By David C. Hodgins – Updated June 2026
What Canadian players are actually agreeing to when they share data with Royal Ace
Royal Ace Casino has operated since 2009 under Infinity Media Group S.R.L., with a licensing position that one independent review describes as a Costa Rica business registration rather than a publicly published gambling-specific licence, alongside references to Curacao eGaming licensing in some sources. For Canadian players evaluating this platform’s privacy practices, that licensing uncertainty matters directly: the privacy frameworks that create real enforcement accountability – AGCO/iGaming Ontario’s provincial requirements, MGA’s GDPR-influenced standards, UKGC’s consumer data obligations – don’t apply here. What does apply is Canada’s federal PIPEDA, which governs any organisation handling Canadian personal data regardless of where it’s incorporated. This guide explains what Royal Ace collects, how it uses that data, and what the thin regulatory context means for Canadian player privacy in 2026.
About the author
My name is David C. Hodgins. I’m a Full Professor and Head of the Department of Psychology at the University of Calgary, a Fellow of the Royal Society of Canada and the Canadian Academy of Health Sciences, and a Research Coordinator with the Alberta Gambling Research Institute. My research spans more than three decades examining addictive behaviours – specifically relapse and recovery from gambling and substance use disorders. I developed brief motivational treatment models for problem gambling that are recognised as evidence-based by the US Substance Abuse and Mental Health Services Administration and used by mental health services worldwide. I received the Lifetime Research Achievement Award from the National Council on Problem Gambling in 2011 and the Scientific Achievement Award from the US National Center for Responsible Gaming in 2010. I delivered the University of Calgary’s Lecture of a Lifetime in 2025 on addiction recovery and what research teaches us about the paths people take toward change. I write independently, without commercial arrangements with any operator I cover.
The regulatory framing: PIPEDA without provincial enforcement
For Canadian players, the privacy accountability structure at Royal Ace reflects a specific absence. PIPEDA – Canada’s federal Personal Information Protection and Electronic Documents Act – applies to how Royal Ace handles Canadian player data regardless of where Infinity Media Group S.R.L. is incorporated. This provides federal privacy rights that exist independently of the platform’s licensing framework.
What’s absent is the provincial enforcement layer. Ontario players accessing AGCO-licensed casinos have data handling requirements enforced as conditions of provincial operating agreements, with iGaming Ontario’s dispute arbitration and AGCO regulatory oversight available. At Royal Ace, none of that applies – Ontario residents cannot access the platform at all, and players in other provinces rely on PIPEDA’s federal framework without the additional provincial backstop that provincially licensed alternatives provide.
| Framework | Applies to Royal Ace | Player protection provided |
|---|---|---|
| AGCO / iGaming Ontario | No | Not available – Ontario excluded |
| Malta Gaming Authority | Not confirmed | Not applicable |
| PIPEDA (Canada federal) | Yes | Federal privacy rights for all Canadian players |
| Costa Rica registration | Yes (not publicly published) | Limited – no published consumer data obligations |
| Curacao eGaming | Possibly | Basic offshore standards where applicable |
What data Royal Ace Casino collects from Canadian players
Data provided directly
| Category | Specific data points |
|---|---|
| Identity data | Full legal name, date of birth (21+ verification required) |
| Contact data | Email address, residential address, phone number |
| Financial data | Credit/debit card details (Visa up to $1,000, Mastercard up to $5,000), bank account information for transfer withdrawals, Bitcoin wallet addresses |
| Verification data | Government-issued photo ID and proof of address, collected at withdrawal stage |
| Account preferences | Bonus code redemptions, VIP programme opt-in, language and session preferences |
| Support communications | Live chat transcripts, email exchanges with support team |
Data collected automatically
| Category | Specific data points |
|---|---|
| Technical data | IP address, device type, browser, operating system |
| Behavioural data | Games played across the ~200 RTG/SpinLogic library, session duration, bet sizes, win/loss records |
| Currency conversion data | CAD-to-USD conversion records, exchange rate at time of deposit |
| Bonus tracking data | Sticky bonus play records, wagering progress toward 30x requirement |
| Progressive jackpot data | Participation in Aztec’s Millions and other network jackpots |
| Cookie and analytics data | Navigation patterns, promotional content engagement |
The currency conversion data category is specific to Canadian players at Royal Ace in a way worth understanding clearly. Because Royal Ace doesn’t support CAD, every Canadian deposit generates a conversion record documenting the exchange rate applied, the CAD amount deposited, and the USD amount credited. This creates a data trail that reflects both the player’s gambling activity and the financial impact of each deposit in a way that native-CAD platforms don’t generate.
The 21+ age verification process, which is triggered at withdrawal rather than upfront at registration for Inclave sign-up users, creates a specific verification data collection moment later in the account relationship than is typical. Understanding that KYC documentation is requested at withdrawal means players are sharing identity data at the precise moment they’re already engaged in a dispute or delay – a timing that can create pressure on the verification experience.
