Version dated August 14, 2026
1.1. This Privacy Policy of the artificial intelligence-based information and analytical service “MASLAHAT AI” (hereinafter referred to as the “Policy”) establishes the procedure for obtaining, collecting, recording, systematising, storing, using, transferring, anonymising, blocking, deleting, destroying, and otherwise processing the personal data of users of the “MASLAHAT AI” information and analytical service, and also establishes measures to ensure their confidentiality and security.
1.2. This Policy has been developed in accordance with the legislation of the Republic of Uzbekistan, including Law of the Republic of Uzbekistan No. ЗРУ-547 dated 2 July 2019 “On Personal Data,” Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 570 dated 5 October 2022 “On Approval of Certain Regulatory Legal Acts in the Field of Personal Data Processing,” as well as the Operator’s internal documents.
1.3. Personal data shall be processed by the Operator using the “MaslahatAI” personal data database, located within the territory of the Republic of Uzbekistan and registered on 14 August 2026 in the State Register of Personal Data Databases of the Republic of Uzbekistan (certificate AA 0002247, issued by the Department of Migration and Personalisation under the Ministry of Internal Affairs of the Republic of Uzbekistan).
1.4. The Policy shall apply to all personal data received by the Operator from Users when they use the mobile application, the web version of the Platform, and other software products, services, interfaces, websites, and information resources related to the “MASLAHAT AI” information and analytical service.
1.5. This Policy constitutes an integral part of the Public Offer of the “MASLAHAT AI” information and analytical service. The User’s acceptance of the Public Offer shall constitute the User’s full and unconditional consent to the terms and conditions of this Policy.
1.6. By commencing use of the Platform and registering on the Platform, the User confirms that the User:
1.6.1. has read this Policy;
1.6.2. understands its content;
1.6.3. accepts its terms and conditions in full;
1.6.4. provides consent to the processing of their personal data in accordance with the procedure and subject to the terms and conditions set forth in this Policy and the legislation of the Republic of Uzbekistan;
1.6.5. provides consent to the processing of personal data electronically through the functionality of the Platform by taking actions that unequivocally demonstrate the User’s intention to provide such consent, including acceptance of the Public Offer, registration on the Platform, and other actions provided for by the Platform interface and accompanied by a notice of consent to this Policy.
1.7. If the User disagrees with the terms and conditions of this Policy, the User must refrain from registering and cease using the Platform. If the User has already provided personal data, the User may contact the Operator with a request to withdraw consent to its processing, delete the Account, and destroy the personal data in the cases and in accordance with the procedure provided for by this Policy and the legislation of the Republic of Uzbekistan.
1.8. This Policy applies exclusively to the activities of the “MASLAHAT AI” information and analytical service and does not govern the processing of personal data by third-party websites, mobile applications, information resources, or services to which links may be provided on the Platform.
1.9. The User’s use of third-party services integrated with the Platform shall be governed by the privacy policies of the respective owners of such services, unless otherwise expressly provided for by an agreement between the Operator and the User.
1.10. In all matters not expressly governed by this Policy, the laws of the Republic of Uzbekistan shall apply.
1.11. This Policy shall be published and made freely available on the Platform and shall remain in effect indefinitely until a new version is adopted.
For the purposes of this Policy, the following terms and definitions shall apply.
Personal Data Operator (the Operator) — Limited Liability Company “RS PRODUCT LABS”, TIN 313128156, which is the owner and administrator of the “MASLAHAT AI” information and analytical service, independently organises and carries out the processing of personal data, determines the purposes of personal data processing and the categories of personal data to be processed, and determines the operations performed therewith.
User — a fully legally capable individual who has reached the age of 18 (eighteen), an individual entrepreneur, or a legal entity that has registered an Account on the Platform and uses the Platform’s functionality.
Platform — the “MASLAHAT AI” software and hardware system, including mobile applications, the web version, server infrastructure, software, databases, interfaces, software modules, and other information resources intended to provide information and analytical services using artificial intelligence technologies.
Personal data — any information relating directly or indirectly to an identified or identifiable individual, the processing of which is carried out by the Operator in accordance with the legislation of the Republic of Uzbekistan.
Processing of personal data — any action (operation) or set of actions performed with or without the use of automated means, including the collection, recording, systematisation, accumulation, storage, clarification, alteration, use, transfer, anonymisation, blocking, deletion, and destruction of personal data.
Automated processing of personal data — processing of personal data using information systems, computer equipment, software, and other automated means.
Anonymisation of personal data — actions that render it impossible to determine that personal data relates to a specific data subject without the use of additional information.
Blocking of personal data — the temporary suspension of personal data processing, except where processing is necessary to clarify personal data or comply with statutory requirements.
Destruction of personal data — actions that render it impossible to restore the content of personal data in an information system or that destroy physical media containing personal data.
Confidentiality of personal data — a mandatory requirement prohibiting the disclosure or dissemination of personal data without the consent of the personal data subject or other lawful grounds.
Account — a set of information about the User necessary for the User’s identification, authorisation, and use of the Platform’s functionality.
Artificial intelligence (AI) — a set of software algorithms, machine-learning models, and other computing technologies used by the Platform to analyse User requests, process documents, search for information, generate draft documents, and prepare informational and reference materials.
3.1. The personal data Operator is:
Limited Liability Company “RS PRODUCT LABS”, TIN: 313128156, registered address: Republic of Uzbekistan, Tashkent City, Yashnabad District, Yangi Davr mahalla, 135 Muynak Street.
3.2. The Operator independently determines the purposes of personal data processing, the categories of personal data subject to processing, and the list of operations performed, and also ensures compliance with the requirements of the legislation of the Republic of Uzbekistan in the field of personal data protection.
