UBASE Privacy Policy
Version: v1.1 Last updated: March 1, 2026
1. General provisions
1.1. This Privacy Policy (hereinafter — the “Policy”) defines the procedure for processing and protecting the personal data of users of the UBASE mobile application.
1.2. The personal data operator is UBASE LLC (hereinafter — the “Operator”, “Platform”).
1.3. The Policy is developed in accordance with:
- The Law of the Republic of Uzbekistan “On Personal Data” (dated 02.07.2019, No. ZRU-547)
- The Law “On Informatization”
- The Civil Code of the Republic of Uzbekistan
1.4. Consent to the processing of personal data is given by the user at registration by ticking a separate checkbox. Consent to the processing of personal data is not combined with acceptance of the offer and is an independent expression of the user’s will.
2. What data we collect
2.1. Customer data
| Data | Purpose | Basis |
|---|---|---|
| Full name | Identification | Offer agreement |
| Phone number | Authorization (OTP), contact | Offer agreement |
| Address (when ordering) | Determining the location for an order | Service performance |
| Geolocation | Finding the nearest masters | User consent |
| Bank card data | Payment for the Platform’s additional paid services, if any are provided | Offer agreement |
| Order history | Improving the service | Legitimate interest |
| Reviews and ratings | Quality control | Offer agreement |
| Photos (when ordering) | Describing the problem | User consent |
| Push token (FCM) | Notifications | User consent |
2.2. Master (Contractor) data
| Data | Purpose | Basis |
|---|---|---|
| Full name (via MyID) | Identification | Offer agreement |
| Passport data (via MyID) | Identity verification | Legal requirement |
| Phone number | Authorization, contact | Offer agreement |
| Profile photo | Display to the Customer | Offer agreement |
| Work photos | Portfolio | Consent |
| Geolocation (real time) | Order assignment, ETA, tracking | Offer agreement |
| Bank card data | Topping up the UBASE balance and refunding the unused remainder | Offer agreement |
| Rating and reviews | Quality control | Offer agreement |
| Financial data (balance, transactions) | Accounting of the UBASE balance and service charges | Offer agreement |
| TIN (if a sole proprietor, at the Master’s discretion) | Tax reporting | Consent |
3. How we use the data
3.1. Providing services:
- Matching the nearest master
- Showing the ETA and tracking
- Generating the checklist and the receipt
- Processing payments related to the Platform’s services, topping up the UBASE balance and refunding the unused remainder
3.2. Security:
- Identity verification via MyID
- Fraud prevention (antifraud checks)
- Maintaining a register of restrictions (blocking for fraud, systematic breaches of the service rules, confirmed abuse). Register data is stored for 3 years. The user has the right to appeal their inclusion via support within 7 days
3.3. Improving the service:
- Analyzing popular categories and jobs
- Optimizing the assignment algorithm
- A/B testing of features
3.4. Communication:
- Push notifications about order status
- SMS for authorization (OTP)
- Chat messages between the Customer and the Master
4. Geolocation
4.1. Customer
- Geolocation is requested when creating an order
- Used to determine the address and calculate distance
- Shared with the assigned Master for the duration of the order
- Not tracked outside the context of an order
4.2. Master
- In “I’m on shift” mode, coordinates are updated to assign the nearest orders, but are not stored in history
- During an active order — precise tracking (ETA, navigation); coordinates are shared with the Customer in real time
- Tracking stops when the order is completed
- When going off shift, coordinate updates stop entirely
- Geolocation is not tracked outside the context of a shift and orders (not 24/7)
5. Whom we share data with
5.1. Between the parties to an order
| Data | Customer sees | Master sees |
|---|---|---|
| Full name | Master’s name | Customer’s name |
| Phone | No (via in-app chat/call) | No (via in-app chat/call) |
| Address | — | Only during the order |
| Geolocation | Master tracking | Order address |
| Rating | Master’s rating | Own rating |
| Photo | Master’s photo | — |
5.2. Third parties
| Recipient | Data | Purpose |
|---|---|---|
| Uzum Bank | Card data, amount | Payment processing |
| MyID | Master’s passport data | Verification |
| Firebase (Google) | Push token, analytics | Notifications, analytics |
| Cloudflare | Photos/media | File storage (R2) |
| eskiz.uz | Phone number | Sending SMS / OTP |
| Agora | Session identifier | In-app voice calls |
| Yandex MapKit | Coordinates (anonymized) | Map display, routes |
| Government authorities | Upon request of a court / police | Legal requirement |
