Data protected by LGPD
Encryption 256-bit SSL across the platform
Your data never sold to third parties
Pix withdrawal in as little as 5 minutes
Welcome Bonus up to R$ 500,00
VIP program with cashback of up to 10%
Support in Portuguese 24 hours
More than 2 million users trust 136bt
Data protected by LGPD
Encryption 256-bit SSL across the platform
Your data never sold to third parties
Pix withdrawal in as little as 5 minutes
Welcome Bonus up to R$ 500,00
VIP program with cashback of up to 10%
Support in Portuguese 24 hours
More than 2 million users trust 136bt
LGPD — General Data Protection Law

Privacy Policy – Data Protection at 136bt

136bt takes your data seriously. This page explains in plain language what we collect, why we use it, how we protect it, and what your rights are as a data subject — all in compliance with the LGPD.

Last updated: January 2026
256 SSL bits
0 Data Sold
LGPD Compliance
2FA Available
48h Request Handling
+18 Minimum Age

What 136bt does to protect your data

Six concrete principles that guide how personal data is handled on our platform.

256-bit SSL encryption across all communications

All data exchanged between your phone or computer and 136bt's servers is protected by 256-bit SSL encryption — the same standard used by Brazil's leading banks such as Nubank, Itaú, and Bradesco. No data travels in plain text over the internet.

Your data is never sold to third parties

136bt does not sell, rent, or share your personal information with marketing companies, data brokers, or any other organization for commercial purposes. Your data is used exclusively to provide the platform's services and meet legal obligations — nothing more.

Full compliance with Brazil's LGPD

136bt's data processing strictly follows the Lei Geral de Proteção de Dados (Law No. 13,709/2018). This means defined legal bases for every processing operation, a record of processing activities, and full respect for all data subject rights provided under the law.

Two-factor authentication available

136bt offers two-factor authentication (2FA) for all users who want an extra layer of security on their account. With 2FA enabled, even if someone obtains your password, they won't be able to access your account without the code generated on your device.

Internal access restricted by role

Within 136bt, only staff members who need your data to perform their role have access to it. A support agent cannot view your full financial history; the finance team does not access data beyond what their role requires. Role-based access control (RBAC) is applied across all systems.

Notification in the event of a security incident

If any security incident occurs that could affect your data — such as a system breach — 136bt will notify the affected users by email within 72 hours of identifying the incident, as required by the LGPD, and will also report to the ANPD (National Data Protection Authority) where applicable.

Your Rights as a Data Subject

The LGPD gives you concrete rights over your personal data. Here's what you can request from 136bt at any time.

Access

You can request a complete copy of all personal data 136bt holds about you — what information, for what purposes, for how long, and with whom it has been shared.

Correction

If any of your data is incorrect, outdated, or incomplete, you have the right to request a correction. Changes to your name, address, and email can be made directly through your account dashboard or by contacting support.

Deletion

You may request deletion of any personal data that is not required for compliance with legal obligations. Data required by law — such as financial transaction records — is subject to mandatory retention periods and cannot be deleted before those periods expire.

Portability

You may request your data in a structured, machine-readable format (such as JSON or CSV) for transfer to another service or provider, as regulated by the ANPD.

Consent Withdrawal

Where data processing is based on your consent, you may withdraw that authorization at any time. Withdrawal does not affect any processing already carried out while consent was active.

Data Sharing Information

You have the right to know which partners or authorities 136bt has shared your data with, under what circumstances, and for what purpose. This information is provided upon a formal request submitted to the platform's DPO.

To exercise any of these rights, please contact us at suporte@136bt.best with the subject line "LGPD Request". Response time is up to 48 hours.

This Privacy Policy describes how 136bt — sports betting and online casino platform accessible at 136bt.best — collects, stores, uses, and protects its users' personal data in compliance with the General Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable Brazilian legislation.

By creating an account with 136bt, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of it, you should not create an account or use the platform's services.


1

Who We Are — Data Controller

A 136bt is the controller of personal data collected on this platform. We are responsible for determining the purposes and means of data processing carried out through our services. All requests relating to your data should be directed to our Data Protection Officer (DPO) through the channel indicated in Section 11 of this Policy.

Our platform is intended exclusively for users residing in Brazil, aged 18 or older, with an active CPF. We do not operate services directed at users outside Brazilian territory and do not intentionally process data from users of other nationalities.


2

Data We Collect

A 136bt collects personal data at various points during your interaction with the platform. Below are the main types of data collected and the context in which each is collected:

Data you provided directly during registration:

Full name CPF Date of birth Email Mobile number Residential address Government-issued ID (RG/CNH) Proof of address

Data collected automatically during platform use:

IP address Device type Browser and version Approximate geolocation Access times Betting history Pages visited Session data

Financial and transaction data:

Registered Pix key Last digits of card Deposit history Withdrawal history Transaction receipts

136bt does not store your full credit or debit card number on its servers. Card transactions are processed by PCI-DSS certified payment gateways. The platform receives only the transaction confirmation and the last four digits of the card for identification purposes.