3.3. The Operator arranges the processing of personal data using organisational and technical protective measures provided for by the legislation of the Republic of Uzbekistan and the Operator’s internal documents, taking into account the nature of the personal data being processed, the purposes of its processing, current security threats, and a reasonably sufficient level of protection aimed at reducing the risk of unlawful or accidental access to personal data, alteration, destruction, blocking, copying, provision, dissemination thereof, or other unlawful actions in relation to personal data.
3.4. In carrying out its activities, the Operator may engage third parties to perform certain functions related to the operation of the Platform, subject to compliance with the requirements of the legislation of the Republic of Uzbekistan and ensuring the confidentiality of personal data.
4.1. In the course of operating the “MASLAHAT AI” information and analytical service, the Operator processes personal data of the following categories of personal data subjects:
4.1.1. registered Users of the Platform;
4.1.2. representatives of legal entities who register for and use the Platform on behalf of the relevant legal entity;
4.1.3. individual entrepreneurs;
4.1.4. persons contacting technical support;
4.1.5. persons submitting requests, applications, claims or other communications through the Platform, by email or through other communication channels;
4.1.6. persons whose personal data is contained in documents voluntarily uploaded by the User to the Platform, subject to compliance with the terms and conditions set forth in this Policy and the legislation of the Republic of Uzbekistan.
4.2. The Operator does not intentionally collect personal data of minors. The Platform may be used exclusively by persons possessing the requisite legal capacity, unless otherwise expressly provided for by the legislation of the Republic of Uzbekistan.
4.3. If the Operator becomes aware that the personal data of a minor has been provided without due legal grounds, the Operator may take measures to restrict the processing of such data or delete it.
4.4. The Operator does not intentionally process special categories of personal data (sensitive personal data), including information concerning health, biometric data, genetic data, political opinions, religious or philosophical beliefs, membership in public associations, or other special categories of personal data, unless the need for such processing arises directly from the User’s own actions when voluntarily uploading documents.
4.5. If the User independently provides documents or information containing special categories of personal data, personal data of third parties, or other personal data not requested by the Operator, the User warrants that such data is provided lawfully and that the User has all necessary rights, powers, consents and other grounds stipulated by the legislation of the Republic of Uzbekistan for transferring such data to the Operator.
The Operator does not conduct a preliminary verification of the lawfulness of the User’s collection of the specified personal data, the accuracy of the information provided, or the existence of third-party consents, and relies on the User’s representations and warranties. The User shall bear sole responsibility for the risk of any adverse consequences associated with the unlawful provision of such data.
The Operator processes such personal data exclusively to the extent and for the period necessary to fulfil the User’s request and provide the relevant services. The Operator may elect not to use, may delete or anonymise, or may refuse to process personal data whose provision is not necessary to achieve the purposes of processing or is contrary to the requirements of the legislation of the Republic of Uzbekistan or this Policy.
5.1. The Operator processes exclusively the personal data necessary to achieve the purposes set forth in this Policy, perform the terms and conditions of the Public Offer, ensure the operation of the Platform, and comply with the requirements of the legislation of the Republic of Uzbekistan.
5.2. When creating an Account, the User independently provides the Operator with the following mandatory information:
mobile telephone number;
Account password;
the IP address from which registration and/or use of the Platform is carried out;
information about the User’s device and software, including the device type, operating system, application version (if applicable), browser information (User-Agent), and other technical specifications automatically transmitted when using the Platform;
a device identifier (Device ID) or another technical device identifier, if its collection is supported by the device, operating system, or software used;
information confirming that the User has reviewed and expressed consent to the Public Offer and this Policy, including the date, time, method of providing consent, version of the relevant document, and other information necessary to confirm such consent.
The User’s password is not stored by the Operator in plain-text (unencrypted) form and is processed exclusively in the form of a cryptographic hash using modern cryptographically secure hashing algorithms.
The specified technical information may be collected automatically during registration, authorisation, and use of the Platform exclusively for the purposes of ensuring Account security, preventing fraudulent activities, identifying technical malfunctions, and ensuring the proper operation of the Platform.
5.3. At their discretion, the User may provide the Operator with additional information necessary to use certain functions of the Platform.
Such information may include: first and last name; gender; marital status; number of children; individual entrepreneur status; and the User’s areas of interest. The Operator does not collect or store the User’s passport details, PINFL, income information, place of employment, citizenship, or date of birth.
Provision of the specified information is voluntary.
The User independently determines the scope of the personal data provided and is responsible for its accuracy.
5.4. When using the Platform, the following information may be collected automatically: IP address; date and time of connection; Device ID; application installation identifier; User-Agent; operating system information; operating system version; device model; device manufacturer; interface language; time zone; browser information; screen resolution; mobile network operator information; MAC address (if technically available); network type information; internet service provider information; authorisation log; User activity log; information regarding the use of the Platform’s functionality; technical error logs; information regarding the duration of the user session; cookie identifiers (for the web version of the Platform); and other technical information automatically generated by the software.
5.5. In the course of using the Platform, the following may be generated: the User’s query history; service usage history; history of generated documents; history of interaction with artificial intelligence; information regarding actions performed; Account settings; history of requests submitted to the support service; information regarding activated Subscriptions; payment information (without storing bank card details); security logs; access logs; and information regarding the User’s consents.
5.6. The Operator does not collect Users’ bank card details.
When payments are made, payment information is processed by the relevant payment organisations in accordance with their own personal data processing rules.
5.7. The Operator does not collect information unrelated to the purposes of personal data processing established by this Policy.
6.1. The Platform enables the User to upload documents, texts, draft agreements, statements of claim, court documents, powers of attorney, applications, local regulations, constituent documents, correspondence, images of documents, as well as other files and information (hereinafter referred to as the “Documents”) for the purpose of using the Platform’s functionalities.
