Privacy Policy
This Privacy Policy describes how mega-bonanza.us.com ("Site," "we," "us") collects, uses, and protects information that visitors provide when using this website. This Site is an independent affiliate review platform and is not affiliated with Mega Bonanza Casino or its operators.
1. Information We Collect
We collect information in two ways:
- Information you provide: If you contact us via email or any contact form, we collect your name and email address.
- Automatically collected information: We use standard web analytics to collect anonymous usage data, including pages visited, time on site, browser type, and geographic region (country-level). This data does not identify you personally.
2. Cookies
This Site uses cookies for analytics purposes only (Google Analytics or equivalent). These cookies do not store personally identifiable information. You can disable cookies in your browser settings at any time without affecting your ability to use this Site.
3. Affiliate Links
This Site contains affiliate links to third-party casino platforms. When you click these links
and register on third-party platforms, those platforms may set their own cookies and collect
data subject to their own privacy policies. We are not responsible for third-party data
practices. Affiliate links are marked with rel="sponsored" in the HTML.
4. Data Use
We use data solely to understand how visitors use this Site and to improve content quality. We do not sell, rent, or share personal data with third parties for marketing purposes.
5. Data Storage
This is a static informational website and does not maintain a user database or account system. Any contact form submissions are stored in our email system and retained for up to 12 months.
6. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, or delete personal data we hold about you. To exercise these rights, email us at: [email protected].
7. Children
This Site is directed at adults aged 18 and older. We do not knowingly collect data from children under 18.
8. Contact
For privacy-related inquiries: [email protected]
Exactly What This Site Stores and Why
The privacy summary above is the headline. The detail below is the contract.
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account identifiers | Email, username | Authentication | Account life + 30 days |
| Verification data | ID image, address proof | KYC compliance | 5 years per US AML rules |
| Behavioural data | Session length, game choice | Product improvement | 13 months |
| Transaction data | Coin purchases, redemptions | Tax + audit | 7 years per IRS |
| Device data | OS, browser, IP | Fraud detection | 13 months |
| Communication data | Support chat logs | Service quality | 24 months |
| Marketing data | Open/click rates | Promo optimisation | 13 months (opt-out anytime) |
Who Else Sees Your Data
This affiliate review site does not directly process payments, run KYC checks, or store identity documents. Instead, when you click an outbound link to Mega Bonanza, the operator inherits the relationship and applies their own privacy policy. We share aggregate, non-identifying analytics with the operator under our affiliate agreement — for example, how many readers clicked the welcome-bonus CTA, the percentage that signed up, and average session-engagement time on this site. None of this includes your email address, IP address or any persistent identifier.
Our own third-party processors are limited and listed below. Each has a current Data Processing Agreement that constrains their use of any data we provide. We do not sell data to third parties under any circumstance. The list below changes infrequently; the "last reviewed" date at the foot of this page reflects the most recent vendor audit.
- Cloudflare — DDoS protection, edge caching. Sees aggregated IP. Retention: 7 days.
- Google Fonts — Outfit and Bebas Neue font delivery. No cookies set; IP processed in transit only.
- Chart.js CDN (jsDelivr) — Chart library delivery. No cookies; IP processed in transit only.
- Plausible Analytics — Cookie-free aggregate analytics. No personal identifiers stored.
For the operator-side data flow that begins after you sign up, see the Mega Bonanza-published privacy policy linked from inside the player account. Our role ends at the moment you click through. The state-by-state data treatment in our jurisdictional reference summarise how state-level consumer-protection rules overlay the operator's policy.
How to Exercise Your Privacy Rights
You have the right to request access to any personal data we hold about you, ask for corrections, request deletion (subject to legal retention obligations), and opt out of any non-essential processing. To exercise any of these rights, email the address listed at the foot of this page from the email address associated with your interaction history. We respond within 30 calendar days; complex requests can extend by an additional 30 days, in which case we will notify you of the delay and the reason.
Several state laws — California's CCPA/CPRA, Virginia's VCDPA, Colorado's CPA, and a growing list of similar statutes — grant additional rights to residents of those states. The headline addition: residents can request a list of categories of personal information sold or shared with third parties in the past 12 months. Because we do not sell data, this list will be empty. We honour all such requests regardless of the requester's state of residence to keep policy administration simple.
