Privacy policy

1. Who we are

This policy explains how we process your personal data under the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547). [verify]

The operator of your data is [TODO: full legal name, tax number (INN) and address of the operator].

2. What we collect

When you use our Telegram store, sign in or place an order, we process:

• your name;
• your phone number, which you confirm with a one-time code sent by SMS;
• your Telegram account number (id), which Telegram gives to our bot or Mini App when you open it;
• delivery addresses: the address text, the point on the map, the entrance, floor, apartment and your comment;
• your orders: the products, amounts, delivery or pickup choice, time window, payment method and status;
• your cart;
• technical data: your IP address and the name of your browser or device, which are kept with your sign-in sessions and with each order you place.

When online payment by card is switched on, you enter your card details on the page of the payment provider Payme. We never see or store your card number. We keep the payment's identifier, amount, status and times.

This website, which is a read-only catalogue, does not ask for any of these.

Its web server does keep an access log: for each request it records your IP address, your browser or device name and the page address (URI), which includes any words you search for. [TODO: confirm how long these web access logs are kept; they rotate at 20 MB per file, 5 files]

3. Why we use it

• To accept, confirm, deliver and, if needed, refund your orders.
• To contact you about an order by phone or in Telegram.
• To keep the books and meet tax and accounting rules.
• To protect the shop from abuse, such as many unconfirmed orders from one phone or address.

We ask for your consent to this processing when you place an order. You cannot place an order without it. We store which version of this policy you accepted together with the order. [verify]

4. Who receives your data

• Telegram carries the messages and the sign-in between you and our bot and Mini App.
• Our couriers receive what they need to deliver an order they are assigned: the name, phone number and address, the items, the amount, the payment method and the time window. They do not see your other orders.
• The SMS provider that delivers one-time codes receives your phone number. [TODO: name the SMS provider]
• Payme receives the order amount, identifier and the items of the receipt when you pay online, once online payment is switched on.
• Other service providers that process data for us, such as a customer relationship system, receive only what they need for their task. [TODO: list every other processor before launch]

We do not sell your data.

5. How long we keep it

Data	How long we keep it
Server logs (phone numbers and other personal data are masked)	about 30 days
Sign-in sessions, with IP address and device name	90 days after the session expires
The IP address stored with an order	180 days after the order; the order itself stays
A cart of a visitor who has not signed in	30 days after the last change
Orders, their lines, payments and status history	5 years, as the tax law requires [verify]
Your deletion requests, and the staff notes on them	3 years [TODO: no job deletes these yet; build it before 2029]
The audit log of staff actions	3 years [TODO: no job deletes these yet; build it before 2029]
Technical account events (they hold no phone number or Telegram number)	as long as the account exists
One-time SMS codes	5 minutes
The delivery address held while you check out	10 minutes
Counters that limit abuse (they use keyed hashes, not your IP or phone)	at most 1 day
Sign-in state	10 minutes
Queued messages from our bot to you	30 days after sending [TODO: the purge job that enforces this is not built yet; do not publish this row until it is]

6. Your rights and deleting your data

You may ask us what data we hold about you, to correct it, and to delete it. Write to us at [TODO: email address for privacy requests] or use the contacts on the Contacts page.

To have your data deleted, write to us and ask for it. [TODO: deletion request in the Mini App/site account before launch] This is how a deletion request is handled:

1. You tell us that you want your data deleted, from the phone number or Telegram account you use with us.
2. Our staff check it. We may call you to confirm that it is you.
3. If it is accepted, your account is anonymised in one step and cannot be undone:
   • your name, phone number, Telegram number and sign-in identifier are erased;
   • your saved addresses, your sign-in sessions, your cart and the bot's messages to you are deleted;
   • you are signed out on every device.
4. We cannot delete the account while you have an order that is not yet delivered, completed, cancelled or refunded. Finish or cancel it first.
5. Your past orders stay for 5 years because the tax law requires it, but they no longer identify you: the name becomes "—", the phone number becomes "***", the address text becomes "—" and the comment and IP address are erased. [verify]
6. If you sign in again later with the same phone or Telegram account, you get a new, empty account.

Orders that you placed as a guest, without an account, are not tied to an account. If you want them handled, contact us.

We answer a request within [TODO: the number of days the law allows] days. [verify]

7. How we protect your data

• Phone numbers and other personal data are masked in our application logs.
• Access to the admin panel is protected by a second factor, and what staff do there is logged.
• Our database is backed up in encrypted form. [TODO: the nightly schedule and the offsite copy of the backups are not in place yet; confirm before launch]
• Limits on sign-in and on the number of requests protect against abuse.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires. [verify]

8. Where the data is stored

[TODO: state where the servers are located. The law may require personal data of citizens of Uzbekistan to be stored on servers in Uzbekistan, or the processing to be registered; confirm this before launch] [verify]

9. Cookies and analytics

This website is a read-only catalogue. It does not use advertising or tracking cookies and it does not run analytics today. If we add analytics, we will ask for your consent first. [verify]

10. Changes to this policy

When we change this policy we publish the new text here and change the date of the update. Policy version: [TODO: version identifier of this text].