6.2. The Documents uploaded by the User may contain the User’s personal data, personal data of third parties, trade secrets, confidential information, other restricted-access information, as well as information protected by the legislation of the Republic of Uzbekistan.
6.3. By uploading Documents to the Platform, the User represents and warrants that: the User has the requisite rights to use and upload such Documents; the User has grounds prescribed by law for transferring the personal data contained therein; the transfer and processing of the Documents through the Platform do not infringe the rights and legitimate interests of third parties.
6.4. The User shall be solely responsible for the content of the uploaded Documents, the lawfulness of their transfer, the accuracy of the information contained therein, as well as compliance with the requirements of the legislation of the Republic of Uzbekistan concerning personal data, trade secrets, state secrets, bank secrecy, notarial secrecy, attorney-client privilege, and other types of information access to which is restricted by law.
6.5. The Operator does not conduct any preliminary review of the content of the Documents, their completeness, accuracy, lawful origin, or compliance with legal requirements.
6.6. The Documents shall be processed exclusively for the purposes of: fulfilling the User’s request; analysing legal documents; preparing draft documents; generating informational and reference materials; searching for and analysing case law; providing recommendations and other results generated by the Platform’s functionalities.
6.7. When processing Documents using artificial intelligence technologies, including technologies, software, cloud services, and artificial intelligence models provided by third parties, the Operator shall implement reasonable organisational and technical measures aimed at minimising the amount of personal data transferred to such parties, to an extent compatible with the purposes of processing and necessary for the proper functioning of the relevant Platform features. Depending on technical capabilities, the nature of the Document, and the intended purpose of the technology used, the Operator may apply procedures for deletion, anonymisation, pseudonymisation, or other methods of reducing the amount of identifying information.
The User is hereby notified and agrees that the foregoing measures are implemented primarily using automated technologies and subject to the technical aspects of Document processing; therefore, the Operator cannot guarantee the complete detection, deletion, or removal from the Document’s content of all personal data and other information that makes it possible to identify a specific person directly or indirectly.
6.8. The Operator shall implement reasonable organisational and technical measures aimed at ensuring the confidentiality and security of Documents processed through the Platform. However, the Operator does not guarantee the absolute security of information against all possible threats associated with the operation of information and telecommunications networks, software, means of communication, or other circumstances beyond the Operator’s control.
6.9. The Operator does not acquire any proprietary, exclusive, or other rights to the Documents uploaded by the User. All rights to such Documents shall remain with the User.
6.10. Once the processing of the Documents is no longer necessary, the Operator shall delete or anonymise them or terminate access thereto within the time limits prescribed by this Policy.
6.11. If the Documents or other information uploaded by the User are found to contain information that may indicate the preparation, commission, or threat of commission of unlawful acts, including crimes related to terrorism, extremism, human trafficking, sexual exploitation of minors, the production, possession, or distribution of materials depicting the sexual abuse of minors, illicit trafficking in narcotic drugs, incitement to violence, cruelty to humans or animals, as well as other acts posing a threat to the life, health, or security of an individual, society, or the state, the Operator shall have the right to:
restrict the processing of or access to the relevant information;
retain such information to the extent necessary to comply with the requirements of the legislation of the Republic of Uzbekistan;
where grounds prescribed by the legislation of the Republic of Uzbekistan exist, or pursuant to a binding request from competent government authorities, provide the relevant information to the authorised government authorities;
take other actions expressly prescribed by the legislation of the Republic of Uzbekistan and aimed at preventing unlawful activities.
7.1. When the User uses the voice input function, the Platform may process voice messages solely for the purposes of converting speech into text, processing the User’s request, and generating a response using artificial intelligence technologies.
7.2. Voice messages are not used by the Operator for the biometric identification of the User, establishing or confirming the User’s identity by voice, creating voice (biometric) templates, or making decisions that produce legal consequences for the User or otherwise affect the User’s rights and legitimate interests. Voice messages are not processed for the purpose of processing biometric personal data.
7.3. Depending on the technical implementation of the relevant function, voice messages may be processed directly using the Platform’s software and technical resources or through the use of technologies, software, cloud services, models, and other solutions provided by third-party artificial intelligence technology providers, including OpenAI L.L.C. (USA), Anthropic PBC (USA), Google LLC (USA), as well as other providers engaged by the Operator under agreements concluded with them. Where technologies of third-party providers are used, voice messages and/or text requests generated therefrom shall be processed to the extent necessary to convert speech into text, process the content of the request, generate the result, and provide the relevant functionalities of the Platform, in compliance with the laws of the Republic of Uzbekistan, this Policy, and the Public Offer.
7.4. Voice messages shall be stored only for the period necessary for their processing and for ensuring the operation of the relevant Service, unless a longer storage period is prescribed by the laws of the Republic of Uzbekistan or is required to protect the rights and legitimate interests of the Operator.
7.5. The User uses the voice input function voluntarily. The User may refrain from using this function and interact with the Platform by means of text input.
8.1. If the User purchases paid features, Subscriptions, or other services of the Platform, payment shall be made using third-party payment services.
8.2. To accept and process payments, the Operator may use the following payment providers: Click; Payme; other payment services subsequently connected by the Operator.
8.3. When a payment is made, payment data (including bank card details, payment information, and other data necessary to complete the payment transaction) shall be processed by the relevant payment provider in accordance with its rules, privacy policy, and the requirements of applicable law.
8.4. The Operator neither receives nor stores the full bank card details of Users (card number, CVV/CVC code, card expiration date, and other data processed by the payment provider).
8.5. The Operator receives only the information necessary to confirm that payment has been made, provide access to the relevant features of the Platform, comply with the requirements of the legislation of the Republic of Uzbekistan, and maintain accounting and tax records.
