In short
- We use data to provide the service, respond to inquiries, handle billing, keep the service secure and improve it. We do not sell personal data (Section 4).
- The seller is responsible for the data of buyers in the seller’s own channels, and Savat processes that data on the seller’s instructions. Savat is responsible for a buyer’s Savat account and for the statistics of storefronts on the Savat domain (Section 2).
- The website and the web version of the panel use analytics and advertising tools (PostHog, the Telegram ad pixel, Google tags); session recording runs only on the website (Section 9).
- Some data is stored or processed on servers abroad (Section 6).
- You can find out what data we hold about you, correct it, ask us to delete it and withdraw your consent (Section 10).
1. General provisions
This Privacy Policy explains how Savat (the savat.app service; hereinafter “Savat” or “we”) processes personal data. Savat is a platform for shops, cafes and restaurants to open and run an online store.
The Policy applies to:
- the seller.savat.app website and its contact form;
- the Savat seller panel: the web version and the Savat Seller app (iOS, Android);
- sellers’ storefront websites and Telegram shops, to the extent described in Sections 2 and 3.4.
The Policy does not cover the Savat Go courier app or the Savat customer app.
We process data in accordance with the Law of the Republic of Uzbekistan “On Personal Data” (hereinafter the “Law”) and other legislation.
For sellers, the Policy is an integral part of the Terms of Use. By submitting the sign-up form, you consent to the processing of your data for the purposes set out in this Policy, including its transfer to the countries listed in Section 6 (Model Procedure for Processing Personal Data, item 9; Article 15 of the Law). Website visitors give their consent when they submit the contact form.
The Policy is drawn up in Uzbek. The Russian and English texts are translations; in case of any discrepancy, the Uzbek text prevails.
2. Who is responsible for the data
| Whose data | Who is responsible | What this means |
|---|---|---|
| Website visitors and people who submit an inquiry | Savat | Savat collects the data for its own purposes and is the owner and operator of that data. |
| Sellers (account holders) | Savat | Account, subscription, billing and business verification data. |
| The seller’s staff and couriers | The seller and Savat | The seller creates the account and manages the data; Savat processes it to provide the service to the seller and is itself responsible for sign-in and account security. |
| Buyers: orders in the seller’s channels, the seller’s customer database and chats; other persons whom the seller enters in the panel | The seller | The seller is the owner of this data. Savat processes it only on the seller’s instructions (Article 31 of the Law). The seller’s privacy policy applies to the buyer. |
| Buyers: Savat account, orders placed through the Savat app; statistics of storefronts on the Savat domain | Savat | A buyer’s Savat account is not tied to the seller; Savat determines the purposes for which it is processed. Savat also measures storefront pages on the Savat domain for its own purposes (Section 3.4). |
3. What data we process
3.1. Website visitors and the contact form
- Contact form, required fields: name, phone number, business name and type.
- Optional fields: city, number of branches, the plan you are interested in and comment.
- Visit data added to the inquiry automatically: website language; approximate location (city, region, country) and internet service provider as determined by Cloudflare; time zone; device type and model, operating system, browser; screen size; browser languages; the page opened; which website you came from (domain and page path only); advertising campaign tags (UTM).
The IP address itself is not added to the inquiry message. Cloudflare uses it to determine the approximate location and provider (see above). The form server keeps the IP address in its anti-spam counters only in memory (RAM), for a short time. The analytics and advertising tools described in Section 9 also receive the IP address.
Page views, button clicks and technical data about the device on the website are collected through analytics tools (Section 9).
3.2. Sellers
- Sign-up: first name, last name, phone number, username and password.
- Profile (optional): patronymic, date of birth, gender, email, PINFL (JShShIR, personal identification number) and profile photo.
- Store and branches: store or brand name, legal name, type of business, subdomain, owner’s name, branch names, phone numbers, addresses and map locations, delivery zones.
- Business verification: legal name, STIR (taxpayer identification number), registration number, bank details (bank, account holder, MFO bank code, account number) and the documents you upload, such as the certificate of registration and the STIR certificate.
- Payment and Telegram settings: the identifiers and secret keys of your Payme or Click merchant account, and your Telegram bot token.
- Subscription: plan, agreement, invoices and payment status.
- Content you post: products, images, prices, promotions, Stories, storefront settings and store documents.
3.3. Staff and couriers
- Staff: first name, last name, patronymic, gender, date of birth, phone, username, email, role and permissions, profile photo. The account is activated with an activation link and an SMS code.
