Aa28 handles your personal data with full transparency and in compliance with the LGPD. Here you will find exactly what information we collect, how we use it, how we protect it, and what rights you have as a data subject.
Six concrete commitments that guide data handling at aa28 — not vague promises, but real practices
All data transmitted between your device and aa28's servers is protected by 256-bit SSL encryption — the same standard used by major Brazilian banks such as Itaú and Bradesco. This covers registration, login, Pix deposits, withdrawals, and every other interaction with the platform.
Aa28 operates in full compliance with the Lei Geral de Proteção de Dados (Law No. 13.709/2018). This means that the entire lifecycle of your data — collection, storage, use, and deletion — follows the legal bases and principles established by the LGPD, under the oversight of our Data Protection Officer (DPO).
Aa28 does not sell, rent, or trade your personal data with third parties under any circumstances. Technical partners who access operational data do so under strict confidentiality agreements and only for specific functions required to operate the platform.
Aa28 collects only the data strictly necessary to operate your account, process payments via Pix or boleto, and fulfill legal obligations. We do not ask for information we do not need. The principle of data minimization has been at the core of our collection model from day one.
You have the right to access, correct, export, or delete your data at any time, in accordance with the LGPD. To exercise any of these rights, simply send an email to suporte@aa28.best — our Brazilian team will respond within 5 business days with the requested information or confirmation of the action taken.
You decide which communications you want to receive from aa28. Promotional emails about bonuses, Brasileirão tips, and new games can be canceled at any time in your account settings or via the unsubscribe link included in every email. Essential operational communications (withdrawal confirmation, account security) cannot be disabled.
This Privacy Policy describes how aa28 collects, uses, stores, and protects the personal data of aa28.best platform users. By creating an account or using any aa28 service, you confirm that you have read and understood the practices described in this document. This policy was drafted in compliance with the Lei Geral de Proteção de Dados — LGPD (Law No. 13.709/2018).
The aa28, accessible at aa28.best, is the controller of the personal data collected and processed in connection with Sports Betting, Live Casino, crash games, roulette, and all other products offered by the platform. Under the LGPD framework, aa28 is the "controller" — the entity that decides which data to collect, for what purpose, and how it is used.
To exercise your rights as a data subject or for any questions related to this policy, please contact us at suporte@aa28.best. Our Data Protection Officer (DPO) is responsible for ensuring ongoing LGPD compliance and for responding to data subject requests within the legally required timeframes.
The aa28 collects personal data in the following categories, based on the requirements of each stage of the user relationship:
| Category | Data Collected | Collection Moment |
|---|---|---|
| Identification | Full name, CPF, date of birth, nationality | Platform registration |
| Contact | Email, mobile number | Registration and verification |
| Address | ZIP code, street address, city, state | Registration and KYC verification |
| Documents | National ID, driver's license, or passport; proof of address | Identity verification (KYC) |
| Financial | Pix key, bank details for wire transfers, deposit and withdrawal history | Financial transactions |
| Behavior | Betting history, games played, access frequency, preferences | Ongoing platform use |
| Technical | IP address, device type, browser, operating system, session cookies | Platform access |
Aa28 does not collect data in sensitive categories such as racial origin, political opinions, health data, biometrics, or religious beliefs, unless expressly required by law or sector-specific regulation.
The personal data collected by aa28 are used exclusively for the following purposes:
The aa28 processes personal data on the basis of the following legal grounds set out in article 7 of the LGPD:
Withdrawing consent for promotional communications does not affect the processing of data required to operate your account, handle Pix deposits and withdrawals, or meet legal obligations — those legal bases do not depend on consent.
The aa28 does not sell, rent, or otherwise commercialize users' personal data. Data is shared with third parties only in the following situations, each with a clear legal basis:
In all cases of sharing with technical partners, aa28 contractually requires that data be handled with confidentiality, used solely for the agreed purpose, and deleted upon completion of the service.
The aa28 uses cookies and similar technologies to ensure the platform functions properly and to improve the user experience. The types of cookies used are:
You can manage your cookie preferences in your browser settings. Disabling essential cookies may prevent certain platform features from working correctly, such as login and bet processing.
