Privacy Policy

DRAFT: this text has not been legally reviewed. It must be checked against Uzbekistan law before launch. 1. General provisions 1.1. This Policy explains how and why the Usta24 platform (the “Platform”) processes personal data and how it protects it. 1.2. Processing is carried out in accordance with the Law of the Republic of Uzbekistan “On Personal Data” (ZRU-547). 1.3. Consent to processing is given separately from accepting the offer terms — with its own tick at registration — and is recorded (with version and date). 1.4. The terms “Customer”, “Professional”, “Order” and “Estimate” have the meaning given in the offers. 2. What we collect • All users: phone number (sign-in and contact), full name, chosen language, optional email, consent records, sign-in sessions (device type and IP address), notifications and delivery preferences, messages in the app. • Customer: saved addresses (region, city/district, street, building, apartment, entrance, floor, landmark and optional coordinates), orders (description, photos, time), estimate versions, payment records (amount and method — not card data), ratings, reviews, complaints, warranty requests. • Professional: photo of an identity document (passport/ID) and qualification documents, profile photo, experience, languages, categories, service radius and area, schedule, base and last known location, emergency contact (optional), order history, ratings, commission and payment records, verification decisions and moderator notes. • Telegram: if you link your Telegram account — your Telegram identifier and language choice. In the Mini App the identifier is accepted only after the server verifies the data signed by Telegram. 2.1. The Platform does not collect or store bank card numbers, CVV codes or bank account passwords. Payment for work takes place directly between the Customer and the Professional. 3. How we use data 3.1. Running the service: registration and sign-in (one-time SMS code), creating and routing orders, finding the nearest suitable Professionals, statuses, estimates, in-app contact, ratings, complaints and warranty, commission accounting. 3.2. Safety and trust: vetting Professionals, preventing fraud and abuse, rate limiting, restrictions, an audit log (who did important actions and when). 3.3. Communication: in-app notifications, SMS with the sign-in code, SMS/Telegram for important events (can be switched off in settings, except sign-in codes). Improving the service: aggregated statistics and reports. 3.4. Marketing messages are sent only with your separate consent and can be withdrawn in your profile at any time. 4. Location 4.1. Customer: coordinates are taken when you enter an address or when you yourself press “Use my current location”; they are used to find the nearest Professionals. The Customer’s location is not tracked continuously (24/7). 4.2. Professional: location is updated when you switch “Online” on and when you update your profile — to offer the nearest orders. It is not updated while offline. The Professional’s location is not shown to the Customer. 4.3. Before accepting an order the Professional does not see the exact address — only the area and approximate distance (e.g. “~3 km”). 5. Who sees your data 5.1. Order participants: once an order is accepted the Professional sees the Customer’s name, phone, exact address, landmark and order photos; the Customer sees the Professional’s name, phone, rating and experience. After the order is cancelled or closed, the Customer’s phone and exact address are no longer shown to the Professional. 5.2. Platform staff: see only the data needed for their tasks, according to permissions. Identity documents can be opened only by staff with a special permission, and every opening is logged. 5.3. Service providers: hosting and infrastructure, the SMS provider, Telegram (if connected), the AI assistant provider (if enabled) — only the minimum needed. Only the text you write to the assistant is sent to the AI provider; messages about safety, payments and complaints are not sent to it. 5.4. We do not sell personal data. Data may be handed to competent state authorities where the law provides. At this stage the Platform uses no third-party advertising trackers or analytics SDKs. 5.5. The country where data is processed and stored depends on the hosting set-up; before launch the operator will state it exactly here: [country of the servers and list of providers — to be completed]. 6. Retention and protection • One-time sign-in codes: stored only as a hash, valid for 5 minutes, single use. Sign-in sessions: up to 30 days or until sign-out. • Orders, estimate versions, messages, ratings: while the account exists; until any dispute or warranty matter is closed. • Financial records (payments, commission, adjustments, refunds): for the period the law requires for tax and accounting (at least 5 years — the operator confirms with counsel); kept in anonymised form when an account is deleted. • Identity documents: by default 3 years from upload or until the account is deleted — whichever comes first; the file is deleted when the period ends. Every access to the documents (allowed or denied) is logged. • Audit log and security records: as long as needed for security and dispute resolution; the exact clean-up period is set by the operator: [to be completed]. 6.1. Protection measures: an encrypted connection (HTTPS) is deployed on the Platform’s side; sign-in codes and session tokens are hashed; staff passwords are stored with strong hashing; role-based access control; documents in private storage; request rate limits; important actions in the audit log. No system is perfectly secure; if an incident occurs, affected users and the competent authority are notified as the law requires. 7. Your rights 7.1. You have the right to obtain information about your data, correct inaccurate data, withdraw consent (marketing — in your profile) and request deletion of your account and data. 7.2. Account deletion: submit a request in your profile; staff review it. With active orders, unresolved disputes or unpaid commission, deletion may be temporarily declined. Once approved, personal data (name, phone, email, addresses, Telegram, documents, notifications) is deleted or anonymised; financial and accounting records are kept in anonymised form for the period the law requires. 7.3. Requests — through support or the competent state authority. 8. Browser storage (cookies) 8.1. The site uses only essential browser storage: the sign-in session (token) and the chosen language. No advertising or tracking cookies are used. 9. Children and automated decisions 9.1. The Platform is not intended for persons under 18 and we do not knowingly collect their data. 9.2. How orders are offered to Professionals (distance, rating, fair distribution, workload) and temporary restrictions for cancellations follow automatic rules. A Professional can appeal a restriction and staff review it. The support assistant only gives suggestions and does not decide on price, payment, refunds or complaints. 10. Changes and contact 10.1. The Platform may update this Policy; material changes are announced in the app. The current version is always available on the website. 10.2. Data requests and reports of security incidents: through the “Contact” page of the website and support. 11. Legal basis • Law “On Personal Data” (ZRU-547); Civil Code; Tax Code (retention of financial records). Platform operator: [company name, tax ID, registered address — to be completed before launch]. Contact: the “Contact” page of the website.