Privacy Policy

Operator: PRODUCTLAB LLC, Republic of Uzbekistan, Samarkand, Konigil MFY, Samarqand darvozasi street, 49. For personal-data matters contact: privacy@ayva.plus. General support: support@ayva.plus.

The Operator’s full details (registered address, tax ID, banking details) are set out in the Public Offer and are available on request.

We follow the principle of minimization and collect only the data necessary to operate the Service:

• Account data: phone number (in +998 format), email address, name, and Telegram identifier — depending on the chosen sign-in method. We support sign-in via one-time code (SMS/email) and via Telegram.
• Profile data you provide voluntarily: name, profile photo (avatar), date of birth, chosen city and interface language.
• Device data: device identifier, platform (iOS/Android/web), app and operating-system version, push-notification token (Firebase Cloud Messaging).
• Subscription and payment data: chosen plan, subscription status and history, payment status and amount, masked card number (last digits) and payment token. We do not receive or store the full card number, expiry date or CVV — this data is processed by the Click and Payme payment systems.
• Purchase and savings data: purchase amount at a partner, the discount applied, the amount saved and the points earned when using the QR code.
• Technical logs and security data: information about logins and sessions (including for fraud and code-guessing protection).

We do NOT collect: gender, home address, passport data, precise device geolocation (GPS), and we do not use third-party analytics or advertising trackers. The App does not scan QR codes with the camera — you only show your own QR code to the partner’s cashier.

We process personal data for the following purposes:

• User registration and authentication, creating and maintaining an account.
• Providing the subscription and access to partner discounts, generating and validating the QR code.
• Processing payments and auto-renewing the subscription via payment systems.
• Accounting for savings, transactions and bonus points.
• Sending service and informational push notifications (e.g. subscription and payment status) and, with consent, marketing messages.
• Providing user support and responding to enquiries.
• Ensuring security, preventing fraud and abuse, and complying with legal requirements.

The legal bases for processing are: your consent; the necessity to perform the contract (the Public Offer) to which you are a party; and compliance with obligations under the legislation of the Republic of Uzbekistan.

We do not sell personal data. We share data with a limited set of service providers only to the extent necessary to operate the Service:

• Click and Payme payment systems — to process payments and tokenize bank cards.
• Eskiz (eskiz.uz) — to send SMS with one-time confirmation codes.
• Email provider — to send emails with confirmation codes.
• Google Firebase Cloud Messaging — to deliver push notifications.
• Telegram — when signing in via the Telegram bot.
• Cloud infrastructure and file-storage provider (including storing uploaded profile images).
• Ayva Plus partners — receive only the fact of an active subscription and the right to a discount at the moment the QR code is presented, without access to your contact details.

Maps are rendered using OpenStreetMap/Carto map tiles; address geocoding may be performed via the OpenStreetMap Nominatim service. All providers process data under agreements and are required to keep it confidential.

Personal data of citizens of the Republic of Uzbekistan is processed and stored using technical facilities located in the territory of the Republic of Uzbekistan, as required by law. Certain technological operations (push-notification delivery, payment processing) may be performed by service providers; in such cases the transfer is carried out on a lawful basis and in compliance with confidentiality requirements.

We store personal data no longer than necessary for the purposes of processing:

• Account data — for the lifetime of the account and until it is deleted.
• One-time confirmation codes — temporarily (usually up to 10 minutes).
• Payment, subscription and transaction data — for the periods established by tax and accounting legislation, even after the account is deleted.

We apply organizational and technical safeguards: encryption of transmission channels (TLS), storing tokens and codes in a protected form (hashing), restricting access to data, rate-limiting requests and protecting against code guessing. When images are uploaded we strip metadata (including EXIF geodata). Full bank-card details are not accessible to us.

In accordance with the legislation of the Republic of Uzbekistan you have the right to:

• obtain information about the processing of your personal data;
• request clarification, updating or correction of inaccurate data (including yourself in the profile);
• withdraw consent to processing and request that processing be stopped;
• request deletion of data if it is processed in breach of the law;
• file a complaint with the authorized state body.

To exercise your rights, write to privacy@ayva.plus. We will consider the request within the periods established by law.

You can delete your account directly in the App (Profile → Delete account). Upon deletion we revoke sessions, remove sign-in method links and anonymize contact data (phone, email, name, date of birth).

Payment, subscription and transaction data is retained in anonymized form to the extent necessary to comply with financial, tax and accounting legislation.

The Service is not intended for persons under 18. Subscribing assumes legal capacity and the right to make payments independently. If we learn that data was provided by a person below the required age, we will delete such data.

Service notifications (subscription, payment, transaction status) are necessary to operate the Service. Marketing and advertising messages are sent only with your consent; you can turn off push notifications in your device or app settings at any time.

We may update this Policy. The current version is always available in the App and on the website with the update date. In case of material changes we will notify you by available means. Continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.