Cookie use is minimal. We set a single first-party cookie to remember your dark/light preference (we currently ship a dark-only theme but the cookie infrastructure exists). We do not set tracking cookies; we do not use third-party advertising cookies; we do not participate in cross-site retargeting networks. The cookie banner you may see in the EU or UK is provided by Cloudflare's edge and is configurable from there.
Minors, Breach Notification and Updates to This Policy
This site is intended for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18, and we comply with the US Children's Online Privacy Protection Act (COPPA). If a parent or guardian discovers that a child under 13 has provided personal information through this site, please email us; we will delete the data and disable any associated account within 7 days.
In the unlikely event of a data breach affecting personal information, we will notify affected users within 72 hours of confirming the breach, the data categories implicated, the likely cause and the steps we are taking to mitigate impact. Where state law requires notification to a state attorney general's office, we will file the required reports within the statutory window. We have not had a notifiable breach to date.
This privacy policy is reviewed at least quarterly. Material changes are flagged at the top of the page for 30 days following the revision, and registered users receive an email summary of the changes. For deeper context on how the legal sweepstakes framework interacts with privacy obligations, see the state attorney-general links in our jurisdictional reference. For everyday platform usage, the Mega Bonanza review hub home aggregates current data on every public-facing operator change.
What Happens When You Submit a Data Request
A data-subject access request lands in our queue within seconds of submission. The first step is identity verification: we confirm the request is coming from the data subject (not someone impersonating them) by matching the requester's email to the account record and, where the request is unusually broad, asking for a secondary identifier. Identity verification typically takes 24 hours and never longer than 72 hours. Once identity is confirmed, the technical export runs against the database categories described in the table above; the export is delivered via secure download link valid for 7 days, after which the file is deleted from the staging system.
Deletion requests follow a different flow. We delete account-identifying data immediately on confirmed request, but verification data (KYC documents) and transaction data are retained for the statutory period regardless of deletion request — federal AML rules and IRS tax rules override the deletion right for those categories. The retention table above documents the period for each category. Where we cannot fully comply with a deletion request because of legal retention, we explain the specific obligation in writing and document the partial fulfilment.
Correction requests are the simplest. Submit the change you want made and the supporting evidence (e.g., a recent utility bill for an address change); we update the record within 7 days. For complex corrections — for example, where a third-party data source disagrees with our record — we may need to coordinate with the third party, which can extend the timeline to 30 days. Our cross-state privacy overlay reference notes the state-specific rights that grant additional remedies in California, Virginia, Colorado and a growing list of states.
International Data Transfers
The Site is hosted in the United States. Most processing happens in US data centres, which is also where the majority of Site users are based. Where data crosses an international border — for example, Cloudflare's global edge network may process traffic in the user's nearest region — the transfer is governed by standard contractual clauses appropriate to the destination region. We do not transfer personal data to jurisdictions without an adequate data-protection framework as defined under widely-used privacy benchmarks.
For users outside the United States, two additional notes. First, the affiliate review service is targeted at US-resident sweepstakes players; outside the US, the Operator may not accept your registration regardless of any data interaction with this Site. Second, your home jurisdiction's data-protection rules may apply in addition to US rules; we honour those rights to the same standard we honour US-equivalent rights, even where local enforcement is uncertain. Submitting a data request from any jurisdiction is processed the same way.
Privacy Vocabulary You Will See
Personal data — any information relating to an identifiable individual, including obvious identifiers (name, email) and quasi-identifiers (device ID, IP address). Processing — any operation performed on personal data, from storage to display to deletion. Controller — the entity that decides why and how personal data is processed; this Site is the controller for the data described above. Processor — an entity that processes data on behalf of the controller (e.g., Cloudflare for caching). Data subject — the human to whom personal data relates; you, the reader. Subject rights request — your formal request to access, correct, delete or restrict processing of your data. Legal basis — the law that permits the processing; for this Site, primarily legitimate interest in operating an editorial publication and consent for analytics and marketing where required. Data minimisation — the principle of collecting only what is necessary for the stated purpose; this Site applies it as a design constraint. Pseudonymisation — replacing direct identifiers with reversible tokens; useful for analytics datasets we share with third parties or academic collaborators. Anonymisation — irreversible removal of identifying signals; used for any data we publish or release outside our own systems.
The scope of this policy is the affiliate review site only — the moment you click an outbound link to the Operator, the Operator's privacy policy governs your relationship with the platform. For the Operator-side legal framework that shapes consumer protections including data handling, see our state privacy law catalogue reference.