Privacy Policy (personal data processing policy)

1. General provisions

1.1 The Operator is BUYSALE LLC, STIR (taxpayer identification number): 313346068, legal address: Xorazm viloyati, Urganch shahri, Tozabog’ MFY, Obodlik ko’chasi, 27-uy, 11-xonadon, postal address: Xorazm viloyati, Urganch shahri, Tozabog’ MFY, Obodlik ko’chasi, 27-uy, 11-xonadon. The Operator provides the BuySale service and processes the personal data described in this Policy.

1.2 The BuySale service (the “Service”) is a cloud accounting program for small shops: point of sale, stock, debt notebook, suppliers, employees and their permissions, reports, barcode scanning, label and receipt printing, and an AI assistant. The Service is not a fiscal cash register: it does not issue fiscal receipts and is not connected to the information systems of the tax authorities.

1.3 The Policy applies to all parts of the Service: the website https://buysale.uz, the web app https://app.buysale.uz, the BuySale Android app and the BuySale Telegram bot. The Policy does not apply to services of other companies that you use yourself (the Telegram app itself, bank and payment apps, your browser); they have their own rules.

1.4 Terms of the Public Offer (User, Contract, Account (cabinet), Balance, Daily Fee) have the same meaning in this Policy, including where they are written in lower case. In addition, the following terms are used:
1) shop owner — the person who accepted the Public Offer and opened an Account with a phone number (the User under the Public Offer);
2) employee — a person whom the shop owner added to the Service and who logs in with the shop’s phone number and a PIN code;
3) shop customer — a buyer, including a debtor, whose data the shop owner or an employee entered into the Service (the Customer under the Public Offer);
4) supplier — a person who supplies goods to the shop and whose data the shop owner or an employee entered into the Service;
5) administrator — a person authorised by the Operator to manage and support the Service;
6) website visitor — a person who visits the buysale.uz website;
7) data subject — the individual whose personal data is processed;
8) you — the data subject to whom the Policy is addressed (mainly the shop owner).
The terms “personal data”, “processing”, “owner of a personal database (mulkdor)”, “operator”, “third party”, “cross-border transfer” and “destruction” have the meaning given in Law No. ZRU-547. Periods are counted in calendar days unless they are stated as working days.

1.5 When the shop owner first logs in to the app, and when a new version of the document is published (clause 12.3), the shop owner personally ticks the box “Ommaviy oferta va maxfiylik siyosatini o‘qidim, shartlariga roziman” (“I have read the Public Offer and the Privacy Policy and agree to their terms”) and presses the “Tasdiqlash va davom etish” (“Confirm and continue”) button. The box is not ticked in advance. An employee cannot give the confirmation. Accepting an offer that clearly states the purposes of processing counts as the data subject’s consent to the processing of their personal data (the second paragraph of point 9 of the Model Procedure for Processing Personal Data approved by Order No. 20-mh of the Minister of Justice of 15 November 2023 (the “Model Procedure”)). This consent covers processing of the data listed in section 2 for the purposes in section 3, disclosure of that data to the persons listed in sections 4 and 5, and cross-border transfer (Telegram; Cloudflare, Inc.; and, when AI features are used, Anthropic PBC, USA). The consent is valid for the term of the Contract and until the retention periods in section 6 end, and it can be withdrawn under section 8.

1.6 Each confirmation is stored as a separate record: the shop, the phone number at the time of confirmation, the document version, the IP address, device and browser information (user agent), the channel (app or Telegram), the time of confirmation (UTC), the language in which the document was shown, a digital fingerprint (SHA-256) of the text of the published documents, and a unique confirmation number. This record is needed to prove that the terms were accepted.

1.7 The Policy is published in Uzbek and Russian; an English translation may also be provided for information. The Uzbek text is the primary text, and the Russian and English texts are its translations. If the texts differ, the Uzbek text prevails.

1.8 The Policy is approved by the head of the Operator, Direktor Abdullayev Akbar Alisherovich, and published at https://buysale.uz/maxfiylik/ (in Russian: https://buysale.uz/ru/maxfiylik/). Effective date: 10 October 2026. Version number: 1.1.

2. What data is processed

2.1 The Operator collects the data needed for the Service to work. Most of the data is entered by the shop owner and employees themselves; some of it is created automatically while the Service is used or comes from Telegram.

2.2 About the shop owner: phone number (to log in to the account); shop name and type; name, shop address and the shop’s bank card number, if entered (the card number is shown to customers on receipts for sales on credit); interface language; when linked to Telegram, the Telegram user identifier (ID), chat identifier, and name and language in Telegram; report and notification settings; who invited the shop (invitation code); information on the balance, trial period and paid days.

2.3 About employees: name; 4-digit PIN code (the shop owner can see it in plain form in the app); role and permissions; whether the employee is active; times of logging in to the Service; which employee performed which action (sale, debt, stock intake, shift and others); if the employee uses the AI assistant, their conversations with it.

