Privacy Policy

Last updated: 08 September 2026

1. Scope

This policy applies to personal information handled by Ellipse Entertainment Limited ("we", "us") in connection with the website mhighflyercasino.com and the gaming account service offered through it to players in Ontario, Canada.

It covers visitors to the website and holders of a gaming account. It does not cover third-party websites that we link to, which have their own policies.

2. Information we collect

We collect information you give us directly, information generated by your use of the service, and information we receive from verification and payment providers acting on our behalf. The categories are set out individually below.

3. Registration data

When you open an account we collect your legal first and last name, date of birth, e-mail address, residential address in Ontario including postal code, an optional telephone number, and a password (stored only as a one-way cryptographic hash, never in readable form). We also record the date, time and IP address of registration and the consents you gave.

This information is necessary to create and operate the account, to establish eligibility, and to meet the obligations that apply to a registered Internet Gaming Operator in Ontario. Without it an account cannot be opened.

4. Contact information

We use your e-mail address, and telephone number where you provide one, for service messages such as verification outcomes, withdrawal notifications, password changes, security alerts, responsible-gambling confirmations and changes to these terms. Service messages are part of operating the account and are not marketing.

If you contact Customer Support or use the contact form, we keep your message, the address you sent it from and our reply so we can deal with the enquiry and keep a record of it.

5. Identity Verification

Before real-money play, and in every case before a first withdrawal, we verify your identity. We collect the type, number and expiry date of an accepted identity document — a driver's licence, passport, provincial identity card or photo card — and match it against the details on your account. Where checks require it, we may collect a document image or additional supporting evidence.

Document numbers are not retained in full: we hold a non-reversible reference derived from the number, together with the document type, expiry date and the outcome and date of the check. Verification may be carried out with the assistance of a specialist verification provider acting under contract on our instructions.

This processing is necessary to comply with the Registrar's Standards for Internet Gaming, anti-money-laundering obligations, and our duty to prevent underage and fraudulent access.

6. Age Verification

We collect your date of birth at registration and confirm it again against your identity document. We record the outcome and date of each age check. Where an account cannot be confirmed as 19+, we record that outcome, suspend the account, stop play and return deposits.

We also record your response to the age gate shown on first visit, so we do not repeat it unnecessarily and so consent can be evidenced.

7. Geolocation Data

This section explains the specific use of geolocation data, because it is central to how the service operates.

Why we collect it. Real-money play is permitted only while you are physically located within Ontario. To meet that requirement we must establish where you are at the time you play — not where you live and not where your account was registered.

What we collect. When a location check runs, your browser or device is asked to share its position through the standard device location interface. We receive latitude and longitude coordinates and an accuracy value, and we record the time of the check, the IP address the request came from, and whether the result placed you inside or outside Ontario.

How it is used. The coordinates are compared against the boundary of the Province of Ontario. The result is a yes-or-no eligibility decision. If the check confirms you are inside the province, real-money play is enabled for 60 minutes, after which the check is repeated. If it cannot confirm this, real-money play is not enabled. The check is also repeated periodically during play and after a period of inactivity.

Consent and control. Your browser asks for permission before sharing your position, and you can refuse or withdraw it at any time in your browser or device settings. Refusing does not close your account and does not stop you browsing the site; it does mean real-money play cannot be enabled, because we cannot establish eligibility without it.

Limits on use. Geolocation data is used only for eligibility, regulatory compliance, fraud prevention and the security of your account. It is not used for advertising, profiling or marketing, and it is not sold or rented to anyone. We keep the coordinates of the most recent check together with a dated log of check outcomes, and we retain that log for the period required by applicable regulatory record-keeping obligations.

8. IP Address

We record the IP address used at registration, at each sign-in, when a location check is run, when a payment is initiated and when certain account changes are made. IP addresses are used to detect access from outside Ontario, to identify unusual or automated activity, to enforce rate limits on sign-in attempts, and to investigate suspected fraud or account compromise.

9. Device and Browser Data

We record technical information about the device and browser used with the account: browser type and version, operating system, screen and viewport size, language, time zone and referring page. A hash of your browser identifier is bound to your session so that a stolen session cookie cannot be reused elsewhere.

