What rs9 collects, what rs9 shares, and what rs9 never sees
rs9 is the editorial publisher. The partner is the operator. The two halves of the privacy story are kept separate: this route describes the rs9 editorial side. The partner-side privacy policy applies to anything a reader does on the partner app or the partner wallet.
What rs9-bonus.com collects
| Category | What | Why |
|---|---|---|
| Strictly necessary cookies | Session, security, lobby grid pagination. | Required for rs9-bonus.com to function. |
| Analytics cookies (opt-in) | Anonymous page views, referrer, viewport. | Improve the editorial coverage and the lobby grid. |
| Marketing cookies (opt-in) | Campaign attribution to the partner checkout. | Measure campaign performance. |
| Cookie preferences | The consent state stored in localStorage. | Remember the reader's choice. |
| Editorial correspondence | Reader-submitted corrections and feedback. | Process the request and reply. |
rs9 does not collect account credentials, KYC documents, bank account details, card numbers or any payment data. The partner app collects those; the partner-side privacy policy applies.
What rs9 never sees
Clicking PLAY NOW routes the reader to the partner host at web-in.gogotofly.com. From that tap onward, the data the partner collects is on the partner's side of the wall. rs9 does not receive the partner account password, the KYC documents, the bank account number, the card number, the deposit amount, the withdrawal amount or the bet history.
The single signal rs9 does receive is the affiliate click identifier - that is the campaign tag, not the reader's identity - plus the consent state the reader sets on the rs9 cookie panel. The partner's analytics are the partner's own.
Third-party processors on rs9-bonus.com
Hosting
rs9-bonus.com is served from the production web root configured for the live URL. The host processes incoming requests, applies the cached HTML and serves the static assets.
Partner preconnect
A single preconnect to the partner host is opened to reduce the cold-start time on the PLAY NOW tap. The preconnect does not transfer data; it only opens the network path.
Optional analytics and marketing categories only run if the reader opts in through the cookie panel. Strictly necessary cookies stay on because the lobby grid, the session handling and the security checks depend on them.
How long the data is held
- Cookie consent state: stored in localStorage for the lifetime of the browser; deletable from the cookie panel at any time.
- Analytics records: pseudonymised; kept for thirteen months from collection.
- Editorial correspondence: kept for the duration required to resolve the request plus six months; deleted on request if the request is closed.
- Server logs: kept for thirty days for security and operational review.
rs9 does not retain data beyond the windows above unless a law requires a longer hold. For the partner-side retention windows, the partner-side privacy policy applies.
Reader rights under DPDP Act 2023
Indian readers can ask rs9 for a copy of the personal data rs9 holds, ask for corrections, ask for deletion, ask for the consent to be withdrawn and ask for the data to be limited to what is strictly necessary. The rights are exercisable against the editorial side; for the partner side, the partner's privacy officer is the right contact.
| Right | How to exercise | Response window |
|---|---|---|
| Access | Email [email protected] | Seventy-two hours |
| Correction | Email with the URL and the correction requested | Seventy-two hours |
| Deletion | Email with the affected identifier | Thirty days |
| Withdraw consent | Open the cookie panel and toggle the switch | Immediate |
| Grievance | Email [email protected] | Thirty days |
How the consent state is recorded and changed
When a reader opens rs9-bonus.com for the first time, the cookie panel is hidden and the cookie banner is delayed by 1.4 seconds so the panel does not fight the LCP. The banner offers three choices: accept all, reject optional, or open the manage panel. Each choice writes a record to localStorage under rs9_cookie_consent_v1 with a timestamp; the consent state then drives which cookies are set on subsequent page views.
The consent state can be changed at any time from the cookie panel. The panel can be opened from the cookie banner, from the footer Cookie Settings button, or from the manage link on the cookie banner. There is no technical limit on how often the consent state can be changed; a reader who wants to disable analytics after first accepting them can do so in a single click.
The consent state is stored locally. rs9 does not transmit the consent state to a third party. The consent state is used only to decide which cookies rs9-bonus.com sets on the reader's browser. The partner-side consent state is the partner's own; rs9 does not see it.