2.4 About shop customers: name; phone number (required to record a debt); language; note; credit limit and a flag that bans sales on credit; reminder mode and reminder log (with the message text); debts (amount, paid part, goods or note, repayment date) and payments; history of purchases and returns of goods; in phone shops, the IMEI number of the device sold and warranty details; if the customer connects to the Telegram bot themselves, their Telegram identifier. The customer’s reliability rating based on payment discipline (“Ishonchli” (reliable), “Ehtiyot bo‘ling” (be careful), “Xavfli” (risky), “Yangi mijoz” (new customer)) is not stored: it is calculated each time only from the payment history within that shop and is not shown to other shops.

2.5 About suppliers: company name or personal name; phone number; debts owed to the supplier; orders and notes on them; if the supplier connects to the Telegram bot through a link sent by the shop, the Telegram identifier, chat identifier, and name and language in Telegram.

2.6 The shop’s trading data: goods (name, barcode, price, cost price, stock, expiry date, photo), sales and payment methods, returns, expenses, cash shifts, stocktaking, orders. This data is usually not personal, but it can become personal data when linked to a customer, employee or supplier. The product names and barcodes you enter may be used to fill the Service’s shared product catalogue for all shops; no customer, employee or supplier data goes into the catalogue.

2.7 About payments: balance movements (top-ups, daily fees, amounts charged for AI requests, refunded payments, corrections), payment method, the payer’s name and the payment document number (if given). For payments through the Rahmat payment page, the Operator keeps: the masked card number (only the first 6 and last 4 digits are visible), the names of the card-issuing bank and of the payment system (for example, Uzcard or Humo), the payer’s identifier in the payment organisation’s system (if provided), the order and transaction numbers, the top-up amount, the payment commission and the total amount paid, the date and time of the payment and of any refund, the payment status (for example, paid, rejected or refunded), the link to and number of the fiscal receipt, and the sales agent’s phone number if it was voluntarily entered when paying. This data is also kept in the log of messages exchanged with the payment organisation (clause 6.6); before an entry is written to the log, the card number is masked and the payer’s phone number, e-mail address, identity and device data and the card token are removed. The full card number, its expiry date, the CVV code and confirmation codes are entered only on the Rahmat page; the Operator does not ask for, receive or store them (clause 4.11). Photos of balance top-up receipts (sent before the effective date of this version or in the cases provided for in clause 5.13 of the Public Offer), the amount, note and sales agent’s phone number entered with them, the receipt status and the administrator’s comment are kept for the periods in section 6; a receipt photo may contain details shown by the bank.

2.8 AI assistant and label reading: the text of questions and AI answers, the conversation title, photos attached to a question (up to 6 per question), drafts prepared by the AI (stock intake drafts, price change proposals) and the price change history, usage statistics (model, volume, cost). This also applies to questions asked through the Telegram bot. A photo sent for label reading is not stored on the server; only a usage record remains.

2.9 Technical data: the terms confirmation record (clause 1.6); IP address (stored in the confirmation record, and used only temporarily, in server memory, to limit the number of attempts); device and browser information (user agent); employees’ login times; barcode scanner diagnostics (camera name, which may reveal the phone model, camera settings, number and time of scans), sent automatically when the scanner is closed; session token (stored on your device, section 10); server technical logs.

2.10 Camera, microphone and location: barcodes are recognised through the camera on the device itself, and the camera image is not sent to the server; a photo reaches the server only when you send it yourself (payment receipt, product photo, label, photo for the AI). With voice input, speech is turned into text by the speech recognition service of your browser or device (for example, Google Chrome may send the voice to Google servers for this); the Operator does not receive or store the audio, and only the finished text reaches the server. Location (geolocation) data is not collected. The Android app asks only for internet and camera permissions.

2.11 About Telegram bot users: the phone number, Telegram identifier, chat identifier, and Telegram name and language of every person who shared their phone number with the bot, even if that person has not opened a shop; messages sent to the bot (for example, debt entries and questions) are processed in the Service.

2.12 About website visitors:
1) through the contact form — name, phone number, shop type, message, language, the page from which the form was sent, and browser information;
2) through the website AI assistant — questions and answers, page, language, and a shortened hash of the IP address for the daily limit. The IP address itself is not stored, but the hash can also indirectly identify a person;
3) to limit the number of requests to the form and the AI assistant, the IP address is used only temporarily, in server memory;
4) analytics data — see section 10.

2.13 The Operator does not aim to collect special personal data (data about health, religious or political beliefs, criminal records and the like) or biometric and genetic data. Do not enter such information in note fields. In a pharmacy, purchases recorded against a customer may reveal information about their health; in such cases clause 9.3 applies.