3

How We Use Your Data

A 136bt uses your personal data only for the purposes described below. No data is processed for purposes incompatible with those listed without your explicit consent:

  • Account creation and management — verify your identity, set up access, link your betting history, and manage your deposit and bonus balances.
  • Delivery of contracted services — process Sports Betting, poker games, casino games, crash games, and all other platform features.
  • Payment processing — record deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED, and process withdrawals via Pix to the key registered under your CPF.
  • Identity verification (KYC) — confirm your identity, that you are over 18, and that you reside in Brazil, as required by the platform's legal and security obligations.
  • Fraud prevention and anti-money laundering — monitor suspicious behavior patterns and meet reporting obligations to the Financial Intelligence Unit (UIF) as required by Brazilian law.
  • Operational communications — send bet confirmations, withdrawal alerts, bonus notifications, and security alerts via email, SMS, and in-app push notifications.
  • Marketing communications — to keep you informed about promotions, new games, tournaments, and features, only with your prior consent and with an unsubscribe option in every communication.
  • Compliance with legal obligations — respond to requests from Brazilian judicial, law enforcement, or regulatory authorities when required by law.
  • Platform improvement — analyze anonymized usage data to identify performance issues, improve the user experience, and develop new features.
  • Customer support — log and resolve your support requests submitted via chat, email, and WhatsApp.

4

Legal Bases for Processing (LGPD)

The LGPD requires that every personal data processing operation have a defined legal basis. At 136bt, the legal bases used are:

  • Contract performance (art. 7, V) — data required to create and manage your account, process bets and payments, and deliver all services you signed up for.
  • Compliance with a legal obligation (Art. 7, II) — data required by Brazilian legislation such as the Anti-Money Laundering Law (Law No. 9,613/1998), Central Bank regulations, and tax requirements from the Receita Federal.
  • Legitimate interest (art. 7, IX) — data used to prevent fraud, ensure platform security, and improve the user experience, in cases where these interests do not override the fundamental rights and freedoms of data subjects.
  • Consent (art. 7, I) — data used for marketing communications and commercial preference analysis, based on the user's explicit opt-in. Consent may be withdrawn at any time.

For each data processing purpose, 136bt maintains an internal record indicating the applicable legal basis. You may request access to this record by emailing suporte@136bt.best with the subject line "LGPD Legal Bases".


5

Data Sharing

A 136bt does not sell your data to third parties. Personal information is shared only in the circumstances below, each with a defined and necessary purpose:

  • Payment processing partners — PCI-DSS certified payment gateways that process your transactions via Pix, boleto, credit/debit card, PicPay, and Mercado Pago. These partners receive only the data strictly necessary to execute the transaction and are contractually prohibited from using it for any other purpose.
  • Identity verification providers (KYC) — specialized services for document verification and CPF validation, used to confirm identity during registration and withdrawals. Data submitted is protected by confidentiality agreements.
  • IT infrastructure and hosting — cloud service providers and servers that host the platform. All data stored in these environments is encrypted at rest.
  • Game providers (casino and crash game providers) — only the minimum session data required to connect your game to the provider, with no direct personal identification. No financial data is shared with game providers.
  • Brazilian authorities and regulatory bodies — when required by law, court order, or regulatory mandate: Receita Federal, Banco Central, Polícia Federal, Ministério Público, UIF (Financial Intelligence Unit), and other competent authorities.

Outside the situations listed above, no personal data is shared with third parties without your explicit consent. In the event of a merger, acquisition, or corporate restructuring involving 136bt, users will be notified in advance and may request deletion of their data if they disagree with the new terms.


6

Storage and Security

The personal data of users of 136bt are stored on servers with the following security measures:

  • Encryption in transit — all communication between your device and the platform uses TLS 1.3 with a 256-bit SSL certificate.
  • Encryption at rest — data stored on our servers is encrypted using AES-256, including identity documents, account information, and transaction history.
  • Role-based access control (RBAC) — each 136bt team member has access only to the data necessary to carry out their specific role. Access is logged and audited on a regular basis.
  • Multi-factor authentication for internal access — all internal systems require two-factor authentication for staff, along with VPN for remote access.
  • Continuous monitoring — automated systems monitor suspicious access, intrusion attempts, and behavioral anomalies 24 hours a day, 7 days a week.
  • Regular penetration testing — the platform undergoes security audits and pentests conducted by independent teams at least twice a year.
  • Incident response plan — in the event of a data breach or security incident, 136bt has documented procedures for containment, notification of affected data subjects within 72 hours, and reporting to the ANPD.

