Privacy Policy

1. General provisions and operator details

This Privacy Policy (the "Policy") governs how personal data of users is collected, stored, processed and protected on the Tadqiq.uz platform (the "Platform"). By using the Platform, the User confirms that they have read and accept the terms of this Policy.

Personal data is processed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (ZRU-547), as amended by ORQ-1125, and other applicable legislation.

The personal-data operator is the business entity whose details are set out below (the "Operator").

2. Terms and definitions

"Personal data" — information relating to a specific natural person or enabling their identification (for example, name, email address).

"Processing" — the collection, systematization, storage, modification, use, transfer, deletion and other operations performed on personal data.

"Subject" — the natural person (User) whose personal data is being processed.

"Operator" — the person who organizes and/or carries out the processing of personal data.

"Cookie" — small text files stored by the browser that enable the Platform to function.

3. Categories of data collected

The Operator collects data only to the extent necessary to provide the Platform’s services:

a) account and authentication data — name, email address;

b) payment data — payment metadata and (while the current flow is in effect) an uploaded payment-receipt image; the Operator does not store full bank card numbers;

c) generation inputs — topics, titles and uploaded source documents provided by the user;

d) technical and log data — IP address, technical information about the browser and device, usage logs;

e) profile and community data — the public researcher profile completed by the user, and content the user posts in the community (posts, comments).

4. Legal bases and purposes of processing

The Operator processes personal data only where a lawful basis exists and for specific purposes:

a) performance of a contract — to provide the ordered service (document generation);

b) the subject’s consent — for the public researcher profile, community features, and sending informational notifications;

c) legal obligation — to keep records of payments and fulfil other obligations arising from legislation.

Data is not processed for purposes incompatible with the purpose for which it was originally collected.

5. Third parties and processors

To provide its services, the Operator uses the following third parties (processors). Each receives, on a contractual basis, only the data necessary to perform its function:

• OpenAI — USA — text generation (user-provided topic, title and source texts)
• Supabase — Australia/Sydney (ap-southeast-2) — database and authentication
• DigitalOcean Spaces — storage of generated documents (files) (offshore cloud infrastructure)
• Payme (JSC "PAYME") — Uzbekistan — online payment acceptance and fiscalization (payment amount, order identifier; card data is processed on Payme's side only)
• Telegram — operational notifications to the administrator
• Cloudflare — protection and content delivery network (CDN) — traffic/IP data

6. Cross-border transfer and localization

Some of the processors listed above may be located outside the Republic of Uzbekistan, so data is transferred cross-border.

Under Article 27¹ of Law ZRU-547 (the ORQ-1125 amendment, in force from 27.03.2026), the mandatory in-Uzbekistan storage requirement applies only to biometric data, genetic data, and data of users of telecom-operator services. The Platform does not collect data of these categories.

For cross-border transfers, the Operator relies on the following data-protection measures: contractual arrangements with the processors, encryption in transit and at rest, and access controls. The Operator does not assert that any country is on an "adequate protection" list or that any specific cross-border transfer condition has been satisfied.

7. Processing by artificial intelligence

To provide the document-generation service, the data entered by the User — topic, title and keywords — is processed by an artificial-intelligence provider (OpenAI). This processing is necessary for the performance of the contract (delivering the ordered service).

The Operator does not make any decision affecting the User’s rights or legitimate interests automatically and solely on the basis of the output of an artificial-intelligence system.

Users are advised not to enter third parties’ personal data or confidential information into the Platform without a lawful basis for processing it.

8. Retention period and deletion

Personal data is retained for as long as necessary to achieve the purposes for which it was collected, or for the period established by legislation.

When a User deletes their account, their personal data is deleted or anonymized within 30 (thirty) days, except for data whose retention is required by legislation (for example, data relating to financial records).

9. Security measures

The Operator implements organizational and technical measures to protect personal data against unauthorized access, alteration, disclosure or destruction.

Such measures include encryption in transit and at rest, access controls, and the use of private file-storage buckets in which generated documents are stored.

10. Rights of the subject

The User has the following rights in respect of their personal data:

a) to be informed about the processing of their data and to access (review) it;

b) to request correction of inaccurate or outdated data;

c) to request deletion of the data;

d) to withdraw consent to processing.

To exercise these rights, the User may delete their account or contact the Operator through the channels set out below.

11. Cookies and analytics

The Platform uses cookies to enable its operation, maintain authentication and carry out usage analytics.

The User may manage or disable cookies through their browser settings; however, this may affect the operation of certain Platform features.

12. State registry registration

Under applicable legislation, personal-data databases may be subject to registration in the state registry in the established manner.

The Operator complies with this requirement in the manner and to the extent established by the legislation of the Republic of Uzbekistan.

13. Minors

To use the Platform’s services, a person must be at least 16 (sixteen) years old; persons under 16 should not use the Platform. The Operator does not knowingly collect the personal data of persons under this age.

14. Changes to the Policy

The Operator reserves the right to amend this Policy unilaterally. A new version takes effect from the moment it is published on the Platform, and the "last updated" date is updated accordingly.

The User’s continued use of the Platform constitutes acceptance of the amended Policy.

15. Governing language and contact

This Policy is provided in Uzbek, Russian and English. In the event of any discrepancy, the Uzbek-language text prevails.

For questions regarding personal data, you may contact the Operator via @tadqiq_admin (Telegram) or by email at [email protected].

Matters not regulated by this Policy are governed by the legislation of the Republic of Uzbekistan.