9.1. The Operator shall process personal data exclusively for the achievement of predetermined, lawful, and specific purposes consistent with the terms of the Public Offer and this Policy.
9.2. Users’ personal data may be processed for the following purposes: registration of the User on the Platform; creation and maintenance of an Account; identification of the User; authentication upon logging into the system; provision of access to the functional capabilities of the Platform; provision of information and analytical services; provision of information and reference materials; preparation of draft legal documents; analysis of documents uploaded by the User; searching for regulatory legal acts; searching for judicial practice; preparation of analytical materials; provision of recommendations on matters concerning the legislation of the Republic of Uzbekistan; preparation of draft agreements; preparation of draft appeals, applications, claims, and other documents; processing of User requests; performance of the terms of the Public Offer; processing of Users’ enquiries; provision of technical support; ensuring feedback; sending notifications related to the use of the Platform; informing Users of changes to the terms of use of the Platform; restoration of access to the Account; ensuring information security; prevention of fraud; detection of unlawful use of the Platform; prevention of unauthorised access; maintenance of security event logs; resolution of disputes; review of claims; compliance with the requirements of the legislation of the Republic of Uzbekistan; enforcement of judicial acts; interaction with government authorities in cases provided for by law; compilation of anonymised statistics; analysis of the quality of the Platform’s operation; improvement of software; development of new services; testing of new functions; conduct of internal audits; backup of information; ensuring the continuity of the Platform’s operation; protection of the Operator’s legitimate interests; achievement of other purposes directly related to the operation of the Platform and not contrary to the legislation of the Republic of Uzbekistan.
10.1. The Platform uses artificial intelligence, machine learning, natural language processing, information retrieval, text analysis, and other automated data processing technologies solely for the purpose of providing Users with the Platform’s functionalities.
10.2. Artificial intelligence technologies may be used, in particular, for: analysing User queries; analysing documents; searching for legal information; preparing draft legal documents; structuring information; comparing versions of documents; searching for judicial practice; searching for regulatory legal acts; preparing informational and reference materials; preparing analytical materials; automatically generating draft responses; preparing recommendations on matters concerning the legislation of the Republic of Uzbekistan.
10.3. Results generated using artificial intelligence technologies are solely informational, analytical, and advisory in nature. The User shall use such results independently and at the User’s own risk.
10.4. Responses, recommendations, analytical materials, draft documents, and other results generated by artificial intelligence: do not constitute a legal opinion; do not constitute an official interpretation of legislation; do not constitute legal assistance provided by an attorney; do not constitute a notarial act; are not binding; do not replace consultation with a qualified lawyer.
10.5. The User shall independently evaluate the results generated by the Platform before using them in practice.
10.6. The Operator does not guarantee the absolute completeness, relevance, or accuracy of results generated by artificial intelligence technologies.
10.7. The Operator may use anonymised data obtained as a result of the use of the Platform solely for the purposes of improving the performance quality of artificial intelligence algorithms, developing new functions, correcting errors, testing, and improving operational efficiency.
11.1. The processing of personal data is primarily carried out using automated means through software, server infrastructure, databases, and other information systems.
11.2. Automated processing may include: collection; recording; systematisation; accumulation; storage; modification; updating; retrieval; use; transfer; anonymisation; blocking; deletion; destruction.
11.3. Automated processing shall be carried out solely to the extent necessary to achieve the purposes of personal data processing.
11.4. The Operator shall take measures to prevent decisions based solely on automated processing that have legal consequences for the User, unless otherwise expressly provided for by the laws of the Republic of Uzbekistan.
12.1. The Operator shall have the right to anonymise personal data in the cases and in accordance with the procedure provided for by the legislation of the Republic of Uzbekistan and this Policy.
12.2. Following anonymisation, the information shall no longer be used to identify a specific User and may be used solely for statistical, analytical, research, scientific, technical, and other lawful purposes.
12.3. Anonymised information may be used by the Operator for: analysing the use of the Platform; evaluating software performance; developing new services; improving artificial intelligence algorithms; conducting internal research; preparing statistical reports; improving the quality of the user experience; detecting errors; ensuring information security; testing new features; and analysing infrastructure load.
12.4. Anonymised information shall not be used by the Operator to re-identify Users.
12.5. The Operator shall take reasonable technical and organisational measures aimed at preventing the identity of a User from being reconstructed from anonymised data.
13.1. For the purpose of informing the User about events related to the use of the Platform, the Operator may use push notification technology.
13.2. Third-party services may be used to deliver push notifications to Users’ devices, including Firebase Cloud Messaging (FCM), provided by Google, as well as other similar services used depending on the operating system employed by the User and the technical architecture of the Platform.
13.3. When push notification technology is used, only technical data necessary for the delivery of notifications may be processed, including the unique identifier (token) of the device, information about the platform and operating system, as well as other technical parameters required for the operation of the relevant service.
13.4. The Operator does not use the specified technical data to identify the User.
13.5. The User may opt out of receiving push notifications at any time by changing the relevant settings on their device or in the application. Such opt-out shall not affect the ability to use the core functions of the Platform, except where the receipt of certain notifications is necessary to ensure Account security or the performance of certain functions of the Platform.
14.1. When the web version and/or mobile application of the Platform is used, the Operator may use Cookies, Local Storage, Session Storage, device identifiers (Device ID), software development kits (SDKs), pixels, tags, event logs (log files), as well as other similar technologies for storing, processing and transmitting technical information (hereinafter collectively referred to as the “Technical Technologies”) to ensure the proper operation of the Platform, the functioning of individual Services, enhanced usability, information security, prevention of fraud and abuse, troubleshooting, analysis of Platform usage, provision of technical support, and improvement of the Platform’s functionality.