5.3. We do not sell personal data to third parties.
5.4. We do not transfer data outside the Republic of Uzbekistan, except for the technical services necessary for the operation of the Application: Firebase (Google, USA), Cloudflare (USA), Agora (Singapore), Yandex MapKit (Russia). When data is transferred across borders, protective measures apply (encryption, minimization of the data transferred, anonymization where possible).
6. Data storage and protection
6.1. Retention periods
| Data | Period |
|---|---|
| Account data | Lifetime of the account + 1 year |
| Order history | 3 years |
| Financial data | 5 years (tax requirement) |
| Chat messages | 1 year |
| Geolocation | 30 days |
| Authorization logs | 6 months |
6.2. Protective measures
- Encryption of data in transit (TLS 1.3)
- Encryption of bank card data (PCI DSS via the provider)
- Hashing of PIN codes (bcrypt)
- Separation of database access
- Regular backups
- Servers located in Uzbekistan (VPS)
7. User rights
In accordance with the Law “On Personal Data”, the user has the right to:
7.1. Right of access
Request information about what personal data is stored about the user.
7.2. Right to rectification
Demand the correction of inaccurate or incomplete data.
7.3. Right to erasure
Request deletion of the account and related personal data.
Exceptions: financial data is stored for 5 years by law.
7.4. Right to restrict processing
Withdraw consent to the processing of geolocation and push notifications.
7.5. Right to data portability
Request an export of personal data in a machine-readable format.
7.6. How to exercise your rights
- In the App settings → “My data”
- Via support: privacy@ubase.uz
- A written request to the UBASE LLC office
Request processing time: up to 7 business days; for complex requests requiring additional verification — up to 30 calendar days.
8. Analytics and trackers
8.1. The App uses Firebase Analytics to collect anonymized analytics:
- The screens the user visits
- Time of use
- Device type and OS
- Country and city (without a precise address)
8.2. Analytics data is anonymized and does not allow identifying a specific user.
9. Children
9.1. The App is not intended for persons under 18 years of age.
9.2. We do not knowingly collect data from minors.
10. Changes to the Policy
10.1. The Platform has the right to update this Policy, notifying users at least 14 days before the changes take effect.
10.2. Notice of changes is given via a push notification and/or upon login to the App.
10.3. Continued use of the App after the changes take effect constitutes agreement with the updated Policy.
11. Security incident notification
11.1. In the event of a detected leak, unauthorized access or other incident affecting users’ personal data, the Platform undertakes to:
- Notify affected users within 72 hours of detecting the incident via the App, a push notification or SMS
- Notify the authorized body within the time limits established by law
- Take measures to remedy the consequences and prevent recurring incidents
11.2. The notification contains: the nature of the incident, the list of affected data, the measures taken, and recommendations for the user.
12. Automated decision-making
12.1. The Platform uses automated algorithms for:
- Assigning the nearest available Master to an order (based on geolocation, category, rating)
- Calculating the Master’s rating (average over the last 50 orders)
- Automatically blocking a Master when the rating drops below the set thresholds
12.2. The user has the right to:
- Request an explanation of the logic of an automated decision via support
- Appeal an automated decision (block, priority reduction) within 7 days
- Demand a review of the decision with the involvement of a Platform employee
12.3. Appeal review time — up to 48 hours.
13. Contacts
Responsible for personal data processing:
UBASE LLC
Republic of Uzbekistan, Tashkent
Email: privacy@ubase.uz
Phone: _________________
Authorized body:
The State Inspectorate for Control in the Sphere of Informatization and Telecommunications under the Ministry of Digital Technologies of the Republic of Uzbekistan.