing in this document promises a gaming outcome. Casino games carry a house edge, results swing widely in the short term, and personal information is never used to suggest otherwise.

Categories of Personal Information

Most of what we hold falls into a handful of groups, and the group matters because each one is handled with a different level of care. A browsing visitor leaves only a thin technical trail. An account holder who has deposited and passed verification has a far fuller record, and that record is treated as sensitive from the moment it exists.

• Contact and profile details, such as name, date of birth, postal address and the contact details entered at sign-up.
• Identity and eligibility records, including documents supplied for age and identity checks.
• Financial and transaction data, covering deposits, withdrawals, balances and payment method references.
• Technical and device data, such as IP address, browser type, approximate location and session logs.
• Gameplay and account activity, including games opened, bets placed, promotions accepted and limits set.
• Correspondence with our support team, kept so a later question can be answered with the full history in view.

We do not ask for information that has no clear use. If a form field looks unnecessary, that is a fair question to raise with us, and we would rather explain or remove it than keep collecting by habit. Some categories overlap in practice. A withdrawal request, for instance, touches identity, payment and device data at once, which is why a single action can trigger more than one check.

Information about health, beliefs or similar sensitive matters is not something we seek. If an account holder volunteers it, for example while explaining why a break from play is needed, it is used only for that request and handled with extra restraint.

Account Registration Information

Opening an account requires a short set of details: full legal name, date of birth, residential address, a username, a password and working contact details. The province or territory of residence is also recorded, since it decides whether real-money play can be offered at all and which age threshold applies. Account currency is set in Canadian dollars where that option is shown.

Each field has a job. The name and date of birth must match later identity documents. The address supports both location checks and fraud prevention. Contact details let us send security notices, confirm changes and reply to support requests. Passwords are stored in a protected, hashed form, so our staff cannot read them and will never ask for one.

The most common problem we see at this stage is small and avoidable. A nickname typed instead of a legal name, a former address, or a mistyped birth year can stall the first withdrawal weeks later, when verification fails to match. Entering details exactly as they appear on government identification saves a great deal of back and forth. Registering on behalf of someone else, or holding more than one account, is not permitted and usually leads to closure once detected.

Registration itself does not activate any offer, unlock every game or confirm that play is lawful from a given location. Those questions are settled separately, under the rules shown at the time, and the information gathered at sign-up simply makes those later checks possible.

Identity and Eligibility Information

Before an account can move money freely, we need reasonable confidence about who is behind it and whether that person may play. Age is the first gate. The minimum is 19 in most provinces and territories, and 18 in Alberta, Manitoba and Quebec. Location is the second, because real-money gambling is only available in some places through authorised operators, and an account opened elsewhere may be limited or closed.

To confirm these points we may request a photo of government-issued identification, a recent document showing the residential address, and occasionally proof that a payment method belongs to the account holder. In some cases a selfie or short liveness check is used to match a face to a document. Requests are tied to a reason, such as a first withdrawal, a change of address or unusual activity, rather than sent at random.

We handle these files with particular care. Access inside our team is restricted to staff who perform verification, uploads travel over encrypted connections, and the documents are not used for marketing in any way. A clear, uncropped image with all four corners visible is usually accepted on the first attempt. Blurred or edited images are the main reason checks take longer than expected.

Passing verification once does not mean it will never be repeated. A significant change to the account, a new payment method or a legal requirement can prompt a fresh request.

Payment and Transaction Information

Every deposit, wager, win, bonus credit and withdrawal leaves a record on the account. We keep that ledger because balances must be accurate, disputes must be resolvable, and financial crime rules require a reliable trail. The record shows amounts in Canadian dollars where that is the account currency, along with timestamps, the method used and the status of each transaction.

Full card numbers and banking credentials are processed by specialist payment partners rather than stored openly on our systems. What we retain is enough to recognize a method, such as a partial number or a reference token, and to return funds to the same source where the rules call for it. Methods offered, and any conditions attached to them, are those shown in the cashier at the time of the transaction.

A situation we see more often than we would like: a player deposits with a family member's card, then cannot withdraw because the name on the method does not match the account. Using only payment methods held in the account holder's own name avoids that problem entirely. Our withdrawal guide explains the checks that apply before funds are released.

Transaction data is also reviewed for patterns that may point to fraud, misuse of promotions or play that has become harmful. Such reviews can lead to a hold, a request for documents or a conversation with our team. None of this implies that a payment will be processed within a particular time, and none of it changes the house edge on any game.

Technical and Device Information

Any connection to slotornado1.casino exchanges some technical data, whether or not an account exists. Servers log the IP address, browser and operating system, screen size, language setting, referring page and the time of each request. When an account holder signs in, the session is linked to that account so activity can be traced and secured.