How Royal Ace uses your data
Royal Ace processes Canadian player data for:
- Account creation and authentication through InClave or standard registration
- Payment processing in USD across Visa, Mastercard, Bitcoin, Coindraw, check, and bank transfer
- KYC verification at the point of withdrawal – passport, government ID, or driver’s licence
- RTG/SpinLogic RNG certification compliance and game fairness audit records
- VIP programme administration including comp point accumulation and tier tracking
- Sticky bonus tracking – recording wagering progress against the 30x requirement and maintaining records of the bonus stripping process at withdrawal
- Progressive jackpot network participation records
- Customer support via live chat and 24/7 available channels
- Marketing communications with consent
- Responsible gambling feature administration
The sticky bonus tracking deserves specific attention because it creates a more complex data function than standard wagering-requirement tracking. At a non-sticky bonus casino, the bonus-clearing process ends when wagering is complete and the balance becomes withdrawable. At Royal Ace, the sticky structure means the platform tracks the bonus amount separately from the cash portion throughout the player’s session, maintains this dual-balance record up to the withdrawal request, and then performs the strip calculation at cashout. This is a more granular ongoing record of how bonus and cash portions interact during play than straightforward playthrough tracking.
From my research perspective on gambling behaviour, the sticky bonus mechanism generates a data pattern that correlates with specific player responses to loss – players who finish below the bonus amount multiple times have a documented record of repeated net-zero or negative cash outcomes that the platform’s analytics can link to session length, bet size escalation, and return visit frequency. Whether and how this data is used to inform promotional targeting is not publicly documented at Royal Ace, and in the absence of MGA or AGCO oversight, there’s no regulatory requirement to disclose it.
Third parties who may receive your data
| Third party | Purpose | Notes |
|---|---|---|
| Infinity Media Group S.R.L. | Operator-level data management | Costa Rica registration |
| Payment processors | USD transaction processing – cards, Bitcoin, Coindraw | Each carries own security standards |
| RTG / SpinLogic | Game session data during RTG-powered gameplay | Provider-level session interaction |
| Technical Systems Testing (TST) | RNG certification verification | Accredited testing agency |
| InClave | Biometric and identity-based account authentication | Sign-up convenience and KYC overlap |
| Analytics platforms | Platform performance and player behaviour data | May include third-party analytics tools |
The InClave connection is worth specific attention. InClave is the biometric-based authentication system that Royal Ace uses in 2026 for convenient sign-up and login, supporting Face ID, Touch ID, and similar device-level authentication. Using InClave means your biometric authentication data intersects with casino account data through InClave’s own platform, adding a third-party data relationship specific to how you authenticate rather than how you play. Understanding InClave’s own data practices is relevant alongside Royal Ace’s, since the authentication data flows through InClave’s infrastructure independently of the casino platform.
Security infrastructure: TLS encryption and RTG’s TST certification
Royal Ace Casino uses TLS (Transport Layer Security) encryption for all data transmission – the current standard for encrypted connections between browsers and web platforms. Alongside SSL-level connection security, the platform implements a site-specific digital firewall as an additional layer of protection. No major data breaches have been publicly documented across Royal Ace’s operational history since 2009, which is a positive indicator over a 17-year period even within an offshore context.
RTG’s RNG certification through TST (Technical Systems Testing) is a globally recognised accreditation covering game outcome fairness. TST has certified RNG processes for significant operators including International Game Technology, Aristocrat, and the Ontario lottery system – its accreditation history is credible. This certification addresses game fairness rather than player data security specifically, but it’s part of the overall platform integrity picture.
Your PIPEDA rights as a Canadian player at Royal Ace
Under Canada’s federal PIPEDA, Canadian players at Royal Ace retain:
- Right of access to all personal information the platform holds about them
- Right to correction of inaccurate, outdated, or incomplete information
- Right to withdraw marketing consent
- Right to know what third parties have received their data
- Right to complain to the Office of the Privacy Commissioner of Canada if requests aren’t addressed
These rights apply regardless of where Infinity Media Group S.R.L. is incorporated, because PIPEDA governs how organisations handle the personal information of Canadians as a matter of federal law. However, enforcement of PIPEDA complaints through the Privacy Commissioner’s office can be a lengthy process, and the absence of a casino-specific regulatory framework means there’s no parallel gambling-specific complaint channel available at Royal Ace the way iGaming Ontario provides for Ontario players at provincially licensed platforms.
David C. Hodgins, Ph.D., FRSC, FCAHS, is a Full Professor and Head of the Department of Psychology at the University of Calgary and Research Coordinator with the Alberta Gambling Research Institute. This guide reflects Royal Ace Casino’s publicly available privacy practices as of June 2026. Players must be 21+. Not available to Ontario residents.
