Version 2.0. Published 8 November 2026. This policy is in force on the website you are reading.
Privacy Policy
Greenroom publishes these terms for the website you are reading. They are written as procedures: who does what, when it takes effect, and what the balance does.
This policy says what the website collects, why, how long it is kept, and what you can ask. It is written for players in Alberta. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA) are the statutes this policy is built around. This policy does not appoint the website as a public body.
Who is responsible
The operator of the website you are reading is responsible for the account records stored here, under the wordmark Greenroom. The legal name, registration number, and street address are not confirmed for this website, so they are not stated. A privacy officer is not appointed. Requests go to privacy@hescorecasino.slonik.store, or through the contact form if you use the account email. Support mail is support@hescorecasino.slonik.store. Both addresses follow the host you are reading.
Where information comes from
Most of it comes from you, on a form. Some of it is produced by the website when you use it: a ledger row, a history row, a message reference, a hash of a network address, a cookie. A file you upload is information you provide. This website does not buy a marketing list. It does not receive a file about you from a payment company, a geolocation company, or an identity-check company, because none of those is connected.
What is required
Registration requires your name, email, password, date of birth, residential address, city, province or territory, postal code, and phone number, and acceptance of the terms. If you do not provide them, the account is not created. A document is not required to open the account or to add a credit. It is required before a withdrawal: while the status is Unverified, the withdrawal is refused. If you do not send a file, the account can remain open and the withdrawal stays unavailable.
The age gate requires a yes or a no. A no means the pages do not open. The cookie banner requires a choice before the optional flags are stored. You can reject the optional flags and still use the website.
Categories
- Identity and contact: name, email, phone, residential address, date of birth.
- Account security: password hash, session identifier, sign-in time, session version, count of wrong passwords.
- Verification: the file, its type, the time, the status, and any result note a person posts.
- Balance: credit, bonus, and withdrawal rows, with amount, status, and time.
- Play: the title opened and the time. Favourites store a game name from the catalogue only.
- Limits and exclusion: the numbers you set, the time a looser limit takes effect, a time-out end, an exclusion end.
- Messages: name, email, subject, category, the text, the reference, the time, and a hash of the network address.
- Mail log: the reset message the website asked the server to send, kept to the last 200 entries.
- Cookies: the age answer, the consent choice, and the session cookie.
Documents
The file is a JPG, PNG, or PDF under 8 MB. A copy is stored in a private directory. It is not published at a public address and it is not shown back to the browser as a gallery. The website reads the type of the file. A person reads the document to check that it matches the name and the date of birth on the account, and posts Verified or Not accepted. The form never sets Verified by itself. No outside identity vendor receives the file. If you send nothing, no document record is created.
A later file replaces the status with Pending and is kept beside the earlier file. The earlier file is not deleted by the new upload. Retention of both is in the table below.
The balance, and what a payment company would hold
This website stores the amount, the type of row, the status, the time, and the account it belongs to. It does not store a card number, a bank account number, an e-transfer address, or a payment token. No payment organisation receives the credit, so there is no second list of data held by a payment organisation. Marks in the footer name payment organisations. They are not a connected cashier, and those organisations do not receive your account record from this form.
Account checks
The purpose of keeping the document and the ledger is to know who the account belongs to and which rows were recorded. The basis is that you asked for the account and for a withdrawal, and that the website has to keep a record of money it recorded. No dollar threshold, no list of signals, and no automated report is published, because the forms do not send a report to an authority. A withdrawal can be held at Pending until a person has seen the document. That hold is the check this website actually performs.
Purposes
- To open and run the account you asked for, including sign-in, the balance, offers, and history.
- To apply the age rule and the Alberta rule stated in the terms.
- To review a document before a withdrawal and to post the result you are waiting for.
- To apply limits, a time-out, and self-exclusion that you set, and to block a new account on an excluded email.
- To store a complaint and answer it on the timetable in the terms.
- To keep the website secure: the password hash, the session, the lockout, and the private file store.
- To remember the age confirmation and the cookie choice.
The interest in security and in keeping a ledger after you stop using the account is the interest in knowing what was recorded and in stopping a closed or excluded email from being used again. You can object to a use that is not required to run the account by writing to privacy@hescorecasino.slonik.store. A use that the account cannot run without, such as storing the email, ends only when the account and the retention period both end.