The IP address does more work than most people assume. It gives an approximate location, which helps us decide whether real-money features can be shown in that province or territory. It also flags sign-ins from unfamiliar places, which may prompt an extra confirmation step. A virtual private network or proxy that hides the true location can therefore cause a refused login or a frozen account, because the location check cannot be satisfied honestly.

Device information also supports fraud controls. A cluster of new accounts created from one device, or a single account suddenly accessed from several, is the kind of pattern we investigate. This does not mean every shared household device is suspect. Context matters, and our team looks at the full picture before acting.

On mobile, the same principles apply whether play happens in a browser or through our app. Device permissions, such as notifications, are requested only where a feature needs them and can be withdrawn in the device settings. We do not read contacts, photos or messages stored on a phone, and nothing technical we collect is sold to anyone.

Website Usage and Cookies

Beyond raw server logs, we look at how pages are actually used. Which sections are opened, where visitors leave a form unfinished, how long a game lobby takes to load, which help articles answer a question and which ones send people straight to support. This sort of measurement is mostly aggregated, and it is how a confusing page gets rewritten rather than left in place.

Cookies and similar technologies make much of this possible. Some are essential: they keep a session signed in, remember a chosen language, hold items in the cashier flow and support security checks. Without them the site would not function properly. Others are optional and help with performance measurement or with understanding which campaigns brought a visitor to us.

We draw a firm line between those two groups. Essential cookies are set because the service depends on them. Optional ones are placed only where consent has been given, or where the applicable rules permit them on another clear basis, and they can be declined without losing access to the core site. A browsing visitor who declines measurement cookies can still read every page, open an account and play where permitted.

Usage data is never treated as a prediction of results. Seeing that a player favours a particular game type does not give us any insight into future outcomes, and it is not used to suggest that one title is due to pay. Practical controls for cookies are set out further down this page.

Purposes of Processing

Collecting information without a reason is something we try hard to avoid, so it helps to set the reasons out in one place. Each item below explains why a piece of data is held, and data gathered for one purpose is not quietly reused for an unrelated one without a fresh notice or consent where that is required.

• Running the account: registration, sign-in, balances, game access and customer support.
• Meeting legal duties: age and identity checks, location assessment, record keeping and reporting where the law demands it.
• Preventing harm: spotting fraud, account takeover, promotion abuse and signs that gambling has stopped being recreational.
• Improving the service: fixing errors, speeding up pages and clarifying wording that confuses players.
• Communicating: security notices, changes to terms and, only with permission, promotional messages.

Some of these purposes rely on consent, which can be withdrawn. Others exist because the account could not operate without them, or because a law requires them, and those cannot be switched off while the account remains open. We think it is fairer to say that openly than to imply every use is optional.

Automated tools assist with some of this work, for example by flagging a transaction for review or estimating whether a pattern of play looks risky. A flag is a prompt for human attention, not a final decision. Where an automated signal leads to a restriction, our team can explain the outcome and review it on request. We do not use any purpose on this list to forecast or influence the result of a game, which always carries a house edge.

Legal and Regulatory Obligations

A gambling business is not free to decide alone what it collects or how long it keeps it. Anti-money laundering rules, tax requirements, consumer protection law and provincial gaming rules all set expectations, and several of them override a preference to hold less. Canadian privacy law adds its own duties on top, including accountability for information handed to partners and a requirement to report certain breaches.

In practice this means we sometimes ask for documents that feel excessive to an account holder who has done nothing wrong. A source of funds question after a run of large deposits is a typical example. It is not an accusation. It is a check the law expects us to make, and the information supplied is used for that check rather than for profiling or marketing.

We may also have to disclose information to public authorities when compelled by a valid legal process, such as a court order or a lawful demand from a competent body. Each request is reviewed before anything is released, and disclosure is limited to what the request actually requires. Where the law allows us to tell the account holder about it, we do.

Because rules differ between provinces and territories, the obligations attached to one account may not match those attached to another. Location affects which checks apply, which features can be offered, and in some places whether real-money play is available at all. When a legal duty and a privacy preference conflict, the legal duty prevails, and we explain that where we can.

Account Protection and Security

Security is a shared job, though most of the weight sits with us. Connections to the site are encrypted, stored data is protected with technical and physical safeguards, staff access is limited by role and logged, and our systems are monitored for unusual behaviour. Sensitive files, such as identity documents, sit behind tighter controls than routine records.