3. Purposes and legal grounds for processing

3.1 The Operator processes personal data on the following grounds provided for in Article 18 of Law No. ZRU-547: 1) performance of a contract to which the data subject is a party (the Public Offer), or steps taken at the data subject’s request before such a contract is concluded; 2) the data subject’s consent; 3) performance of the Operator’s obligations established by law; 4) exercise of the rights and legitimate interests of the Operator or a third party, provided the data subject’s rights are not violated (“legitimate interest”).

3.2 Opening an account, logging in and identifying the user (sending the login code, letting an employee in with a PIN code, maintaining the session) — performance of the contract.

3.3 Providing the Service’s functions: point of sale, stock, debt notebook, suppliers, employees, reports, export, label and receipt printing — performance of the contract. The Operator processes the data of the shop’s customers, employees and suppliers on the shop owner’s instructions (section 9).

3.4 Sending messages through Telegram: to the shop owner — login codes, alerts about employee logins and attempts to guess a PIN code, alerts that the balance is running out, the evening financial report, AI answers (ground: performance of the contract and legitimate interest, namely security); to a customer — receipts, purchases and the remaining debt, and to a supplier — orders (ground: their consent, expressed by connecting to the bot themselves).

3.5 Keeping records of the balance and payments, accepting payments through the Rahmat payment page, checking their status with the payment organisation and recording refunded payments, checking previously sent payment receipts, calculating referral and agent bonuses — performance of the contract; keeping payment documents — performance of obligations established by law. Showing sales agents the name, owner’s name, phone number and balance of the shops they connected — to calculate the agent’s reward and to help the shop, the Operator’s legitimate interest (clause 4.10).

3.6 The AI assistant and label reading are optional features. For them, data is sent to the AI provider (clause 4.3) only when you or your employee use that feature. Ground: performance of the contract and the consent expressed by using the AI feature (clauses 4.4 and 4.8).

3.7 Support, finding and fixing faults, resolving payment questions — performance of the contract and legitimate interest.

3.8 Security: limiting the number of attempts, detecting abuse and unauthorised access, recording administrators’ actions in the audit log — the legitimate interest of the Operator and of data subjects.

3.9 Improving the Service: scanner diagnostics, AI usage statistics, website visit statistics — legitimate interest.

3.10 Replying to a request received through the website and advising on the Service — steps taken at the data subject’s request before a contract is concluded; answers of the website AI assistant — the visitor’s request and legitimate interest.

3.11 Proving acceptance of the terms, resolving disputes, complying with lawful requests of state bodies — legitimate interest and obligations established by law.

3.12 The Operator does not sell personal data, does not give it to third parties for advertising and does not use it for purposes not stated in the Policy. If the purpose of processing changes, the Operator obtains the data subject’s consent to process their data for the changed purpose (Article 19 of Law No. ZRU-547).

3.13 The Operator does not make decisions that have legal consequences for a data subject based solely on automated processing. The customer reliability rating and AI suggestions are supporting information for the shop owner; the decision whether to sell to a customer on credit is made by the shop owner or an employee.

4. Where data is stored and to whom it is transferred

4.1 The Service’s database and uploaded files (photos) are stored on servers physically located in the Republic of Uzbekistan. Backup copies of the data are also stored in Uzbekistan.

4.2 For the Service to work, some data is transferred to, or passes through, the recipients listed below. Some of them process data outside Uzbekistan, which is a cross-border transfer under Article 15 of Law No. ZRU-547. The Operator gives them only the data needed for the relevant function to work and keeps its legal obligations to protect the data. This section is prior written notice that data is provided to the recipients listed in it. If a new recipient is added, the Policy is amended in advance under section 12, and in any case data subjects are notified through the channels listed in clause 12.2 no later than 3 days after data is first provided to that recipient (Article 23 of Law No. ZRU-547).

4.3 Anthropic PBC (United States of America) provides the Claude models for the AI assistant and label reading. Data is sent only when the following features are used: the AI assistant in the app; AI answers in the Telegram bot; reading a product label from a photo; the AI assistant on the buysale.uz website. Anthropic PBC may keep the data it receives for the period set in its own terms; the Operator does not set that period.

4.4 The following data is sent to Anthropic PBC:
1) in the AI assistant in the app and in the Telegram bot — the question text, attached photos, earlier messages of the same conversation, and the shop data the AI retrieved from the Service to answer: goods and stock, sales (sales receipts: list of goods, amount, payment method, customer’s and seller’s names), expenses, profit and cost price (if the person asking has that permission), employees’ names and performance figures, the balance; depending on the question — customers’ names, phone numbers, debt amounts, repayment dates and notes, suppliers’ names and phone numbers. In a pharmacy these lists may reveal information about a customer’s health (clauses 2.13 and 9.3);
2) in label reading — the photo of the label;
3) in the website AI assistant — the messages the visitor writes, the page address and the language. The IP address and shop data are not sent; the assistant answers only from the website’s content.