This data supports security, helps us reproduce and fix faults, and lets us present the site correctly on different screen sizes.

10. Payment data

Deposits and withdrawals are processed by regulated payment providers. Card numbers, card security codes and payment-service credentials are entered with the provider and are not stored on our systems.

We hold the information needed to operate the account and to reconcile payments: the payment method type (Visa, Mastercard, Interac, Skrill), a masked reference supplied by the provider, the amount, the currency, the date and time, the status, and the name on the account as confirmed by the provider.

11. Transaction history

We keep a record of deposits, withdrawals, wagers, returns and any adjustments made to your account, together with dates, amounts, methods, references and statuses. This record is required for regulatory reporting, for anti-money-laundering purposes, to resolve disputes, and so that you can see your own activity in your account.

Responsible gambling data

We record the limits you set, the date and time of each change, breaks and self-exclusions, reality-check settings, and any contact we have with you about your play. These records are used to enforce the controls, to meet the Registrar's Standards, and to keep an exclusion effective — including after an account closes.

12. Cookies

We use first-party cookies and similar storage. Essential cookies keep you signed in, protect forms against cross-site request forgery, remember your age-gate answer and record your cookie choices; they cannot be switched off because the service does not function without them. Functional, analytics and advertising cookies are used only where you have consented, and remain inactive until you do.

Full detail, including categories, purposes, retention periods and how to change your choices at any time, is in the Cookie Policy.

13. Analytics

Where you consent to analytics cookies, we collect aggregated statistics about how the site is used — pages viewed, journeys through the site, approximate region, device category, load performance and error rates. Analytics data is used to improve the service. It is not used to make decisions about individual accounts, and analytics identifiers are not combined with your identity or verification records.

If you do not consent, no analytics collection takes place and the site works exactly as it otherwise would.

14. Fraud Prevention

We analyse registration details, payment activity, device and IP signals, location check outcomes and patterns of play to detect duplicate accounts, stolen payment methods, account takeover, collusion, bonus abuse and attempts to circumvent self-exclusion or the Ontario location requirement.

Where activity indicates a risk, we may pause a transaction, restrict features on an account, request further verification, suspend the account, or report the matter to the Alcohol and Gaming Commission of Ontario (AGCO), to a payment provider or to law enforcement, as applicable law requires or permits.

15. Security Monitoring

We keep security logs covering sign-in attempts, password changes, session activity, changes to limits and exclusions, administrative actions and application errors. Logs are used to detect and investigate unauthorised access, to maintain the availability and integrity of the service, and to meet record-keeping obligations. Access to logs is restricted to staff who need it.

16. Why we use your information

We use personal information to: create and administer your account; verify your identity, age and location; process deposits, wagers and withdrawals; provide games and support; operate responsible-gambling tools including limits, breaks and self-exclusion; send service messages; prevent fraud and money laundering; maintain the security of the service; comply with the Registrar's Standards for Internet Gaming and other legal obligations; keep the records we are required to keep; and handle complaints and disputes.

Where consent is the basis for a use — non-essential cookies, analytics, advertising technologies and any marketing — you may withdraw it at any time without affecting the lawfulness of what was done beforehand. We do not sell personal information.

Our legal basis

We operate under the Personal Information Protection and Electronic Documents Act (PIPEDA), which is built on consent supported by the principles of accountability, identified purpose, limited collection, limited use and disclosure, and openness.

Some processing does not depend on your consent because it is required by law or by the regulator: identity and age verification, geolocation checks, anti-money-laundering obligations and record-keeping. If you withdraw consent for those, we cannot continue to offer you an account.

Marketing communications are sent only with your express consent, as required by Canada's Anti-Spam Legislation (CASL), and every commercial message includes a way to unsubscribe that we act on promptly. Unsubscribing from marketing does not stop service messages about your account, which we are required to send.