The aa28 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or destruction. Key safeguards include:
In the event of a security incident that may affect your personal data, the aa28 will notify the National Data Protection Authority (ANPD) and affected data subjects within the timeframe established by the LGPD, providing details on the nature of the incident and the measures taken to mitigate the risks.
If you suspect unauthorized access to your aa28 account, change your password immediately and contact support via live chat. Our Brazilian team is available 24 hours a day to help protect your account.
The aa28 retains personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal and regulatory obligations:
Once the applicable retention periods expire, data is securely and irreversibly deleted. You may request early deletion of specific data when there is no legal basis for its continued retention, as described in the Data Subject Rights section.
The LGPD grants the personal data subject the following rights, all of which can be exercised directly with the aa28:
Request confirmation that your data is being processed and obtain a complete copy of the information aa28 holds about you.
Request the correction of incomplete, inaccurate, or outdated data — such as your name, email, or address.
Request the anonymization or deletion of data processed on the basis of consent, when the account is closed and no other legal basis for retention applies.
Receive your personal data in a structured, machine-readable format for transfer to another data controller.
Withdraw consent for promotional communications at any time, with no penalty to your use of the platform.
Object to processing based on legitimate interest when it conflicts with your rights and reasonable expectations.
To exercise any of these rights, send an email to suporte@aa28.best with the subject line "LGPD Rights" and a description of your request. aa28 will respond within 15 calendar days with the requested information or confirmation of the action taken. Requests requiring identity verification may require additional documentation.
Due to the global nature of some technical infrastructure services used by aa28, data may occasionally be processed on servers located outside Brazil. In such cases, aa28 ensures that:
The aa28 is a platform exclusively for users aged 18 and over. Registration requires a date of birth and a valid CPF — the platform automatically verifies age during the sign-up process. Identity verification (KYC) strengthens this control by requiring photo ID.
Aa28 does not intentionally collect personal data from individuals under 18. If we become aware that an account was created by a minor, it will be closed immediately and the associated data will be deleted, unless there is a legal retention obligation. If you believe a minor may have accessed your account, contact support immediately via live chat.
The aa28 may update this Privacy Policy periodically to reflect changes in data handling practices, new legal requirements, or improvements to the products and services offered. Material changes will be communicated by email to the registered address at least 15 days in advance.
The current version of the policy is always available at aa28.best/privacy-policy, with the date of the last update clearly indicated at the top of the document. Continued use of the platform after the effective date of any new terms constitutes acceptance of the changes. If you do not agree with a change, you may close your account and request deletion of your data before the effective date.
To exercise your rights as a data subject, clarify questions about this policy, or report any privacy concern, the official contact channel of the aa28 is:
Our Data Protection Officer (DPO) is the designated point of contact for all LGPD-related matters. Requests addressed to the DPO will be responded to within a maximum of 15 calendar days.
If you are not satisfied with aa28's response to a rights request, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), as provided for in art. 55-J of the LGPD. The ANPD can be reached through the portal gov.br/anpd.
The LGPD gives you real rights over your data. At aa28, you can exercise them simply and without red tape
Send an email to suporte@aa28.best with the subject line "Access to my data". aa28 will deliver a full report within 15 days.
Account details such as your name or address can be corrected by our support team via chat or email. Please provide supporting documentation when required.
After closing your account, you may request the deletion of any data not subject to a legal retention period. Submit your request by email.
Request your data in a structured format (JSON or CSV) for transfer to another service. aa28 processes the request within 15 days.
Use the unsubscribe link in any aa28 email, or go to Settings > Notifications to opt out of promotional emails immediately.
If you are not satisfied with aa28's response, you may file a complaint with the Autoridade Nacional de Proteção de Dados through the gov.br/anpd portal.
Privacy policies are read by very few people — they tend to be long documents filled with legal jargon that seem designed more to satisfy a compliance requirement than to genuinely inform the people who will actually use the service. At aa28, the choice was different: to write a policy you can actually read in plain language, understand what is being done with your data, and make informed decisions about how you use the platform.