4.5 Telegram — login codes, notifications and reports to the shop owner, AI answers, receipts and debt information to customers, and orders to suppliers are sent through the Telegram Bot API. Telegram receives the message text and the recipient’s Telegram identifier. From Telegram, the Operator receives the user identifier, chat identifier, name, language and the phone number the user shared themselves. When the app page opens, a Telegram script is loaded from telegram.org, and Telegram receives your IP address and browser information. Telegram processes data under its own rules, including outside Uzbekistan; the Operator does not determine in which country the data is processed.

4.6 Cloudflare, Inc. (United States of America) — all domains of the Service (buysale.uz, app.buysale.uz and others) run through the Cloudflare network (Cloudflare Tunnel). All requests and responses between your device and the Service’s server, including the personal data in them, your IP address and browser information, pass through the Cloudflare network: the encrypted connection from your device ends in the Cloudflare network and continues to the server through a tunnel. The Cloudflare network consists of data centres in various countries. The Operator does not store the database on Cloudflare servers. Uploaded photos (payment receipts, product photos and photos for the AI) may be kept temporarily, for up to 24 hours, in the Cloudflare network and in your browser cache.

4.7 The buysale.uz website also uses the following services: Yandex Metrica (Yandex, Russian Federation) — for visit statistics and recording actions on the page; Google Fonts (Google LLC, United States of America) — for loading fonts, during which Google receives your IP address and browser information. Details are in section 10. These services are not used in the app (app.buysale.uz).

4.8 Using AI features is optional. When you use them, the data listed in clause 4.4, including personal data of the shop’s customers, employees and suppliers, is transferred to the USA. By using an AI feature, you (the shop owner or an employee) confirm that you are aware of this transfer and consent to the cross-border transfer of your own personal data to the USA. Ask the AI assistant about the data of the shop’s customers, employees and suppliers only if the shop owner has obtained their consent to cross-border transfer (Article 15 of Law No. ZRU-547); without such consent, do not ask the AI assistant about sales receipts, customers, debts, suppliers or employees. If you do not want any data to be transferred to the USA:
1) do not use the AI assistant in the app or label reading from photos;
2) do not send the Telegram bot anything other than debt entries. The bot passes the following messages to the AI assistant: a message ending with “?”; a message starting with the command /savol, /савол, /ai or /вопрос; a message written as a reply to a bot message; any other message not recognised as a debt entry;
3) remove the “AI yordamchi bilan gaplashish” (“Talk to the AI assistant”) permission from employees and tell them not to use AI features. The button for reading a label from a photo is available to employees with the “Tovar qabul qilish (kirim)” (“Receive goods (stock intake)”) permission and cannot be switched off separately;
4) do not write personal data to the AI assistant on the website.

4.9 Processing through Telegram and Cloudflare is necessary for the basic operation of the Service: the login code is sent only through Telegram, and the Service can be reached only through the Cloudflare network. Therefore this processing cannot be refused while using the Service.

4.10 BuySale sales agents (persons who offer the Service to shops) see the name, owner’s name, phone number and balance of the shops connected through them. If the shop owner voluntarily enters an agent’s phone number when topping up the balance, the shop is linked to that agent: for a payment by receipt, when the receipt is approved; for payments through the Rahmat payment page, when the total of the shop’s payments through that page reaches the agent reward amount set by the Operator. Agents cannot enter a shop’s cabinet. Agents must use this data only for the purpose stated in clause 3.5 and must not disclose it (Article 28 of Law No. ZRU-547).

4.11 Multicard Payment JSC (Republic of Uzbekistan) is a payment organisation; it accepts payments to top up the balance through the Rahmat payment page and generates the fiscal receipts for them. Card details (card number, expiry date, CVV code) and payment confirmation codes are entered only on the Rahmat page; they are processed by the payment organisation and the card-issuing bank under their own rules and the law, and the Operator does not receive them. The Operator gives the payment organisation only the payment amount, the order number and the technical data needed to open the payment page (for example, the language and the return address) and, for the fiscal receipt, may also give the name of the service, its tax classification codes and the Operator’s taxpayer number (STIR); the shop name, phone number and other shop data are not transferred. The Operator receives from the payment organisation the payment details listed in clause 2.7. The payment organisation keeps data for the period set by law and its own rules; the Operator does not set that period. The payment organisation’s own rules apply to the use of the Rahmat page (clause 1.3).

4.12 The Operator provides data to state bodies at their request on the grounds established by law. The data subject is notified, unless the law prohibits it.

4.13 Personal data is given to third parties not listed in this section only with the data subject’s consent or in cases provided for by law.

4.14 With voice input, speech is converted to text by the speech recognition service of your browser or device maker (for example, Google or Apple) (clause 2.10). The Operator does not transfer or receive this data: your browser or device sends it under its own rules. If you do not want this, do not use voice input.