7

Data Retention

A 136bt retains your personal data only for as long as necessary for the purposes described in this Policy or to comply with legal obligations. The main retention periods are:

  • Registration and identification data — retained for the full duration of the active account and for at least 5 years after account closure, as required by Brazilian anti-money laundering legislation.
  • Financial transaction history — retained for a minimum of 5 years after the transaction, in accordance with Brazilian tax and regulatory obligations.
  • Bet logs and game session records — retained for 2 years after account closure for dispute resolution and audit purposes.
  • Support communications — retained for 2 years after the ticket is closed.
  • Cookie and tracking data — based on each cookie's individual settings, with periods ranging from 30 days (session cookies) to 2 years (preference cookies).
  • Consent-based marketing data — retained until consent is withdrawn by the user.

Once the retention period ends, data is securely deleted or irreversibly anonymized for use in aggregated statistical analysis.


8

Cookies and Tracking Technologies

A 136bt uses cookies and similar technologies on its website and app for various purposes. You can manage your cookie preferences directly in your browser or app settings.

  • Strictly necessary cookies — essential for the platform's basic functionality: keeping your session active, remembering items in your bet slip, and securing your access. These cannot be disabled without affecting how the service works.
  • Performance cookies — collect anonymized data on how users interact with the platform — which pages they visit, how long they spend in each section, and what errors they encounter. Used exclusively to improve the platform. These can be disabled in settings.
  • Functionality cookies — remember your preferences — such as language, displayed currency (always R$), and notification settings — to personalize your experience so you don't have to reconfigure anything each time you log in.
  • Aggregated analytics cookies — used for aggregated and anonymized statistical analysis of platform traffic. The data does not identify individual users.

136bt does not use cross-site tracking cookies for third-party targeted advertising. No browsing data is shared with external ad networks.


9

Minors

A 136bt is a platform intended exclusively for users aged 18 and over. We do not intentionally collect personal data from minors. The registration process includes date-of-birth verification, and the KYC process includes identity document validation — measures designed to prevent minors from accessing the platform.

If 136bt determines that data from a minor was inadvertently collected, that data will be deleted immediately and the account closed. Parents or guardians who believe a minor has created an account on the platform should contact support immediately at suporte@136bt.best or via the 24-hour chat.

If you suspect that a minor is using your account or has access to your credentials, contact 136bt support immediately. Never share your password or leave your session open on devices accessible to minors.


10

How to Exercise Your Rights

To exercise any of the rights provided under the LGPD regarding your personal data at 136bt, follow the procedure below:

  • Send an email to suporte@136bt.best with the subject line: "LGPD Request — [describe the right you wish to exercise]".
  • Include in the email: your full name, the CPF registered to your account, and a clear description of what you are requesting (access, correction, deletion, portability, etc.).
  • For full data access or deletion requests, you may be asked to confirm your identity by providing a copy of a photo ID.
  • The response time is up to 48 hours to confirm receipt and up to 15 calendar days to complete the request, as set out under the LGPD.

You may also file a complaint directly with the ANPD (National Data Protection Authority) at gov.br/anpd if you believe your rights have not been respected by 136bt. This does not prevent you from also contacting your state's Procon or using the consumidor.gov.br platform.


11

Contact the Data Protection Officer (DPO)

A 136bt has appointed a Data Protection Officer (DPO), as required by Article 41 of the LGPD. The DPO is the official point of contact for all matters related to personal data processing on the platform.

To contact the 136bt DPO:

  • Email: suporte@136bt.best (subject: "DPO — [your request]")
  • Live chat: available on the platform 24 hours a day, 7 days a week
  • WhatsApp: available to registered users after the first contact via chat or email

The DPO is also the point of contact for reporting suspected security incidents involving personal data, as well as any questions about the legal bases used for specific data processing activities.


12

Changes to this Policy

A 136bt may update this Privacy Policy periodically to reflect changes in legislation, our data processing practices, or platform features. Significant changes will be communicated via your registered email and through an in-app notification at least 7 calendar days before the effective date.

The most recent version of this Policy will always be available at 136bt.best/privacy-policy. The date of the last update is displayed at the top of this document. We recommend reviewing this page regularly — especially if you receive an update notification.

Continued use of the platform after a new version of this Policy takes effect constitutes acceptance of the changes made. If you do not agree with the changes, you may request account closure before the effective date without any penalty.

Why privacy matters to 136bt

When the team at 136bt set the product roadmap, privacy and data security were never just items on a compliance checklist — they were central to what it meant to be a trustworthy platform. That's because we understand that betting with peace of mind requires users to know their personal data, financial history, and Pix key are in safe hands.

In Brazil, the online betting market has grown at a rapid pace. That growth has also brought platforms that handle data carelessly — selling emails to spam lists, sharing CPFs with advertisers, failing to encrypt identity documents submitted during KYC. 136bt chose a different path not because the law requires it, but because it is the bare minimum every user deserves.