When you create an account on aa28, you must provide your full name, CPF, date of birth, email address, and phone number. These details are used for three main purposes: operating your account (a CPF is required to create an account that complies with Brazilian law), processing your deposits and withdrawals via Pix, boleto, or card, and meeting the legal obligations that any betting platform operating in Brazil must fulfill — including anti-money laundering regulations. None of this data is shared with third-party marketing lists, data brokers, or any company that is not directly involved in operating your account.
Identity verification — what the industry calls KYC (Know Your Customer) — may feel like extra paperwork, but it exists for a concrete reason: to protect you and the integrity of the platform. When the aa28 verifying that an account belongs to who it claims to belong to makes it much harder for someone to create a fake account using your details and attempt to withdraw your balance. It follows the same logic as a bank that requires documents before opening an account. The documents you submit — national ID, driver's license, or passport, and proof of address — are stored with encryption and accessed only when there is an operational need or a specific legal requirement.
Your betting history from Brasileirão matches, Copa do Brasil games, crash games, or Live Casino tables is stored for two reasons: first, so you can review your activity within the platform; and second, so that the aa28 detect unusual patterns that may indicate bonus abuse or risky behavior — protecting both the platform and other users. This behavioral data is not used to sell ads or build marketable profiles — it stays within aa28 and is used exclusively to operate and improve the service.
On cookies: the aa28 uses session cookies to keep you logged in while betting, analytics cookies to understand how people navigate the platform and identify areas for improvement, and security cookies to detect unauthorized access attempts. You can block non-essential cookies in your browser settings — this may affect some features such as access to Live Casino, but will not prevent deposits or withdrawals via Pix.
The topic of emails deserves special attention. The aa28 sends two types of messages: operational (withdrawal confirmations, security alerts, active bonus notifications) and promotional (Brasileirão updates, weekly promotions, featured tips). Operational messages are necessary for your account to function and cannot be disabled. Promotional messages are optional — if you'd rather not receive them, simply click "Unsubscribe" in any such email or turn them off in the notification settings within the platform. The cancellation is immediate and does not require confirmation from support.
Regarding financial data security: when you deposit R$ 50.00 via Pix or request a withdrawal of R$ 200.00 to your Nubank, Itaú, or Bradesco account, that transaction goes through a layer of 256-bit SSL encryption — the same standard Brazil's major banks use to protect online transactions. The Pix keys and banking details you register for withdrawals are stored with encryption at rest and accessed only at the moment the transaction is processed.
Ultimately, the LGPD is not a legal technicality — it is a real right you hold as a Brazilian citizen. The aa28 takes this legislation seriously because it believes privacy and transparency are part of its commitment to players — not just a box to check. If you have any questions about what is done with your data, what has been collected, or how to request deletion, aa28's support team is available 24 hours a day via live chat — and responses are in Portuguese, with no generic scripts.
To access, correct, port, or delete your personal data, contact our DPO:
Aa28 handles your personal data with the same care you would expect from a Brazilian bank. SSL 256-bit encryption, full LGPD compliance, and zero data selling to third parties. If you have any questions about how your data is handled, our Brazilian team is available 24 hours a day via live chat or at suporte@aa28.best. You have the right to access, correct, export, and delete your information — and aa28 will respond within the legally required timeframe.
Also read the full Terms and ConditionsData protection at aa28 is part of a broader commitment to player well-being. Deposit limit, session limit, and self-exclusion tools are all available in your account settings — no need to contact support. The platform is exclusively for users aged 18 and over, with mandatory identity verification. If you or someone close to you is struggling with gambling, call CVV: 188 — free, confidential, and available 24 hours a day, 7 days a week.
Learn More About Responsible GamblingYour data protected under the LGPD, deposits via Pix from R$ 10.00, and a 100% welcome bonus up to R$ 500.00. Bet on the Brasileirão, Live Casino, and crash games with withdrawals in under 5 minutes.