5. Administrators’ access to shop data

5.1 Through the administrative panel, administrators can view the following shop data: shop profile; balance and payments; photos of payment receipts; the shop activity feed (sales and debts with the customer’s name, the customer list and their phone numbers, suppliers, goods, logins, employees, AI usage statistics without the text of questions); the reminder log (debtor’s name, phone number and message text). Administrators can change the shop name, the owner’s name and the login phone number. They also see website contact requests and records of the website AI assistant.

5.2 An administrator can also enter a shop’s cabinet. The app then opens with the shop owner’s rights, without a login code, for up to 2 hours. Inside the cabinet the administrator sees all the shop’s data, including AI conversations, and can perform actions on behalf of the shop owner.

5.3 Such access is made only for the following purposes: helping at the request of the shop owner or an employee; finding and fixing faults; checking and correcting payments and the balance; investigating security incidents or abuse of the Service; complying with legal requirements. While in the cabinet, an administrator does not confirm the Public Offer or the Policy on behalf of the shop owner.

5.4 Every entry into a cabinet is recorded in the Operator’s internal audit log: which administrator entered which shop and when. Changes made in the administrative panel (blocking, changing the balance, changing shop details and settings, deletion) are also written to this log. Viewing data in the administrative panel is not separately logged. Actions performed inside the cabinet appear in the shop’s history as the shop owner’s actions.

5.5 The Operator does not separately notify the shop owner of each view or entry into the cabinet by an administrator. By accepting this Policy, the shop owner confirms awareness of this possibility of access. Under section 8, the shop owner may request information on who entered their shop’s cabinet and when.

5.6 Administrators work under a personal account with an assigned role. They must use data only to perform their duties and must not disclose it (Articles 12 and 28 of Law No. ZRU-547).

6. Retention periods and destruction

6.1 Personal data is kept until the purpose of processing is achieved (Article 10 of Law No. ZRU-547). While the shop account is active, shop data is kept until the shop owner or an employee deletes it, unless this section sets another period. Once the purpose is achieved, data is destroyed within 3 days unless this section sets another period (point 23 of the Model Procedure).

6.2 Inactive accounts: if the Service is suspended (the balance is zero or negative, clause 5.6 of the Public Offer) and after that, for 6 months, the balance is not topped up, the app is not used (by the shop owner or an employee) and no entries are made through the Telegram bot, the Operator deletes the shop account and its data, except the data listed in clause 6.4. At least 30 calendar days before deletion, a warning is sent through the Telegram bot (if the bot is connected) and shown in the app. If, before the deletion date, the balance is topped up, the app is used or an entry is made through the Telegram bot, the deletion is cancelled.

6.3 The shop owner may request deletion of the account and shop data through the channels listed in clause 8.4. The Operator verifies the applicant’s identity (clause 8.5) and deletes the data no later than the working day after the day the request is received, except the data listed in clause 6.4; if the identity cannot be confirmed, the applicant is informed within the same period. Deletion cannot be undone. In the app you can download sales reports and expenses (CSV) and the stock list (XLSX); the app cannot yet download lists of customers, debts, suppliers and employees, so if you need them, ask for a copy through the channels in clause 8.4 before requesting deletion. The question of the remaining balance is settled under the Public Offer.

6.4 The following is kept even after the account is deleted:
1) records of payments and balance movements (for payments through the Rahmat payment page, with the total amount paid, the payment commission, the masked card number and the transaction number), payment receipts (with their photos) and a copy of the deleted shop’s record (shop name and type, phone number, owner’s name, address, card number, Telegram identifier and settings) — for accounting and as evidence in disputes, for 5 years after the end of the relevant year;
2) terms confirmation records — for the term of the contract and 5 years after it ends;
3) the audit log of administrators’ actions (with the shop’s name and phone number) — for 5 years from the date of the entry;
4) if there is a dispute or a request from a state body — the necessary data until the dispute is resolved or the request is fulfilled.
This data is not used for any other purpose.

6.5 AI conversations: conversations not updated for 30 days are deleted automatically every day. The exception is each shop’s 20 most recent conversations (counted separately per employee and channel): they are kept regardless of age until you delete them or the account is deleted. Photos attached to messages sent to the AI assistant are deleted after 30 days in any case. Unconfirmed stock intake drafts are deleted after 7 days. You can delete conversations yourself in the app at any time.

6.6 Other periods: login code — 5 minutes, in server memory only; attempt counters (which may contain a phone number or IP address) — up to 2 days, in server memory only; scanner diagnostics — the latest 200 records per shop; the employee login log (with the employee’s name, even if the employee was deleted), the reminder log, AI usage statistics and the price change history — until the shop account is deleted; the log of messages exchanged with the payment organisation about payments through the Rahmat payment page (with the data listed in clause 2.7) — 365 days from the date of the entry, even if the shop account is deleted.

6.7 When an account is deleted, the following is not deleted automatically and is deleted at the data subject’s request through the channels in clause 8.4: the Telegram link record (phone number and Telegram identifier); product photos uploaded to the server and files of photos sent to the AI. Barcodes and product names added by the shop remain in the shared product catalogue (clause 2.6); they contain no personal data.