What changes in practice for Brazilian users

For those who use the 136bt whether you're here to bet on the Brasileirão, the Superliga de Vôlei, or to play Aviator in the crash games, the protections in this Policy translate into concrete things: you won't receive spam from third parties just because you created an account here. Your Pix details won't be shared with anyone beyond the payment processor needed to complete the transaction. Your CPF doesn't appear on any marketing list that 136bt sells to third parties — because that list doesn't exist.

When you deposit via Pix and a penny lands in your account within seconds, or when you request a withdrawal and the money appears in your Nubank in under five minutes, that's only possible because the payment system is securely integrated — and that integration requires your financial data to be handled with the same care a bank applies to its own. 136bt holds all partners who process user data to that same standard.

Betting data: what we record and why

Betting history is one of the most sensitive types of data on a platform like 136bt — because it reveals behavioral patterns, financial volumes, and personal preferences. The platform retains this history for two main reasons: operational (resolving disputes over bet outcomes, validating bonuses, calculating VIP points) and legal (financial record-keeping obligations under Brazilian law).

Your betting history is never shared with third parties for commercial purposes. It is not sold to data brokers or used to build consumer profiles for advertisers. It belongs to you — and you can request a full copy at any time through 136bt. If you choose to close your account, operational data is retained for the mandatory legal periods and then securely deleted.

LGPD: more than a requirement, a commitment

The Lei Geral de Proteção de Dados came into force in Brazil in 2020, establishing an important milestone for the handling of personal data in the country. The 136bt has reviewed all of its internal processes to ensure full compliance: data mapping, processing activity records, legal basis definitions, staff training, and DPO appointment. This work is ongoing — it is continuously reviewed as the platform grows and new services are added.

If you have any questions about how your data is handled at 136bt that aren't answered in this Policy, please reach out to our support team. We respond in Portuguese within 48 hours, without legal jargon — because privacy needs to be understood to be respected.

Your Rights — LGPD

To exercise your rights of access, correction, deletion, or data portability, please get in touch: suporte@136bt.best with the subject line "LGPD Request".

Contact the DPO

Questions about data processing? Our Data Protection Officer (DPO) responds within 48 hours.

suporte@136bt.best
Subject: "DPO — [your request]"
Platform Security
256-bit SSL across all communications
Data encrypted at rest (AES-256)
Two-factor authentication (2FA)
24/7 monitoring against suspicious access
Regular pentests by independent teams
Payments via PCI-DSS certified gateways
Responsible Gambling

Betting is entertainment. Access our responsible gambling tools at Responsible Gambling.

+18

Frequently Asked Questions about Privacy at 136bt

Common questions about how 136bt handles and protects your personal data.

No. 136bt does not sell or share your personal data with advertising companies, ad networks, or data brokers. Data is shared only with strictly necessary operational partners — such as payment gateways to process your Pix, boleto, or card, and identity verification providers for the KYC process. All of these partners are contractually required to use your data solely for the specific purpose of delivering their service.

After account closure, 136bt retains your data for as long as required by Brazilian law — generally 5 years for financial and identity records, in accordance with Anti-Money Laundering legislation and tax obligations. Data with no mandatory legal retention period is securely deleted immediately upon closure. You may request detailed information about which data is retained and for how long by emailing suporte@136bt.best with the subject line "Data Retention After Closure".

You can request deletion of your data by sending an email to suporte@136bt.best with the subject line "LGPD Request — Data Deletion". Include your full name and registered CPF. Data not subject to mandatory legal retention periods will be deleted within 15 calendar days of the request being confirmed. Data with mandatory legal retention requirements — such as financial transaction records — cannot be deleted before those periods expire, but you will be informed exactly which data is retained and for how long.

136bt collects approximate geolocation based on your device's IP address — not your precise GPS location. This information is used to verify that access is occurring from Brazil (as required by operational and legal obligations) and to identify suspicious access from unusual locations as a way to protect your account. The app may request device location permission for specific features, but this permission is optional and can be denied in your phone's settings without affecting the platform's core functionality.

Yes. Under the LGPD, you have the right to data portability and access. To request a full copy, email suporte@136bt.best with the subject line "LGPD Request — Data Access". Please include your full name, CPF, and a copy of your ID for verification. 136bt will deliver your data in a structured format (JSON or PDF) within 15 calendar days. The report will include: registration details, deposit and withdrawal history, betting and gaming session history, and support communication records.

Your data, secured. Your bets, your call.

136bt protects your data with end-to-end encryption and full LGPD compliance. Create your account, deposit from R$ 10.00 via Pix, and start betting on the Brasileirão, Superliga, crash games, and much more — with complete transparency about your data.

Data protected by the LGPD
256-bit SSL
Bonus up to R$ 500.00
Pix in 5 min
Português