17. Sharing with service providers

We share personal information only where it is necessary, and only with:

• Identity and age verification providers, to confirm the details you supply.
• Payment providers and financial institutions, to process deposits and withdrawals and to investigate payment disputes.
• Game suppliers, which receive a pseudonymous account reference and the information needed to run a game session and settle a round.
• Hosting, infrastructure, e-mail delivery and customer support providers that operate the platform on our behalf.
• Analytics providers, where you have consented to analytics cookies.
• The Alcohol and Gaming Commission of Ontario (AGCO) and other regulators, auditors, law enforcement and courts, where required or permitted by law.
• Professional advisers such as lawyers and auditors, under a duty of confidentiality.
• An acquirer or successor, in the event of a corporate reorganisation, with equivalent protection.

Service providers act on our documented instructions under written contracts, may use the information only for the purpose we specify, and must apply appropriate security measures.

18. International transfers

Ellipse Entertainment Limited is established in Alderney, Channel Islands, and some service providers operate outside Canada. Where personal information is transferred outside your province or country, we use contractual and organisational safeguards intended to give it a comparable level of protection, and the information remains subject to this policy.

19. Data retention

We keep personal information for as long as it is needed for the purpose it was collected for, and then for as long as we are required to keep it.

• Account and verification records: for the life of the account and then for the period required by the Registrar's Standards for Internet Gaming and applicable anti-money-laundering law, which is generally a number of years after the account closes.
• Transaction records: for the statutory financial and regulatory record-keeping period.
• Self-exclusion records: for at least the length of the exclusion, and afterwards to the extent needed to keep the exclusion effective and to prevent an excluded person re-registering.
• Location check logs: for the regulatory record-keeping period applicable to eligibility evidence.
• Security and access logs: normally up to 24 months, longer where an investigation requires it.
• Support correspondence: normally up to 24 months after the enquiry is closed.
• Cookie consent records: for the life of the consent and a reasonable period afterwards as evidence.

When a retention period ends, information is deleted or irreversibly anonymised. Closing your account does not delete records we are legally required to retain.

20. How we protect information

Traffic is encrypted in transit using TLS. Passwords are stored only as salted one-way hashes. Sessions are bound to the browser that created them, expire after inactivity and are invalidated on sign-out and on password change. Forms that change account state are protected against cross-site request forgery, and sign-in attempts are rate limited.

Access to personal information is limited to staff and providers who need it for their role, under confidentiality obligations. Account, verification and transaction data is stored outside the public web root and is not directly reachable over the internet. Security events are logged and reviewed.

No system can be guaranteed completely secure. If a breach occurs that is likely to create a real risk of significant harm, we will notify affected individuals and the relevant authorities as required by law.

21. Your rights

Subject to applicable law and to the records we must retain, you may:

• Access the personal information we hold about you and be told how it is used and who it is shared with.
• Correct information that is inaccurate or incomplete. Some details, such as the name on a verified account, can only be changed with supporting evidence.
• Withdraw consent for uses that rely on it, including non-essential cookies, analytics and marketing.
• Object to or restrict certain processing where a legal basis for doing so applies.
• Request deletion of information we are not required to keep.
• Request a copy of information you provided to us, in a commonly used electronic format.
• Complain about how we have handled your information.

To exercise any of these, write to the Privacy Officer at privacy@mhighflyercasino.com. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (OPC), which oversees compliance with PIPEDA. CASL enforcement is shared between the OPC, the CRTC and the Competition Bureau.

22. Children

This service is for adults aged 19 and over. We do not knowingly collect personal information from anyone under 19. If we learn that we hold information about a person under 19, we close the account, stop play, return deposits and delete the information other than what we must retain as a record of the incident. If you believe a minor has used the service, contact the Privacy Officer immediately.

23. Changes to this policy

We may update this policy to reflect changes to the service, to our providers or to legal requirements. The date at the top of the page shows when it was last changed. Where a change materially affects how we handle your information, we will tell you by e-mail or through a notice on the site before it takes effect.

24. Contacting the Privacy Officer

Questions, requests and complaints about privacy should go to:

For anything that is not about privacy — payments, verification, game questions or account help — please use Customer Support at support@mhighflyercasino.com.