6.8 Website contact requests and records of the website AI assistant are kept for 12 months and then deleted.

6.9 Backup copies are used only to restore data after a failure. Data deleted from the main database may remain in backup copies until they are replaced; this period is no longer than 30 days.

6.10 If the law sets a different retention period, that period applies.

7. Protection measures

7.1 The Operator takes legal, organisational and technical measures to protect personal data (Article 27 of Law No. ZRU-547). The following measures are currently used in the Service.

7.2 Login code: the shop owner logs in with a 6-digit one-time code. The code is valid for 5 minutes and is sent only through the Telegram bot. The code is not sent by SMS. When the app is opened inside Telegram, the shop account linked to the Telegram account is entered without a code, using data signed by Telegram.

7.3 Attempt limits: if a login code, an employee PIN code or the administrative panel password is entered incorrectly several times, access is temporarily blocked to protect against guessing. The shop owner receives a Telegram alert about attempts to guess an employee’s PIN code. The number of login code requests and of requests to the website form and the website AI assistant is also limited.

7.4 Session: after login, the device receives a signed token valid for 30 days. On every request the Service checks again that the shop is not blocked, that the employee is active and what permissions they have, so a deactivated employee loses access on the very next request.

7.5 Permissions: an employee works only within the permissions given by the shop owner. The balance, the employee list and the referral programme are available only to the shop owner; cost price and profit are not shown to an employee without that permission; changing data through the AI requires a separate permission.

7.6 Notifications: when an employee logs in to the Service, a message is sent to the shop owner through Telegram (this setting is on by default and can be changed in the app).

7.7 Administrators: each administrator logs in to the administrative panel with a personal login and password; passwords are stored as hashes, not in plain text; access rights are limited by role; entries into shop cabinets and administrative changes are written to the audit log.

7.8 Connection and Telegram: connections to the website and the app use the HTTPS protocol; requests coming from Telegram are checked with a secret key, and logins from inside Telegram are checked with Telegram’s signature.

7.9 Person responsible for processing and protecting personal data: Nazarov Kamronbek Rasulovich, hammuassis.

7.10 No system can guarantee complete security. To protect your account: turn on two-step verification in your Telegram account; never give the login code to anyone — the Operator’s administrators never ask for it; do not show employees’ PIN codes to outsiders; deactivate or delete an employee who has left straight away; log out after working on someone else’s device.

8. Data subjects’ rights and how to make a request

8.1 A data subject (shop owner, employee, shop customer, supplier, website visitor) has the following rights under Law No. ZRU-547 (including its Articles 11, 17, 21, 22, 30 and 31):
1) to know whether the Operator holds their personal data and what it consists of;
2) to receive information about the processing on request;
3) to receive information on the conditions for giving access to their data;
4) to demand that the data be changed and completed;
5) to demand that processing be temporarily suspended if the data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the purposes of processing;
6) to withdraw consent;
7) to demand destruction of the data in cases provided for by law;
8) to apply to the authorised state body or to a court.

8.2 Information provided on request (Article 22 of Law No. ZRU-547): confirmation that data is being processed; the grounds, purposes and methods of processing; the Operator’s name and postal address; persons who have access to the data; the composition and source of the data; processing and retention periods; the procedure for exercising rights; information on cross-border transfer.

8.3 In the app, the shop owner can personally: change the shop name, their own name, address, language and card number; delete customers (if they have no open debt), employees, goods, expenses, orders and AI conversations; download sales reports and expenses (CSV) and the stock list (XLSX). Changing the login phone number and deleting the account are done through support.

8.4 Ways to send a request: Telegram — https://t.me/arabicone_admin; phone — +998 91 267 06 06, +998 93 922 88 89; email — [email protected]; written application — Xorazm viloyati, Urganch shahri, Tozabog’ MFY, Obodlik ko’chasi, 27-uy, 11-xonadon. An application to temporarily suspend processing or to destroy data can be sent electronically (through Telegram or by email).

8.5 To protect other people’s data, the Operator verifies the applicant’s identity: for example, it asks for the request to be sent from the Telegram account linked to the shop’s phone number, or for confirmation of additional details related to that number. Requests are handled free of charge.

8.6 Deadlines:
1) changing and completing data — no later than 3 days after the application is submitted (Article 11 of Law No. ZRU-547);
2) if providing information is refused — a written notice of this is sent within 10 days (Article 22 of Law No. ZRU-547);
3) when consent is withdrawn — data is destroyed no later than the working day after the day the application is received, except data that must be kept by law (clause 6.4) (point 10 of the Model Procedure);
4) data processed in breach of the law — destroyed within 1 working day after the demand is received (point 24 of the Model Procedure);
5) other requests — answered no later than 10 days.
The applicant is informed in writing (electronically) that the data has been changed or destroyed.

