Privacy Policy

1. Data Controller Information

The data controller responsible for your personal information is nostar, the operator of the online gaming platform accessible at https://nostar.cam ("Platform," "We," "Us," "Our"). For all privacy-related inquiries, corrections, or deletion requests, the nostar Data Protection Officer ("DPO") can be reached at the contact details set out in Section 11 of this Policy. nostar is committed to handling your personal data in accordance with applicable data protection legislation, including but not limited to the Republic Act No. 10173 (Data Privacy Act of 2012) of the Philippines and related regulations issued by the National Privacy Commission.

By creating an account, accessing the nostar Platform, or otherwise interacting with our services, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy. If you do not agree with any provision herein, please discontinue use of the Platform immediately and contact our DPO to arrange erasure of any data already collected.

2. Personal Data We Collect

nostar collects personal data only to the extent necessary for operating a regulated gaming service, complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations, and providing a personalised, secure experience. The categories of personal data we process are described below.

2.1 Registration and Identity Data

When you create your nostar account we collect: full legal name, date of birth, gender, nationality, residential address (including barangay, city, and province), email address, and Philippine mobile number. This data is required to open your account and to satisfy identity verification requirements mandated by our gaming licence. Without it, we cannot lawfully activate your account.

2.2 Verification and KYC Documents

Before processing your first withdrawal, nostar requires submission of government-issued identification—such as a Philippine passport, driver's licence, Unified Multi-Purpose ID (UMID), postal ID, or SSS/GSIS ID—as well as a recent proof of address (utility bill, bank statement, or government correspondence not older than 90 days). Where legally required, we may also request a selfie photograph alongside your ID and documentation evidencing the source of deposited funds. Copies of submitted documents are stored securely and used exclusively for the KYC/AML purposes described in this Policy.

2.3 Financial and Transaction Data

To facilitate deposits and withdrawals, nostar processes transaction records including payment method type (GCash, Maya, BPI, BDO, UnionBank, USDT, or other supported methods), transaction amounts in PHP or relevant cryptocurrency, timestamps, and partial account identifiers provided by the payment processor. We do not store complete credit or debit card numbers; full card data is handled by PCI-DSS-compliant third-party processors and never retained on nostar servers.

2.4 Gaming Activity Data

nostar records gameplay history including game titles, bet amounts, win and loss outcomes, session duration, bonus usage, and jackpot events. This data is used for account management, bonus eligibility, dispute resolution, responsible gaming monitoring, and regulatory reporting. Aggregate gaming data may also be used anonymously for product improvement and platform analytics.

2.5 Technical and Device Data

When you access nostar, our servers automatically log: IP address, browser type and version, operating system, device type (mobile, tablet, desktop), referring URL, pages visited, time and date of visits, and session length. This data assists with fraud detection, security monitoring, and platform optimisation. It is retained in identifiable form for up to 12 months and thereafter in anonymised aggregate form indefinitely.

2.6 Communication Data

When you contact nostar customer support via live chat, email, or phone, we retain a record of the interaction, including the content of messages, timestamps, and support agent identifiers. Calls may be recorded for quality assurance and training purposes, and you will be informed of any recording at the outset of the call.

2.7 Cookie and Tracking Data

nostar uses cookies and similar tracking technologies as detailed in Section 8 of this Policy. You may manage your cookie preferences at any time through the cookie consent tool accessible from the Platform footer.

3. Purposes of Processing and Legal Bases

nostar processes your personal data only where a lawful basis under applicable data protection law exists. The table below sets out the principal processing activities, their purposes, and the corresponding legal basis.

Where nostar relies on consent as the legal basis for processing—most notably for marketing communications—you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, update your communication preferences in account settings or contact our DPO directly.

4. How We Share Your Personal Data

nostar does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We disclose personal data only in the circumstances described below, and only to the minimum extent necessary for each purpose.

4.1 Service Providers and Processors

We engage carefully vetted third-party service providers who process data on our behalf under binding Data Processing Agreements. These include: KYC and identity verification platforms, payment processors (for GCash, Maya, bank transfers, and USDT transactions), cloud hosting and infrastructure providers, fraud detection and cybersecurity vendors, customer support software providers, and email and SMS communication platforms. All processors are contractually obligated to process data only on nostar's documented instructions and to implement appropriate technical and organisational security measures.

4.2 Gaming Software Providers

Game providers such as Evolution Gaming, Pragmatic Play, and JILI Games receive limited session data (such as player identifier, bet amounts, and game outcomes) necessary to facilitate gameplay. Game providers are prohibited from using this data for purposes beyond gameplay facilitation and are bound by confidentiality obligations in their service agreements with nostar.

4.3 Regulatory and Law Enforcement Authorities

nostar may disclose personal data to gaming regulators, financial intelligence units, tax authorities, law enforcement agencies, or other public bodies where required or permitted by law—for example, in connection with anti-money laundering investigations, gambling licence audits, or court orders. Such disclosures are made strictly in accordance with applicable legal requirements.

4.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of nostar's business assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer in advance where we are legally permitted to do so, and the successor entity will be bound by obligations no less protective than those in this Policy.

5. International Data Transfers

Some of our service providers and gaming software partners operate servers located outside the Philippines. Where personal data is transferred outside the Philippines, nostar ensures appropriate safeguards are in place in compliance with Chapter VIII of the Data Privacy Act of 2012 and relevant National Privacy Commission circulars. Appropriate safeguards may include standard contractual clauses, adequacy decisions by the relevant authority, or the recipient's binding corporate rules. Upon request, nostar will provide further information about the safeguards applied to any specific international transfer.