14.2. Cookies are small text files stored by the User’s browser on the device being used and containing information necessary for the functioning of individual components of the Platform. Local Storage and Session Storage are used for the temporary or permanent storage of technical information necessary for the operation of individual functions of the Platform.
14.3. The Operator may use essential (technical), functional, analytical, operational, security, session, persistent and other categories of Cookies and Technical Technologies necessary for the operation, development and security of the Platform.
14.4. The following information may be processed through Technical Technologies, among other things: IP address; User session identifier; device identifiers (Device ID); browser identifiers; device information; operating system information; browser information; language settings; application version information; network connection information; information regarding sections of the Platform visited; duration of the User session; information regarding the User’s actions; information regarding errors encountered; software performance information; information contained in event logs (log files); information generated by SDKs; as well as other technical information necessary for the operation, maintenance, protection and improvement of the Platform.
14.5. The Platform may use software development kits (SDKs) owned by the Operator and/or third parties to enable individual functions of the Platform, analyse the use of Services, diagnose errors, ensure information security, send technical notifications and perform other functions necessary for the provision of the Platform’s Services.
14.6. Upon the first visit to the Platform, the User may be given an opportunity to provide consent to or refuse the use of Cookies and other Technical Technologies that are not essential for the operation of the Platform, by means of a Cookie banner or another settings management mechanism. Technically necessary Cookies shall be used irrespective of the User’s choice to the extent necessary to ensure the operation and security of the Platform and the provision of the Platform’s Services.
14.7. The User may independently restrict the use of Cookies by changing the settings of the browser or device being used, provided that the User’s software supports the relevant technical functionality.
14.8. Disabling certain categories of Cookies or other Technical Technologies may result in limitations to the functionality of the Platform, the inability to use certain Services, or a reduction in the quality of their operation.
14.9. The Platform may use event logs (log files) containing information regarding software operation, the User’s actions, security events, authorisation attempts, technical errors, software performance, the use of individual functions of the Platform and other events necessary to ensure information security, troubleshoot malfunctions, prevent unlawful use of the Platform and improve the quality of the Services provided.
14.10. The Operator may use other technical technologies that are functionally analogous to those specified in this section if their use is necessary for the operation, security, development and improvement of the Platform, subject to compliance with the requirements of the legislation of the Republic of Uzbekistan.
15.1. The Operator shall ensure the confidentiality of Users’ personal data and shall not disseminate such data to third parties, except in cases provided for by this Policy, the Public Offer, or the legislation of the Republic of Uzbekistan.
15.2. The Operator may transfer personal data to third parties solely to the extent necessary to achieve the relevant purpose of processing.
15.3. Personal data may be transferred to government authorities, law enforcement authorities, judicial authorities, inquiry and investigative authorities, and other government authorities vested with the relevant powers; the Operator’s contractors; cloud infrastructure providers; data centre operators; data storage service providers; information security service providers; technical support organisations; payment service providers; SMS service providers; email service providers; User authentication and authorisation service providers; and other persons engaged by the Operator to ensure the operation, maintenance, development, and security of the Platform, provided that they comply with the requirements of the legislation of the Republic of Uzbekistan and this Policy.
15.4. All persons granted access to personal data on behalf of the Operator shall comply with confidentiality requirements, the legislation of the Republic of Uzbekistan, and contractual obligations concerning the protection of personal data.
15.5. Personal data shall be transferred solely on one of the following grounds: the User’s consent; performance of the Public Offer; compliance with legal requirements; enforcement of a judicial act; compliance with a mandatory requirement of a government authority; protection of the rights and legitimate interests of the Operator; prevention of unlawful activities; or other grounds provided for by the legislation of the Republic of Uzbekistan.
15.6. The Operator shall not sell Users’ personal data to third parties.
15.7. The transfer of anonymised information that does not permit the identification of a specific User shall be permitted for statistical, analytical, and research purposes, as well as for improving the operation of the Platform.
15.8. The Operator shall take reasonable measures when selecting persons to whom personal data is transferred and shall require them to comply with the requirements of personal data and confidentiality legislation. However, the Operator shall not be liable for actions by such persons in breach of the agreements concluded with them or the requirements of legislation, provided that the Operator has taken the measures for the protection of personal data prescribed by legislation and this Policy.
15.9. The notification of the transfer of personal data to third parties required by Article 23 of the Law of the Republic of Uzbekistan “On Personal Data” is provided to the User in advance — before processing begins — by means of this Privacy Policy and the Public Offer accepted by the User. The list of recipients, the purposes and the scope of the data transferred are disclosed in Sections XV and XVI of this Privacy Policy. Such notification shall be deemed provided at the moment the Public Offer is accepted. Should the list of recipients change, the Operator shall notify the User separately in accordance with Section XXVI of this Privacy Policy.
16.1. Where the operation of certain services of the Platform requires the use of software, cloud infrastructure, data processing services, artificial intelligence models, or other information technologies located outside the Republic of Uzbekistan, the Operator may carry out a cross-border transfer of personal data solely where there are legal grounds provided for by the legislation of the Republic of Uzbekistan, in accordance with the procedure and requirements established by the legislation of the Republic of Uzbekistan.
16.2. Prior to commencing a cross-border transfer of personal data, the Operator shall take the measures provided for by the legislation of the Republic of Uzbekistan aimed at ensuring that the receiving party complies with personal data protection requirements, including assessing such measures where required by the legislation of the Republic of Uzbekistan.
16.3. When carrying out a cross-border transfer, the Operator shall take the necessary organisational and technical measures to protect personal data.
16.4. A cross-border transfer shall be carried out solely to the extent necessary to achieve the purposes of personal data processing.
16.5. When using foreign artificial intelligence technologies or cloud services, the Operator shall endeavour to minimise the amount of personal data transferred, including through anonymisation, pseudonymisation, or other protective measures, where possible in view of the intended purpose of the relevant service.