8.7 If consent to the processing of data necessary to provide the Service is withdrawn, or that data is deleted, the Service can no longer be provided, and the contract is terminated in the manner set out in the Public Offer.

8.8 If a data subject believes their rights have been violated, they may apply to the authorised state body for personal data — the Department of Migration and Personalisation under the Ministry of Internal Affairs of the Republic of Uzbekistan (https://pd.gov.uz) — or to a court. It is not mandatory to contact the Operator before applying to the authorised state body, but many issues can be resolved faster that way. Disputes between the shop owner and the Operator arising from the contract are resolved in the manner set out in the disputes section of the Public Offer.

9. Data of the shop’s customers, employees and suppliers

9.1 The data of the shop’s customers, employees and suppliers is entered into the Service by the shop owner or employees. The shop owner decides what data to enter, about whom and why. By agreement of the parties, for this data the shop owner is the owner (mulkdor) of the personal database, and the Operator processes it on the shop owner’s instructions and only to provide the Service (part three of Article 31 of Law No. ZRU-547).

9.2 The Operator uses this data only to provide the Service: it does not use it for its own purposes, does not sell it, does not give it to persons other than those listed in section 4, and does not contact the shop’s customers or suppliers on its own initiative. A customer or supplier receives Telegram messages only if they connected to the bot themselves. The Operator protects this data too, in line with the law (section 7).

9.3 The shop owner must:
1) have a lawful basis for entering the data (for example, a credit sale agreement with the customer or the data subject’s consent);
2) when entering the data of a customer, employee or supplier into the database, notify them in writing of the purposes of processing and of their rights under Article 30 of Law No. ZRU-547 (Article 23), including that the data is stored in the BuySale service and may be transferred to a provider in the USA if the shop owner or an employee uses AI features (sample text — clause 9.8);
3) if the shop owner or an employee uses AI features with their data, obtain their consent in advance to the transfer of their data to the USA (clause 4.8);
4) for data of minors, obtain the written consent of a parent or other legal representative (Article 21);
5) process special personal data (for example, information about a customer’s health in a pharmacy) only with the data subject’s written consent, including consent in electronic form (Articles 21 and 25);
6) correct and delete data promptly at the data subject’s request.

9.4 Employees: an employee’s PIN code is visible to the shop owner in plain form; an employee’s login times and actions are recorded and visible to the shop owner; if the setting in clause 7.6 is on, the shop owner receives a Telegram message when an employee logs in. The shop owner must tell employees about this in advance.

9.5 Connecting a customer to the Telegram bot: the shop owner or an employee sends the customer a special link (by copying it, through Telegram or through the phone’s own SMS app — in that case the SMS is sent from the shop owner’s or employee’s own number). After the customer opens the link and starts the bot, a receipt for each purchase is sent to them automatically, and they can see their purchases and remaining debt in the bot. The link does not expire. Any Telegram account that opens the link sees the customer’s purchases and remaining debt and receives later receipts, and the link moves to the account that opened it last. So send the link only to the customer personally. To stop receiving messages, the customer can block the bot in Telegram or ask the shop to remove the link.

9.6 The Operator does not send SMS messages to shop customers and does not call them.

9.7 A customer, employee or supplier of a shop is advised to contact that shop first about their data: the shop entered the data and can correct or delete it faster. They can also contact the Operator through the channels in clause 8.4; to help find the data, give the shop’s name or phone number and your own phone number. The Operator reviews the request, forwards it to the shop owner if needed, and replies within the deadlines in clause 8.6.

9.8 Sample notice (for sub-clauses 2 and 3 of clause 9.3). The shop owner may give a customer, on paper or by message, for example the following text, and keep proof that it was given: “(Shop name) keeps information about your name, phone number, purchases and debt in the BuySale program to record sales on credit and to inform you about your debt; the program’s servers are located in Uzbekistan. You have the right to receive information about your data and to demand that it be corrected or deleted (Article 30 of Law No. ZRU-547) — to do so, contact the shop. If the shop uses the AI assistant, this data may be transferred to Anthropic PBC in the USA. I agree to this: yes / no (signature, date).” For an employee or a supplier, the text is adapted to their data.

10. Cookies, browser storage and website analytics

10.1 The app (app.buysale.uz and the Android app) does not set cookies itself (for the technical cookie that Cloudflare may set, see clause 10.6). The following is stored in the device’s browser storage (localStorage): the login token; interface language; invitation code; open carts (which may include a customer’s name and phone entered in the cart; deleted on logout); print and label settings; scanner camera, sound and vibration settings; menu state; a flag that the app install prompt was closed; Rahmat payment cards closed on the Balance screen (payment number and the time closed: entries older than 26 hours are ignored and are replaced by an updated list the next time a card is closed, otherwise they stay until the browser storage is cleared). Browser session storage (sessionStorage) holds a flag that confirming a new version was postponed with the “Keyinroq” (“Later”) button. To open faster, the app’s shell (page files and icons) is cached on the device; the app does not cache shop data, but photos you open may stay in the browser cache for up to 24 hours.