Where the rs9 wall ends and the partner wall starts
The boundary between the rs9 editorial side and the partner operational side is the same as the scope clause on /legal/. Before the PLAY NOW tap, the rs9 privacy notice applies. After the PLAY NOW tap, the partner privacy notice applies. The wall is enforced by routing; rs9 does not see what happens on the partner host.
For a reader who wants to understand what data the partner collects, the partner privacy notice is the canonical reference. The partner privacy notice covers account data, KYC documents, wallet transactions, bet history and the support ticket history. rs9 does not see any of those categories; the wall is operational, not just contractual.
Why rs9 does not address readers under 18
rs9-bonus.com is built for readers aged 18 and above. The editorial coverage, the catalogue preview, and the captain-pick flow are not aimed at minors. rs9 does not knowingly collect personal data from children through contact forms, newsletter sign-ups, or in-product feedback. If a parent or guardian believes a child has provided data on rs9-bonus.com, the rs9 team will arrange deletion on request and confirm the deletion in writing within 30 days.
The partner enforces the age gate at the partner side. A reader who is under 18 cannot create a partner account, cannot pass KYC, and cannot reach the wallet. The age gate is the partner-side enforcement; rs9's role is to publish the editorial coverage to the audience the partner serves, and to mirror the partner's age policy on this notice.
How this privacy notice is updated
This privacy notice is updated when the categories of data rs9 collects change, when the third-party processors change, or when the applicable law changes. Material updates are recorded with a date stamp at the top of the route. The date stamp is the canonical source for "what does this notice say at the time I read it?"
Minor edits - typo corrections, link corrections, phrasing refinements - do not carry a date stamp. The date stamp is reserved for changes that affect the categories of data collected, the categories of data shared, the third-party processors or the reader rights. Minor edits are recorded in the editorial changelog rather than on the route.
For a reader who wants to know what changed between two date stamps, the rs9 team can provide a diff on request. The diff is sent by email to the reader who asks; the diff is not published on the route because the editorial side wants the route itself to read cleanly without a long list of historical changes.
How this notice fits with DPDP Act 2023
The Digital Personal Data Protection Act 2023 sets the frame for personal data processing in India. This notice is written to be compatible with the DPDP Act frame: the categories of data rs9 collects are listed on the collect-h section above, the consent state is stored locally and recorded on this route, the reader rights are exercisable against the editorial side and the response windows above are aligned with the Act's expected turnaround.
Where the partner-side processing falls under the same Act, the partner-side privacy policy applies; the wall on /legal/ is the same wall here. The DPDP Act's per-account obligations are the partner's; the DPDP Act's per-reader obligations on the editorial side are rs9's.
For a reader who wants to file a complaint under the DPDP Act, the appropriate authority is the Data Protection Board of India. The rs9 team can help a reader frame the complaint but cannot file it on the reader's behalf. The grievance address above is the editorial-side escalation path; the Data Protection Board is the regulatory escalation path.
How rs9 protects the data it does hold
The editorial site serves static HTML over HTTPS. The static-HTML shape means there is no rs9-side database that holds reader records; the editorial side does not maintain a per-reader store on its own infrastructure. The reader's consent state is held in the reader's own browser; the reader's correspondence with the rs9 team is held in the rs9 team's mailbox.
The HTTPS layer protects the request from the reader's browser to the production web root. The the rs9 team's mailbox is protected by the email provider's standard security posture. The optional analytics and marketing categories process pseudonymised records at the analytics provider; the rs9 side does not see per-reader identifiers.
For a reader who wants to know what a partner-side compromise would mean for the editorial side, the answer is straightforward: rs9 does not hold partner-side data, so a partner-side compromise does not give an attacker access to anything rs9 holds. The wall on /legal/ is the same wall here.
Where the data travels
The editorial site is served from India. Optional analytics and marketing categories may process records in regions where the analytics provider operates; rs9 only enables those categories if the reader opts in. Strictly necessary cookies and the editorial correspondence are processed in India.
Where the partner-side data travels after the PLAY NOW tap is the partner's question, not rs9-bonus.com's. The boundary is recorded on /legal/.