16.6. The recipients of personal data in connection with cross-border transfers are, or may be — depending on the Platform functions used by the User and the technical solutions applied by the Operator — the following: OpenAI L.L.C. (USA), Anthropic PBC (USA), Google LLC (USA) — the texts of Users’ queries that have undergone automatic masking of personal identifiers, as well as files and images attached by the User, for the purpose of generating responses using large language models; Voyage AI Innovations Inc. (USA) — text fragments that have undergone the same masking, for the purpose of vector search within the legislation database (RAG); OpenAI L.L.C. (USA) or Google LLC (USA) — audio recordings of voice queries solely for the purpose of converting speech into text, provided that such audio recordings are not used to train models and are deleted upon completion of transcription; Google LLC (USA) — technical device identifiers (tokens) for the purpose of delivering push notifications (Firebase Cloud Messaging). The servers on which Users’ personal data are stored are located within the territory of the Republic of Uzbekistan.
17.1. The Operator processes personal data in compliance with the requirements of the legislation of the Republic of Uzbekistan, including personal data localisation requirements, where such requirements apply to the relevant activities of the Operator.
17.2. Where the legislation of the Republic of Uzbekistan imposes an obligation to localise personal data, the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), and retrieval of personal data shall be carried out using information databases located within the territory of the Republic of Uzbekistan.
17.3. The Operator may use third-party software, cloud services, computing resources, and other information systems to ensure the operation of the Platform, provided that the requirements of the legislation of the Republic of Uzbekistan are complied with, including requirements for the protection of personal data and, where necessary, for the cross-border transfer of personal data.
17.4. The use of foreign information systems and services shall not release the Operator from its obligation to ensure the confidentiality and security of personal data to the extent provided for by the legislation of the Republic of Uzbekistan and this Policy.
17.5. In the event of changes to the architecture of information systems or the requirements of the legislation of the Republic of Uzbekistan, the Operator may change the methods of storing and processing personal data, provided that the requirements of the legislation and this Policy are complied with.
18.1. Personal data shall be processed and retained by the Operator for no longer than is necessary to achieve the purposes of its processing, perform the Public Offer, comply with the requirements of this Policy and the laws of the Republic of Uzbekistan, and protect the rights and legitimate interests of the Operator.
18.2. Personal data contained in the User’s Account shall be processed and retained throughout the existence of the Account. After the Account is deleted, such personal data shall be deleted, destroyed, or anonymised within 30 (thirty) calendar days, unless its further retention is required under the laws of the Republic of Uzbekistan or for the protection of the rights and legitimate interests of the Operator.
18.3. The history of the User’s queries, communications using artificial intelligence technologies, documents uploaded by the User, and other information provided while using the Platform shall be retained until the User deletes the relevant data or the Account. After the Account is deleted, such information shall be deleted, destroyed, or anonymised within 30 (thirty) calendar days, unless otherwise provided for by the laws of the Republic of Uzbekistan or necessitated by the protection of the rights and legitimate interests of the Operator.
18.4. Security logs containing information on authorisation, use of the Platform, information security events, and the technical operation of information systems shall be retained for 12 (twelve) months, unless a longer retention period is required by law for the investigation of information security incidents, the resolution of disputes, or the protection of the rights and legitimate interests of the Operator.
18.5. Backups of information systems that may contain personal data shall be retained for no more than 90 (ninety) calendar days from the date of their creation, after which they shall be automatically deleted or overwritten in accordance with internal backup procedures, unless longer retention is required to ensure the recovery of information following technical failures, comply with the requirements of the laws of the Republic of Uzbekistan, or protect the rights and legitimate interests of the Operator.
18.6. Accounting, tax, and other mandatory records containing personal data shall be retained for the periods established by the laws of the Republic of Uzbekistan, but in any event for no less than 5 (five) years, unless a longer retention period is provided for by law.
18.7. Upon expiry of the established retention periods or achievement of the purposes of processing, personal data shall be deleted, destroyed, or anonymised, unless its further processing and retention are required under the laws of the Republic of Uzbekistan, for the performance of obligations to the User, the resolution of judicial or administrative disputes, compliance with mandatory requirements of government authorities, or the protection of the rights and legitimate interests of the Operator.
18.8. The deletion, destruction, or anonymisation of personal data may be carried out automatically or manually, depending on the nature of the relevant information, the information systems used, and the organisational and technical procedures applied by the Operator.
19.1. The User has the right to obtain information regarding the processing of their personal data in accordance with the procedure prescribed by the legislation of the Republic of Uzbekistan.
19.2. The User has the right to: obtain information concerning the fact of processing of their personal data; obtain information concerning the purposes of processing; obtain information concerning the categories of personal data being processed; request the clarification, updating, or correction of personal data; request the blocking of personal data in cases provided for by law; request the deletion or destruction of personal data where appropriate grounds exist; withdraw previously provided consent to the processing of personal data in cases where processing is carried out exclusively on the basis of such consent; obtain information concerning persons to whom personal data have been transferred, where the obligation to provide such information is prescribed by law; contact the Operator regarding matters related to the processing of personal data; appeal against actions or omissions of the Operator in accordance with the procedure established by the legislation of the Republic of Uzbekistan.
19.3. The exercise of certain rights of the User may be restricted in cases provided for by the legislation of the Republic of Uzbekistan, including situations where the processing of personal data is necessary to comply with legal requirements, protect the rights and legitimate interests of the Operator, or fulfil obligations to public authorities.
19.4. The User’s requests shall be considered by the Operator within the time limits and in accordance with the procedure prescribed by the legislation of the Republic of Uzbekistan.
19.5. To exercise their rights, the User may contact the Operator using the contact details specified in this Policy or made available on the Platform.
