Privacy Policy

1. What this document covers

AvtoSoz is a platform for car service centres and drivers: a car’s service history is opened by QR code, completed work is written to the car’s profile, and a loyalty counter is kept. This policy applies to every surface:

• AvtoSoz mobile app (Android and iOS) — for the service team: owner, administrator, reception and mechanic.
• AvtoSoz Telegram Mini App — for drivers (garage, history, QR) and for mechanics.
• Web CRM — the browser interface for running a service centre.
• avtosoz.uz website — this marketing site and its contact form.

The data controller is the AvtoSoz team (avtosoz.uz). Privacy contact: support@avtosoz.uz, Telegram @avtosoz_support.

2. Data we collect

Drivers (Telegram Mini App):

• Telegram user id, name and username (if set) — when signing in through the Mini App;
• a verified phone number — you share it once, yourself;
• vehicle data: make, model, licence plate, year, odometer reading, preferred oil brand and viscosity;
• service visit records: work performed, date, odometer, price, the mechanic’s note, and job photos when the service centre uploads them;
• loyalty counter and language preference.

Service staff (mobile app and Web CRM):

• full name, work email address, role, and the organisation/branch they belong to;
• password — stored in protected form, never in plain text;
• sign-in sessions — kept in protected storage on the device;
• an activity log: who entered which record and when.

Automatically collected technical data: request time, IP address, app and operating-system version, and error reports. These are used only for security, abuse detection and fixing faults.

What we do not collect: location, contacts, device files or photo library, advertising identifiers. The app contains no advertising networks and no third-party analytics SDKs at all.

3. Camera and microphone

The mobile app requests two device permissions, each for exactly one purpose:

• Camera — only to read the QR code a driver shows. The image is decoded on the device itself: no photo is taken, stored or uploaded. Only the decoded QR payload reaches our server.
• Microphone — records only while the voice-fill button is held down. The recording is sent to our server and from there to an AI provider, and the answer is turned into form field values. Audio is not stored in our database. The app does not listen in the background or when the button is not held.

You can revoke either permission at any time in your operating system settings. Without the camera a QR code can be entered manually; without the microphone the form is filled in by hand as usual — the app keeps working.

4. How the data is used

• to keep a car’s service history and show it to the mechanic when a QR code is scanned;
• to record completed work and keep settlements, debts and warehouse stock;
• to run the loyalty counter and determine when a reward is due;
• to send Telegram notifications about visits and rewards;
• to compute indicative suggestions for upcoming services from the history;
• to produce a service centre’s internal reporting and analytics (over its own customers);
• to keep the platform secure and detect abuse and technical faults;
• to answer your requests and to meet legal obligations.

Your data is never used for advertising and never sold.

5. Legal bases

• Performance of a contract — the data without which the service cannot work (account, vehicle, visit records).
• Consent — phone number verification, camera and microphone access. Consent can be withdrawn at any time.
• Legitimate interest — platform security, fraud prevention, fixing technical faults.
• Legal obligation — accounting, tax and other statutory requirements.

6. Artificial intelligence and third parties

Two features use external AI providers. No database records are sent to them — only what is listed here:

• Voice fill (for mechanics) — the recording is sent to an external artificial-intelligence provider together with that service centre’s own service catalogue. What the mechanic says may include a customer name, licence plate, phone number and price, so mechanics are advised to say only what the job requires.
• Upcoming-service suggestions (for drivers) — an artificial-intelligence provider receives the vehicle’s technical context (service types, dates, odometer); identifying fields such as name, phone number and licence plate are stripped out first.
• Telegram — the Mini App and bot notifications run on the Telegram platform and are subject to Telegram’s own policy.
• Hosting and file storage — servers and the cloud store that holds job photos. These providers act as processors, strictly on our instructions.

Suggestions and voice-fill results are indicative — a mechanic or user always confirms them.

The set of service providers may change over time. You can request the current list at support@avtosoz.uz.

7. Who can see your data

• A car’s history is visible to the mechanic who scanned the QR code you showed and to their organisation. The QR code is valid for 5 minutes and cannot be reused.
• The prices of work recorded by another service centre are not visible to an unrelated service centre.
• Inside a service centre, access is limited by role: owner, administrator, reception and mechanic see different screens and have different rights.
• Platform staff access data only when technically necessary (a fault, a security incident, your own request) and only to the extent needed.
• Data may be disclosed in response to a lawful request from a competent public authority.

8. Where data is stored and for how long

Data is stored on a reputable provider’s servers and is transmitted over encrypted connections (HTTPS/TLS).

• Account and related data — while the account is active and until a deletion request.
• Visit records — as part of the service centre’s accounting documents, they may be retained by that centre for the period required by law.
• Audio recordings — not stored in our database; processed only for the duration of the request.
• Technical logs — kept for a limited period, then deleted.
• Backups — deleted data may persist in backups for a short period and is then removed automatically.

9. Security

• passwords are never stored in plain text;
• sign-in uses short-lived sessions, held in protected storage on the device;
• QR codes are short-lived and cannot be reused;
• access to data is limited by the employee’s role;
• data is encrypted in transit.

No system is 100% secure. If you believe your account is at risk, write to support@avtosoz.uz immediately.

10. Your rights

• access your data and request a copy;
• correct inaccurate data;
• remove a vehicle from your garage;
• request full deletion of your account — see Account Deletion;
• withdraw a consent you have given (for example for the microphone or notifications);
• object to processing and lodge a complaint.

Send requests to support@avtosoz.uz; we handle them within 10 business days.

11. Children’s data

The platform is intended for users aged 18 and over: the mobile app is a working tool for service staff, and the Mini App is for vehicle owners. We do not knowingly collect children’s data, and the app contains no child-directed content and no advertising. If we learn that a child’s data reached us by mistake, it will be deleted — please report such a case to support@avtosoz.uz.

12. Data safety summary

The table below is a short summary aligned with the Google Play “Data safety” and App Store “App Privacy” questionnaires.

13. Changes

This policy may be updated. We will announce material changes through the Telegram bot or the app; the current version always lives on this page, with the update date shown above.

14. Contact

Privacy questions, requests and complaints: support@avtosoz.uz or Telegram @avtosoz_support. We reply within 10 business days.