No system can be described honestly as impossible to breach. If a security incident affects personal information and creates a real risk of significant harm, we will notify the people concerned and the appropriate authorities as Canadian privacy law requires, and explain what happened and what is being done about it.

What Account Holders Can Do

The weakest point is often the password. One reused across several websites is the usual way accounts are taken over, and no amount of server-side protection fully offsets that. A unique password, a locked device and signing out on shared computers make a real difference. Our staff will never ask for a password by message or phone, and any request that does should be treated as fraud.

When something looks wrong, such as an unfamiliar login notice or a changed contact detail, the safest step is to secure the account first and contact our team straight after. We may temporarily lock an account ourselves when activity suggests someone else has access. That can be frustrating, but it is far easier to unlock a protected account than to recover a drained one.

Sharing With Service Providers

Running a casino site involves more specialists than most players imagine. Hosting, payment processing, identity verification, fraud screening, customer support software, email delivery and game delivery are often handled by outside providers working under contract with Slotornado. Each of them receives only the information its task requires.

How Those Arrangements Are Controlled

We remain accountable for personal information passed to a provider for processing on our behalf. Contracts limit what each provider may do with the data, require safeguards comparable to our own, prohibit use for its own marketing and require prompt notice of any breach. Providers are chosen with privacy and security in mind, and the arrangement is reviewed when the service changes.

A verification partner, for example, sees the identity document and the details needed to check it, not the account's game history. A game supplier receives what is needed to run a session and settle bets, not the player's home address. Keeping each slice narrow means a problem at one provider exposes far less.

Information may also move as part of a business change, such as a merger or sale of assets, under conditions that continue to protect it. Beyond these cases, we do not sell personal information, and we do not hand account data to advertisers to target individuals. If our sharing practices change in a meaningful way, this policy will be updated before the change takes effect, with notice to account holders where the change affects them.

International Data Transfers

Although our service is aimed at players in Canada, the systems behind it are not confined to one country. Some providers that host data, process payments or handle verification operate servers or support teams in other jurisdictions. Personal information may therefore be stored or accessed outside the province or territory where the account holder lives, and in some cases outside Canada.

When information leaves Canada it becomes subject to the laws of the place where it is held. Courts, police or national security bodies in that country may, in certain circumstances, be able to obtain access under their own legal rules. We think it is better to state that clearly than to bury it, because it is a genuine consequence of using international infrastructure.

Moving data abroad does not mean it loses protection. Before using a provider outside Canada, we look at its security practices and put contract terms in place that require a comparable level of protection to the one we apply ourselves. Data is transferred over encrypted channels, and only the information needed for the task is sent. Where provincial privacy law sets additional expectations for transfers out of the province, such as assessing the risk in advance, those expectations are built into our process.

Anyone who wants to know more about where a particular category of their information is processed can ask our team. We may not be able to name every provider for security or contractual reasons, but we will explain the general location and the safeguards in place.

Retention and Deletion

Keeping information forever is a risk, not a convenience. Each category of data has a retention period tied to the reason it was collected, and when that reason ends, the data is deleted, anonymized or securely archived until any remaining legal duty expires.

The difficulty for a gambling business is that several of those duties run well past the end of an account. Financial crime rules and tax requirements can require transaction and identity records to be kept for a set number of years after closure. Records related to self-exclusion are often kept longer still, because their whole purpose is to stop a returning account from being opened during an exclusion period. Deleting them early would defeat a protection the account holder chose.

Closing an account therefore does not erase everything at once. Marketing preferences stop applying immediately, access ends, and data held purely for convenience is removed. Data that must be kept by law is restricted, so it is no longer used for ordinary operations, and is then destroyed when the period runs out.

Deletion requests are taken seriously and handled case by case. Where we can delete, we do. Where a legal requirement prevents it, we say which requirement applies and when deletion will become possible, rather than offering a vague refusal. Backups follow the same schedule and are overwritten on a regular cycle.

Privacy Choices and Requests

Canadian privacy law gives individuals real say over their personal information, and we would rather make those choices easy to use than hide them. Several controls sit directly in the account settings. Others need a written request, mainly because they involve identity checks or records that cannot be changed with a single click.

The choices available to an account holder include:

• Withdrawing consent for optional uses, such as promotional messages or measurement cookies.
• Asking what information we hold and how it has been used or shared.
• Requesting correction of details that are wrong or out of date.
• Asking for deletion, subject to the legal retention duties explained elsewhere on this page.
• Raising a concern about how a request was handled.

Requests can be sent through the channels on our contact page. Before acting on one, we confirm the identity of the person asking, since releasing account data to the wrong individual would be a serious breach in itself. A request from a third party, such as a relative, needs proof of authority to act for the account holder.