20.1. When using the Platform, the User shall comply with the requirements of the legislation of the Republic of Uzbekistan, the terms of the Public Offer, this Policy, and other documents governing the use of the Platform.
20.2. The User shall provide the Operator with accurate, up-to-date, and complete personal data where such provision is contemplated by the functionality of the Platform and is necessary for registration, use of certain functions of the Platform, or implementation of this Policy.
20.3. If any previously provided personal data changes, the User shall promptly update it using the functionality of the Platform or by contacting the Operator.
20.4. The User shall maintain the confidentiality of the User’s authentication credentials, including the password and one-time verification codes, and shall not disclose them to third parties.
20.5. The User shall be solely responsible for all actions performed using the User’s Account.
20.6. When uploading documents, the User warrants that: the User has lawful rights to use the relevant documents; the User has the necessary legal grounds for transferring the personal data contained in the documents; the User has obtained the consent of the personal data subjects where such consent is required by the legislation of the Republic of Uzbekistan; and the transfer of the documents does not infringe the rights and legitimate interests of third parties.
20.7. The User shall not use the Platform: to commit unlawful acts; to distribute malicious software; to infringe the rights of third parties; to post information whose dissemination is prohibited by the legislation of the Republic of Uzbekistan; to circumvent the information security mechanisms of the Platform; to gain unauthorised access to information systems; or to interfere with the operation of the Platform or its software.
20.8. The User shall independently verify legal, factual, and other material information generated using artificial intelligence technologies before using it in practice.
20.9. The User shall immediately notify the Operator of any unauthorised access to the Account, compromise of authentication credentials, or other information security incidents of which the User becomes aware.
20.10. The User shall be responsible for compliance with the requirements of the legislation of the Republic of Uzbekistan when processing the personal data of third parties contained in documents uploaded to the Platform.
21.1. The Operator shall process personal data in accordance with the legislation of the Republic of Uzbekistan, this Policy, and the terms of the Public Offer.
21.2. The Operator shall take the necessary legal, organisational, and technical measures aimed at protecting personal data against: unlawful access; destruction; alteration; blocking; copying; dissemination; provision; and other unlawful actions.
21.3. The Operator shall ensure that access to personal data is restricted exclusively to employees, contractors, and other persons for whom such access is objectively necessary to perform their official or contractual duties.
21.4. The Operator shall enable the User to update their personal data and shall take reasonable measures to amend the personal data being processed upon receiving information from the User regarding changes thereto.
21.5. The Operator shall review requests from personal data subjects in accordance with the procedure and within the time limits prescribed by the legislation of the Republic of Uzbekistan.
21.6. The Operator shall have the right to: independently determine the methods of processing personal data; improve the Platform software; modify the composition of technical information security measures; engage third parties to process personal data on its behalf, subject to compliance with the requirements of the legislation of the Republic of Uzbekistan; use anonymised information for the purpose of improving the Platform; suspend or restrict the processing of personal data in cases prescribed by the legislation of the Republic of Uzbekistan.
21.7. The Operator shall have the right to refuse to process a User’s request if such request: does not allow the applicant to be identified; contains knowingly inaccurate information; has been submitted by a person lacking the appropriate authority; contravenes the requirements of the legislation of the Republic of Uzbekistan, as well as in other cases prescribed by law.
22.1. The Operator shall take necessary and sufficient legal, organisational, and technical measures aimed at ensuring the security of personal data, taking into account the nature of the data being processed, the scope of processing, the technologies used, potential security threats, and the requirements of the legislation of the Republic of Uzbekistan.
22.2. For the purpose of protecting personal data, the Operator may apply, inter alia, the following measures: segregation of access rights to personal data; identification and authentication of users of information systems; application of cryptographic methods for protecting information during the transfer and, where necessary, storage of data, including the use of modern cryptographic protocols and algorithms (for example, TLS, AES-256, or other equivalent technologies); use of modern algorithms for hashing User credentials (for example, bcrypt, Argon2, or other equivalent technologies); use of secure data transmission channels; logging of information security events; data backup; integrity control of information systems; use of firewalls; application of means for detecting and preventing cyberattacks; antivirus protection; monitoring of information security events; timely software updates; conducting internal monitoring of compliance with personal data protection requirements; restriction of physical access to equipment and premises; and application of other protective measures consistent with the current state of development of information technologies.
22.3. Personal data shall be processed exclusively by persons who have been granted the relevant authority and whose access is required for the performance of their official or contractual duties.
22.4. Employees of the Operator, contractors, and other persons who have obtained access to personal data shall comply with confidentiality requirements and shall be liable for any breach of the established personal data processing regime in accordance with the legislation of the Republic of Uzbekistan and the agreements concluded with them.
22.5. Notwithstanding the application of necessary and sufficient protective measures, the Operator cannot guarantee the absolute security of information transmitted via the Internet, since its operation involves risks beyond the Operator’s control.
22.6. Upon identifying an information security incident capable of resulting in unlawful access to personal data, alteration, destruction, blocking, copying, dissemination thereof, or other unlawful actions involving personal data, the Operator shall record such incident, arrange for an assessment of its nature, causes, and potential consequences, and take the necessary organisational and technical measures to contain the incident, eliminate its causes, and minimise possible harm.
22.7. Following the review of an incident, the Operator may conduct an internal investigation into the causes of its occurrence, take measures to prevent similar incidents in the future, and, where necessary, update the organisational, technical, and other personal data protection measures applied.
23.1. The Operator shall treat Users’ personal data, documents uploaded by Users, and other restricted-access information as confidential information, except where the obligation to disclose the relevant information is expressly provided for by the legislation of the Republic of Uzbekistan or agreed upon with the User.
