Privacy

Who we are

Quick Lotto (quicklotto.io) is a lottery betting site operated by QuickLotto. For anything on this page — a copy of your data, a correction, a deletion, or a question — write to [email protected] from your registered address.

What we collect, and why

Your account. Email address, phone number, username, first and last name, date of birth, country, and your chosen currency and language. Date of birth and country are not optional extras: this is an 18+ service and we have to be able to show that we checked.

How you signed in. We store a one-way hash of your password, never the password itself, and a hash of each session token rather than the token. A copy of our database taken by someone who should not have it does not let them sign in as you.

Your devices. For each sign-in we keep the IP address, the browser’s user-agent string, the country the sign-in came from and the time it was last used, plus the IP you registered from. The country is the one our network provider resolved at the moment you signed in — we do not send your address to any location-lookup service, then or later. This is what lets support answer “was that me?” and lets you see the list of sessions on your account.

Identity documents, if you send them. Images you upload for verification are stored in the same database as the rest of your account, with their review status and any note the reviewer wrote. They are not copied to a separate file store — a second place to keep documents is a second place to lose them.

What you agreed to. Your consents — that you are of age, the terms, and whether you want marketing email — are kept as an append-only history rather than a single current value, so the question “what had you agreed to when you placed that bet?” has an answer. Withdrawing a consent adds a record; it does not erase the earlier one.

Money and play. Deposits, withdrawals, every ledger entry, and every bet with its lines and outcome. These are the record of what we owe you and what you played, and they are the part of your data we are least able to delete on request — see retention below.

Usage. A small beacon records page paths and named events against your account, or anonymously when you are signed out. There is no third-party analytics service on this site: no Google Analytics, no advertising pixel, no cross-site tracker. The events go to our own database and nowhere else.

Email delivery. Our mail provider reports back when a message is delivered, opened, clicked, bounces or is marked as spam, and we keep those events against your address. Opens are measured with a tracking pixel, which is standard for email and which your mail client may already block.

Messages you send us. Support email is stored against your account so whoever answers can see the conversation.

What stays on your device

We set no advertising or tracking cookies. What we do set is small and functional: ql_locale remembers your language and display_country your display currency — both first-party, both simply your own choices written down. Your theme preference and whether you have seen the lottery tour are kept in your browser’s local storage and never sent to us.

A bet slip you are part-way through building is held in your browser’s session storage until you buy the ticket. If you close the tab, it is gone — we never saw it.

Your session is held as a bearer token rather than a cookie, which is why you will not see a cookie banner asking for consent we do not need.

Who else sees it

Payment providers, when you deposit or withdraw. They receive what a payment needs — amount, currency, a reference — and they hold their own record of the transaction under their own privacy terms.

Our email providers, who receive your address and the message in order to deliver it. We use separate senders for account email and marketing so that one has nothing to do with the other.

Nobody, in the case of the lottery results feeds. Worth stating plainly because it is the opposite of what people assume: we ask those services what numbers were drawn. They are never told that you exist, what you played, or that anyone bet on anything.

Our own team, through an internal alerting channel that reports registrations and payments so the site can be watched in real time. Email addresses in those alerts are masked (ab***@example.com) and the account is identified by an internal id, precisely because a chat channel is a weaker container than the back office.

We do not sell your data, and we do not share it for anyone else’s marketing.

Marketing

We only send marketing to people who have opted in, and every marketing email has an unsubscribe link that works without signing in. Account email — verification, receipts, a win notice, a change to your account — is not marketing and cannot be unsubscribed from while your account is open.

If you unsubscribe, your address goes on a permanent suppression list. That list exists specifically so a later import of a mailing list cannot resurrect you: an opt-out that a spreadsheet can undo is not an opt-out. Keeping your address for that purpose is the only way to reliably stop mailing it.

How long we keep it

Your account and its history are kept while the account is open, and after closure for as long as we are required to keep them. Financial records — deposits, withdrawals, ledger entries, settled bets — are the exception to almost everything else on this page: they are the accounting record, and deleting them on request is not something we can offer.

Gambling and anti-money-laundering rules usually impose a minimum retention period on exactly those records. We will tell you the applicable period when you ask about deletion rather than quoting a number here that may not be the one that governs your account.

What you can ask for

Write to [email protected] from your registered address and you can ask us to:

• send you a copy of the data we hold about you;
• correct anything that is wrong;
• delete your account and the data we are not required to keep — we will tell you specifically what has to stay and why;
• stop sending you marketing, which you can also do from any email;
• close or self-exclude your account, which we treat as urgent rather than as a request to be processed in turn.

You can see and end your own sessions, update your details and manage your marketing preference from your profile without asking anyone.

Security

Passwords are hashed, session tokens are stored only as hashes, the site is served over HTTPS, and identity documents live inside the same protected database as the rest of your account rather than in a public bucket. No system is perfect and we would rather say that than claim otherwise; if we ever have a breach that affects you, we will tell you.

Children

This service is for adults aged 18 and over. We do not knowingly hold data about anyone younger, and if we find that we have, we delete the account and refund the balance. See responsible gambling.

Changes

When this page changes materially we will say so on the site rather than editing quietly and relying on a date stamp nobody checks.