6. Data Retention

nostar retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following minimum retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship plus a minimum of five (5) years following account closure, to satisfy AML and gaming regulatory obligations.
• KYC and verification documents: Retained for a minimum of five (5) years from the date of account closure or the last completed transaction, whichever is later.
• Transaction and financial records: Retained for a minimum of five (5) years to comply with tax, AML, and gaming regulatory reporting requirements.
• Gaming activity logs: Retained for three (3) years from each session date for dispute resolution and regulatory audit purposes.
• Customer support communications: Retained for two (2) years from the date of each interaction.
• Technical and device logs: Retained in identifiable form for up to twelve (12) months, thereafter anonymised.
• Marketing consent records: Retained while consent is active and for one (1) year following withdrawal, for evidence of consent compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. You may request early deletion of data where no legal obligation prevents us from doing so—see Section 7 for details.

7. Your Rights Under Data Privacy Law

As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to personal data that nostar holds about you. To exercise any of these rights, submit a written request to the nostar DPO using the contact details in Section 11. nostar will respond within 15 business days of receiving a valid, verified request.

• Right to be Informed: You have the right to know that your data is being collected and processed, the purposes for processing, and the identity of the data controller. This Policy fulfils that obligation, but you may request additional information at any time.
• Right of Access: You may request a copy of the personal data nostar holds about you, together with supplementary information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Account holders may update most information directly through account settings without contacting the DPO.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. Note that certain data must be retained to comply with legal obligations even after account closure.
• Right to Data Portability: Where processing is based on consent or contract performance, you may request a machine-readable copy of personal data you have provided to nostar.
• Right to Object: You may object to processing of your data where we rely on legitimate interests as the legal basis. You may also object to direct marketing at any time and we will cease such processing immediately.
• Right to Complain: You have the right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph) if you believe that nostar has processed your data in violation of the Data Privacy Act of 2012.

Before processing access or erasure requests, nostar may require you to verify your identity to prevent unauthorised disclosure or deletion of another person's data. We will not charge a fee for exercising these rights unless the request is manifestly unfounded, excessive, or repetitive.

8. Cookie Policy

nostar uses cookies—small text files stored on your device—and similar technologies such as web beacons, pixels, and local storage objects. These technologies help us keep you logged in securely, remember your preferences, prevent fraud, and understand how the Platform is used. The categories of cookies we deploy are:

• Strictly Necessary Cookies: Essential for the Platform to function. They enable session management, login authentication, and security features. These cannot be disabled without rendering the Platform inoperable.
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and display options to provide a more personalised experience on nostar.
• Analytics Cookies: Collect anonymised data about how visitors use the Platform—pages visited, time spent, error messages—to help us improve performance and content. We use first-party analytics where possible to minimise third-party data sharing.
• Marketing Cookies: Used with your consent to deliver relevant promotions and to measure the effectiveness of nostar marketing campaigns. These may be placed by trusted third-party advertising partners bound by our Data Processing Agreements.

You may manage your cookie preferences at any time via the cookie consent tool available in the Platform footer. Withdrawing consent for optional cookie categories will not affect your ability to play or manage your account, though some personalisation features may no longer function optimally. Note that clearing your browser cookies after setting preferences will reset your selections; you will be prompted to reconfigure them on your next visit.

9. Data Security Measures

nostar takes the security of your personal data seriously. We implement a comprehensive programme of technical and organisational measures proportionate to the risk posed by processing activities. Key measures include:

• Encryption in Transit: All data transmitted between your device and nostar servers is encrypted using TLS 1.3 with 256-bit AES encryption—the same standard used by major Philippine banks like BDO and Metrobank.
• Encryption at Rest: Sensitive personal data fields (including identity document copies, financial records, and KYC data) are encrypted at rest using AES-256.
• Access Controls: Personal data is accessible only to nostar personnel who require it for their specific role. Role-based access controls and multi-factor authentication are enforced for all internal systems. Access logs are maintained and reviewed regularly.
• Network Security: nostar infrastructure is protected by enterprise-grade firewalls, intrusion detection and prevention systems, and continuous security monitoring. We conduct regular penetration testing and vulnerability assessments.
• Incident Response: In the event of a personal data breach, nostar will assess the risk to affected individuals and notify the National Privacy Commission and relevant data subjects within 72 hours where required by law.
• Staff Training: All nostar employees handling personal data receive mandatory data privacy training upon onboarding and annually thereafter. Employees are bound by confidentiality obligations in their employment contracts.

While nostar implements robust security measures, no electronic transmission or storage system is completely impenetrable. You also have a role to play: use a strong, unique password for your nostar account, enable two-factor authentication where available, never share your login credentials, and contact us immediately at [email protected] if you suspect any unauthorised access to your account.

10. Minors and Age Restriction

In accordance with Philippine gaming regulations, participation in online gambling is restricted to persons who have reached 21 years of age. nostar employs age verification checks during registration and requires identity documentation confirming date of birth before processing any withdrawal. If we become aware that personal data has been collected from a minor without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the relevant account.

If you are a parent or guardian and believe that your child has registered with nostar, please contact our DPO immediately at [email protected] with the account details and we will investigate and resolve the matter promptly.

11. Changes to This Privacy Policy

nostar may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or business operations. When we make material changes, we will notify you by posting a prominent notice on the Platform and, where we hold your email address, by sending a notification to your registered email at least 14 days before the changes take effect. The revised Policy will indicate the updated effective date at the top of the document.

Your continued use of the nostar Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the revised Policy, you should discontinue use of the Platform and request account closure through customer support or by contacting the DPO.

Previous versions of this Privacy Policy are archived and available upon request from our DPO.