23.2. The Operator shall take the necessary measures to prevent the unlawful disclosure, dissemination, provision, or use of confidential information.
23.3. Access to personal data shall be granted solely to the extent necessary for the performance of specific employment or contractual duties.
23.4. The Operator shall ensure compliance with confidentiality requirements by employees, contractors, and other persons granted access to personal data.
23.5. The obligation to maintain confidentiality shall survive the cessation of personal data processing in the cases provided for by the legislation of the Republic of Uzbekistan or concluded agreements.
24.1. The parties shall be liable for failure to comply or improper compliance with the requirements of this Policy in accordance with the laws of the Republic of Uzbekistan.
24.2. The Operator shall be liable for violations of the laws of the Republic of Uzbekistan governing personal data to the extent of its fault and the scope of the obligations imposed upon it by law.
24.3. The Operator shall not be liable for consequences arising from: the User’s provision of inaccurate or incomplete personal data; the User’s violation of the requirements of this Policy; the User’s disclosure of their credentials to third parties; the User’s failure to comply with information security measures; actions of third parties resulting from the User’s failure to comply with the requirements for maintaining the confidentiality of their authentication credentials; the User’s unlawful uploading of documents containing personal data of third parties or other information that the User was not duly authorised to process; circumstances of force majeure, including natural disasters, mass civil disturbances, terrorist acts, hostilities, decisions of public authorities, large-scale disruptions in communications networks, energy infrastructure facilities, information and telecommunications networks, or other circumstances beyond the reasonable control of the Operator; technical failures of software, equipment, or communications networks arising for reasons beyond the Operator’s control, provided that the Operator has taken reasonable measures to restore the operability of the Platform; the User’s use of results generated through artificial intelligence technologies without independently verifying their completeness, currency, accuracy, and applicability to a specific situation.
24.4. The User shall bear sole responsibility for the content of documents, data, and other information posted, transmitted, or uploaded to the Platform, as well as for compliance with the requirements of the laws of the Republic of Uzbekistan when processing the personal data of third parties.
24.5. Nothing in this Policy shall be construed as limiting the liability of the Operator in cases where such liability may not be excluded or limited by virtue of mandatory provisions of the laws of the Republic of Uzbekistan.
25.1. The User shall have the right to submit to the Operator communications, applications, requests, demands, and other messages related to the processing of their personal data, the exercise of the rights of a personal data subject, and the application of this Policy.
25.2. A communication must contain information enabling the applicant to be identified, as well as a description of the substance of the communication. The Operator shall have the right to request additional information necessary to verify the applicant’s identity or review the communication.
25.3. The Operator shall review Users’ communications within the time limits established by the legislation of the Republic of Uzbekistan.
25.4. If sufficient information necessary to review a communication is unavailable, the Operator shall have the right to request additional documents or information.
25.5. The Operator shall have the right to refuse to grant a communication, in whole or in part, in cases provided for by the legislation of the Republic of Uzbekistan, including where: the communication was submitted by a person lacking the requisite authority; the applicant’s identity cannot be established; retention of the personal data is mandatory pursuant to legal requirements or is necessary to protect the rights and legitimate interests of the Operator or third parties.
26.1. The Operator shall be entitled to amend and supplement this Policy for the purposes of: bringing it into compliance with changes in the legislation of the Republic of Uzbekistan; modifying the functionality of the Platform; introducing new information processing technologies; improving personal data protection mechanisms; changing the Operator’s organisational processes; correcting inaccuracies or clarifying the provisions of the Policy; or for other reasons related to the Operator’s activities.
26.2. The new version of the Policy shall enter into force upon its publication on the Platform or on another date specified in the new version of the Policy.
26.3. If material amendments affecting the rights and obligations of Users are made, the Operator shall take reasonable measures to notify Users via the Platform, email, push notifications, or by other available means.
26.4. Continued use of the Platform after the new version of the Policy enters into force shall constitute the User’s consent to its terms and conditions.
26.5. If the User does not agree with the new version of the Policy, the User must cease using the Platform and shall be entitled to submit a request to the Operator to terminate the processing of personal data in the cases and in accordance with the procedure prescribed by the legislation of the Republic of Uzbekistan.
27.1. This Policy shall be governed by and construed in accordance with the laws of the Republic of Uzbekistan.
27.2. All disputes, controversies, or claims arising in connection with this Policy, the processing of personal data, or the use of the Platform shall be settled through negotiations.
27.3. Prior to initiating court proceedings, the interested party may submit a written claim to the other party if a mandatory pre-trial claim procedure is required by the laws of the Republic of Uzbekistan or by an agreement between the parties.
27.4. If the dispute cannot be settled through negotiations, it shall be adjudicated by a competent court of the Republic of Uzbekistan in accordance with the rules of jurisdiction established by the laws of the Republic of Uzbekistan.
28.1. This Policy shall remain in effect indefinitely until a new version is adopted by the Operator.
28.2. If any provision of this Policy is declared invalid, unlawful, or unenforceable, this shall not render the remaining provisions of the Policy invalid, and such provisions shall remain in full force and effect.
28.3. In all matters not governed by this Policy, the Operator and the User shall be guided by the laws of the Republic of Uzbekistan, the Public Offer, and other documents governing the use of the Platform.
28.4. This Policy shall be published and made freely available on the Platform.
The personal data Operator:
Limited Liability Company “RS PRODUCT LABS”
TIN: 313128156
Registered address: Republic of Uzbekistan, Tashkent, Yashnabad District, Yangi Davr Mahalla, 135 Muynak Street.
Email: privacy@maslahat.ai (or the address specified in the “Contacts” Section)
For matters concerning the processing of personal data: privacy@maslahat.ai.
General inquiries and support: support@maslahat.ai.
Telegram: @maslahat_support_bot.