10.2 No analytics, advertising or error-tracking services are used in the app. When the app page opens, a Telegram script is loaded from telegram.org (clause 4.5).

10.3 The buysale.uz website uses the Yandex Metrica counter: visit statistics, click map, link click tracking and Webvisor — a recording of actions on the page (page view, mouse movement, clicks, scrolling). Text typed into form fields may also end up in the Webvisor recording. The following events are also counted: starting to fill in and sending the form, going to the app and to Telegram, tapping the phone number, opening a question in the FAQ, switching language, viewing prices, opening the website AI assistant, asking it a question (number of questions), pressing a ready-made question button, an AI error, and choosing comparison and device sections. Depending on the event, the following is sent with it: the page address; when a FAQ question is opened, the question text; when a ready-made question button is pressed, the button text; and when the form is sent, the shop type and language. Yandex Metrica uses its own cookies and browser storage, and Yandex processes the data under its own terms.

10.4 The website loads fonts from the Google Fonts service (clause 4.7). The website AI assistant keeps the conversation history in browser session storage (sessionStorage), which is cleared when the browser tab is closed.

10.5 No advertising trackers (for example, advertising pixels) are installed on the website or in the app.

10.6 Cloudflare may set its own technical cookie for security purposes (for example, to detect automated requests).

10.7 Cookies and browser storage can be blocked or cleared in your browser settings. If Yandex Metrica is blocked on the website, the website keeps working. If browser storage is cleared in the app, you will be logged out and the settings on the device will return to their defaults.

11. Actions in case of a data breach

11.1 If the Operator detects unauthorised access to personal data, or that data has been leaked, lost or altered, it: takes steps to stop the incident; temporarily suspends processing if necessary (Article 31 of Law No. ZRU-547); investigates the causes and records the incident.

11.2 If the incident concerns shop data, the Operator informs the shop owner through the Telegram bot and/or the app without undue delay: what happened, which data was affected, what measures were taken and what the shop owner should do. Where the law requires, data subjects are notified in writing.

11.3 The Operator notifies the authorised state body in the cases and manner provided for by law. If data leaks during cross-border transfer, the Operator reports it to the authorised state body within 24 hours of detection and, within 72 hours, sends detailed information on the causes of the leak and the measures taken to remedy it (Resolution No. 415 of the Cabinet of Ministers of the Republic of Uzbekistan of 29 July 2026).

11.4 If the incident concerns the data of the shop’s customers, employees or suppliers, the Operator gives the shop owner the information needed to notify them.

11.5 If you suspect unauthorised access to your data (for example, you receive a login code you did not request or a message about an unexpected employee login), report it immediately through the channels in section 13.

12. Changes to the Policy

12.1 The Operator may change the Policy when a new feature or a new external service that receives data is added, or when the processing procedure or the law changes. Each version is published with its number and effective date at https://buysale.uz/maxfiylik/ (in Russian: https://buysale.uz/ru/maxfiylik/); previous versions also remain available.

12.2 Material changes — new types of data or new purposes, new recipients or countries, longer retention periods, a change in how administrators access shop data — are announced at least 30 calendar days before they take effect, in the app, through the Telegram bot (to shop owners who connected the bot) and on the website. Until the effective date, the previous version applies.

12.3 After a new version is published, the app asks the shop owner to confirm it (clause 1.5); until the effective date you can keep working by pressing the “Keyinroq” (“Later”) button, including viewing data and downloading reports. After the effective date, until the new version is confirmed, neither the shop owner nor employees can use the app; during this time the shop owner may request a copy of their data through the channels in clause 8.4.

12.4 Editorial corrections that do not change rights and obligations (correcting typos, updating contact details) take effect on the day they are published on the website.

12.5 If you do not agree with the new version, you may stop using the Service and request deletion of the account (clause 6.3). A shop owner who rejects a material change receives the unused balance back in full under clauses 6.3 and 14.4 of the Public Offer; in other cases the question of the remaining balance is settled under the Public Offer.

13. Contact details

13.1 Operator: BUYSALE LLC; STIR: 313346068; legal address: Xorazm viloyati, Urganch shahri, Tozabog’ MFY, Obodlik ko’chasi, 27-uy, 11-xonadon; postal address: Xorazm viloyati, Urganch shahri, Tozabog’ MFY, Obodlik ko’chasi, 27-uy, 11-xonadon.

13.2 Person responsible for processing and protecting personal data: Nazarov Kamronbek Rasulovich, hammuassis.

13.3 Contact: Telegram — https://t.me/arabicone_admin; phone — +998 91 267 06 06, +998 93 922 88 89; email — [email protected]; website — https://buysale.uz.

13.4 Authorised state body: Department of Migration and Personalisation under the Ministry of Internal Affairs of the Republic of Uzbekistan — https://pd.gov.uz.