How long
Each period below is a period adopted in this policy, unless a statute requires a longer one. The start of the period is the event in the second column.
| Record | The period starts | How long | Why |
|---|---|---|---|
| Account profile | The last completed ledger row, or closure if there is no row | Five years, and for as long as the account stays open if that is longer | The balance and the complaints rule |
| Ledger rows | The day the row is stored | Five years | A dispute about a credit, a bonus, or a withdrawal |
| Verification file and result | The day a result is posted, or the upload if no result is posted | Five years | A later dispute about the decision |
| Opened-title history and favourites | The open, or removal of the favourite | Two years, and favourites only while the account is open | Your own history page |
| Messages | The day the message is stored | Two years | The complaint and one appeal |
| Reset token | The moment it is created | One hour, then it stops working | The reset link |
| Mail log | Each new entry | The last 200 entries, then the oldest is dropped | A record that a reset was asked for |
| Wrong-password counter | The failed sign-in | The 15-minute window | The lockout |
| Self-exclusion | The moment you confirm it | Until the end time. An open-ended exclusion stays until a person lifts it. The email block is kept for five years after it ends | Stopping a new account on that email |
| Limits and time-out | The moment you save them | While they are in force, then with the account | Applying the number you set |
| Age cookie grn_age | The day you answer the gate | 365 days | Not asking on every page |
| Consent cookie grn_consent | The day you choose | 180 days | Remembering Accept All, Reject Optional, or Cookie Settings |
| Session cookie grn_sid | Sign-in | Until the browser session ends, and sooner after 30 idle minutes or 12 hours | Keeping you signed in |
| Hash of the network address | Sign-in, or the message | With the account, or with the message | The lockout and the complaint record. The raw address is not written into the account |
Who receives it
The people who operate this website, and the host that stores the files, receive the records above. The role of the host is to store and serve the website. No payment company, no identity-check company, no geolocation company, and no provincial exclusion register receives a record, because those connections are not in place. When you open a title, your browser loads the game window from the game provider. That request is between your browser and the provider. This policy does not name a contract that sends your account file to that provider, and this website does not attach your email to that request.
A reset link is handed to the server’s mail program, addressed to the email on the account. The contact form does not send a copy by email. A message is stored on the website. An authority receives information only when a binding request requires it. Records are not sold.
Other countries
This policy does not name a foreign recipient and does not name a country of storage beyond the fact that the website is directed at Alberta. If a host or a mail program sits outside Alberta, that is a fact of the server, not a transfer this policy appoints to a named company. No adequacy finding is claimed.
What you can ask
You can read your profile while you are signed in, and you can correct your name, phone number, and address there. The email and the date of birth are not edited on that form. You can ask privacy@hescorecasino.slonik.store for a copy of the account record, for a correction the form does not allow, or for deletion. Write from the email on the account, or say the email and enough detail that the request can be matched. If the sender cannot be matched, the request is not actioned and you are told what is missing. That ask is the one request for a missing detail.
The rule of this website, and the period PIPEDA sets for a request of this kind, is an answer within 30 days. The period can be extended once, by up to another 30 days, if the file is large, and you are told why before the first 30 days end. Deletion does not lift an active self-exclusion, and it does not erase a ledger row or a verification file before the period in the table. When deletion is refused for that reason, you are told which record stays and for how long.
You can withdraw the optional cookie choice at any time in Cookie Settings. Withdrawing it does not close the account. You can complain to the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca, and to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Those offices are not this website’s support desk.
No automated decision sets the status to Verified or Not accepted. The form only sets Pending. Refusals that the code applies by itself are the rules in the terms: age, a duplicate email, an excluded email, a limit, a time-out, a file of the wrong type, and a withdrawal above the balance. They are not a score about you.
Cookies
The cookie policy lists grn_age, grn_consent, and grn_sid, and the banner sentence. This policy does not rename them.
Age
The website is not for anyone under 18. A date of birth under that age is rejected. If a review finds that an account was opened under that age, the account is locked against play and against a new credit, and the email is blocked. Write to privacy@hescorecasino.slonik.store if you believe that has happened.
Security
The password is stored as a hash. The session cookie is HttpOnly. Forms that change the account carry a token that must match the session. Verification files sit outside the public pages. The network address on a message and at sign-in is stored as a SHA-256 hash, not as the raw address. These measures do not make a record impossible to disclose if the server itself is compromised. If that happens, the privacy address above is where a notice is sent when the website has your email and a notice is required.
Changes to this policy
A change is posted on this page with a new version and a new date before it applies. The notice period for a material change is 14 days, which is a rule of this website. The page does not promise a separate email for every edit, because the contact form does not run a mailing list. Continued use after the date is acceptance, except for a consent that the banner asks for again when the cookie categories change.