Withdrawing consent has consequences that should be understood in advance. Declining promotional messages simply stops them. Withdrawing consent to information the service depends on, such as identity data, may mean the account can no longer operate. We explain any such effect before the change is made. If a response from us seems unsatisfactory, the matter can be escalated internally and, after that, raised with the privacy oversight body that applies in the relevant province or at the federal level.

Access and Correction Requests

Any account holder may ask to see the personal information we hold about them. A useful request names what is wanted: a full copy, or something narrower such as transaction history for a certain period, verification records, or the notes attached to a support case. Narrow requests are usually answered faster and are easier to read.

Our response sets out the information itself, how it has been used, and the types of organizations it has been disclosed to. Some material may be withheld where the law allows or requires it, for instance where release would reveal another person's information, interfere with a fraud investigation or breach legal privilege. When something is held back, we say so and explain the general reason.

Correction works a little differently. Some details, such as a contact preference, can be updated directly in the account. Others, including legal name, date of birth and residential address, are tied to verification and need supporting documents before they change. That friction is deliberate. A quick name change with no evidence is one of the classic signs of account takeover.

If we disagree that a record is inaccurate, the account holder's view can be attached to it so that anyone reviewing the file sees both positions. Where a correction is made, it is passed on to providers who received the old information, where that is relevant and practical. Access requests are generally handled without charge. Anyone who suspects an error in their balance or play history should raise it promptly, while the supporting logs are easiest to trace.

Marketing Preferences

Promotional messages are sent only to account holders who have agreed to receive them, and that agreement is separate from accepting the terms of the account. Saying no at registration does not limit access to games, the cashier or support. Saying yes can be undone at any time through the account settings or the unsubscribe option included in every promotional message.

Service messages are a different matter. Security alerts, confirmations of withdrawals, notices of changes to terms and responses to support requests are sent regardless of marketing choices, because the account cannot be run safely without them. We keep these messages free of promotional content so the distinction stays clear.

Our own rule goes further than the minimum. When an account holder sets deposit limits, takes a break, or self-excludes, promotional messaging is suspended for the duration, even if consent was given earlier. Sending offers to someone who has just said they need distance from gambling would be indefensible. The tools for those choices are described on our responsible gambling page.

Any offer that does arrive is subject to the terms displayed at the time, and a message describing a promotion does not by itself enrol anyone in it. Promotions do not change the house edge or improve the odds of a win, and we avoid wording that implies they do.

Cookies and Browser Controls

Cookie choices are managed in two places. Our consent banner and preference panel allow optional categories, such as analytics and campaign measurement, to be accepted or refused, and the panel can be reopened later from the site footer to change an earlier decision. Separately, every mainstream browser offers its own settings for blocking, limiting or clearing cookies.

Each route has trade-offs worth understanding. Refusing optional cookies in our panel has no effect on core features. Blocking all cookies at the browser level is stronger but blunter: it can break sign-in, reset language settings on every visit and interrupt the cashier, because essential cookies are blocked along with the rest. A middle path, allowing first-party cookies while blocking third-party ones, keeps the site working for most people while limiting tracking across other websites.

Clearing cookies removes the record of earlier choices, so the consent banner will appear again on the next visit. That is expected behaviour, not an error. Private or incognito browsing works in a similar way, discarding cookies when the window closes. Mobile browsers and the app each hold their own settings, and a choice made on a laptop does not carry over to a phone automatically.

Some browsers send a signal asking websites not to track. Where a recognized standard for such a signal applies, we honour it for optional tracking. Device advertising identifiers on phones can also be reset or limited in the operating system settings. None of these controls affect the legal records we must keep for an account.

Changes to This Policy

Privacy practices change as systems, providers and laws change, and this document will be revised to keep pace with them. A policy that describes how things worked two years ago is worse than useless, because it gives false comfort. We review the text regularly and update it whenever our handling of information changes in a way that matters.

Minor edits, such as clearer wording, corrected links or reorganized headings, are published with an updated revision date at the top of the page. More significant changes are handled with greater care. If we plan to collect a new category of information, use existing data for a purpose not described here, or share it with a new type of recipient, account holders will be told in advance through a notice on the site or a message to the account. Where the change requires fresh consent under Canadian privacy law, it will not apply to that person until consent is given.

We do not apply a significant change retroactively to information collected under an earlier version without proper notice. Data gathered before the update continues to be handled under the terms that applied when it was collected, unless the law requires otherwise or consent for the new use has been obtained.

Anyone who has not visited for a while should check the revision date before relying on a detail they remember. Questions about a particular change, or about how it affects an existing account, can be raised with our team.