Privacy

KURAL processes personal data only as a data processor on behalf of our customers (the licensed iGaming operator). We do not market to end-players, we do not sell data, and we do not transfer personal data to any regulator without the operator's explicit per-control, per-occurrence consent.

In short

• Lawful basis: Article 28 GDPR / UK GDPR — KURAL acts as a processor under the operator's Data Processing Agreement.
• Hosting: AWS UK / EEA only. No US LLM inference without operator opt-in. See Subprocessors.
• Retention: Evidence ledger entries are COMPLIANCE-mode Object-Locked for 7 years per UKGC LCCP / MGA / SGA recordkeeping obligations.
• Data-subject rights: exercised via the operator; KURAL provides operators with the tooling to fulfil access and erasure requests inside the dashboard.

Full policy

The detailed privacy policy and Data Processing Agreement are available to prospective operators on request. Email privacy@kural.tech.

This page is the public summary. The legally binding document is the DPA executed alongside the Master Services Agreement.