- Couriers: first name, last name, patronymic, phone, username, email, vehicle, assigned branches, comment and pay plan; messages exchanged with the seller about orders; earnings and cash reports.
- Courier location: the last location sent by the Savat Go app, its timestamp and the courier’s status (online, busy, offline). The seller sees it in the panel to assign orders and track deliveries.
- Action history: who did what with an order, for example which staff member or courier changed its status (with name and phone).
3.4. Buyers and other persons entered by the seller
When a buyer places an order through a storefront or a Telegram shop, and when the seller itself enters an order or a customer in the panel (for example, via Instagram or manually), we process the following for the seller:
- name and phone number; delivery address, map point and comment; saved addresses (entrance, floor, intercom);
- order contents and amount, payment method and status, returns, status history and order channel;
- data that the seller keeps in its customer database: gender, date of birth, segments, purchase statistics and bonus balance;
- messages and images in chats with the seller, reviews and replies to them;
- data of other persons the seller enters, for example supplier contact persons (name, phone, email).
The seller states in its own privacy policy which data is kept, why and for how long; the panel lets the seller publish such a document on its storefront. Online payments go to the seller’s own Payme or Click merchant account. The seller is responsible for the analytics tools it connects to its storefront itself (Yandex Metrika, Google Analytics 4, Google Tag Manager, Meta Pixel).
If a storefront runs on the Savat domain (*.savat.app), Savat, for its own purposes, receives data on the page address, load speed, browser and operating system through Cloudflare Web Analytics and Google tags; Savat is responsible for this data.
If a buyer places an order with a Savat account or uses the Savat app, Savat is responsible for the account data.
3.5. Support requests
When you ask for help through the panel, we keep your messages, attached files and callback requests (reason and preferred time). If you contact us via Telegram, phone or email, we use your message and your contact details.
3.6. Technical data
- Sessions: device, IP address, browser or app name and version (user agent), when the session was opened and last used, and when it expires.
- Requests: app name, platform, version and interface language.
- Device identifier: a random number generated at installation. It is used only for sessions and push notifications and is not an advertising identifier.
- Push notifications: device token and platform.
- Device location: to mark the store or branch on the map, and only if you allow it.
Background removal from product images runs on your device: the image is not sent anywhere; only the model needed for this is downloaded from a Hugging Face server.
4. Purposes and legal bases
| Purpose | Data | Basis |
|---|---|---|
| Responding to your inquiry: contacting you by phone or Telegram, helping you choose a plan | Contact form | Taking steps at your request before an agreement is concluded |
| Assessing which ad or channel brought you to us | Visit data in the inquiry | Savat’s legitimate interests |
| Creating an account and providing the service: panel, storefront, Telegram shop, notifications | Seller, staff and courier data, technical data | Performance of the agreement |
| Verifying the business, launching the store and online payments | Business data and documents, payment merchant account data | Performance of the agreement; legal obligations |
| Subscription billing and accounting documents | Business and bank details, subscription data | Performance of the agreement; legal obligations |
| Managing orders, buyers and delivery for the seller | Data of buyers, couriers and other persons entered by the seller | The seller’s instructions (Article 31 of the Law) |
| Support and callbacks | Support request data | Performance of the agreement; your consent for callbacks |
| Security: protecting accounts, fighting spam and abuse | Sessions, IP address, device data | Legitimate interests of Savat, sellers and other persons |
| Measuring how the website and storefronts perform | Page address, load speed, browser and operating system (Cloudflare Web Analytics) | Savat’s legitimate interests |
| Analytics on the website and in the web version of the panel, session recording on the website, measuring advertising effectiveness | Data from the analytics and advertising tools described in Section 9 | Savat’s legitimate interests: improving the website and measuring advertising effectiveness |
| Analyzing use of the service in the Savat Seller app | Account identifier, key actions, app version and device type | The consent you gave when signing up (Section 1) |
| Complying with legal requirements | Data required by law | Legal obligations |
The bases above follow Article 18 of the Law. Data is processed mainly by automated means, on Savat servers and through the services listed in Section 5; business verification and support requests are reviewed by Savat employees.
If we want to use data for a new purpose, we will first ask for your consent (Article 19 of the Law). We send advertising messages only with your prior consent (Article 30 of the Law “On Advertising”).
6. Storage location and transfers abroad
For the service to work, some data, including the following, is stored or processed outside Uzbekistan:
- Sweden: business verification files (Amazon Web Services, Stockholm).
- United States: analytics data and website session recordings (PostHog).
- Various countries: Cloudflare (all traffic of the website, panel and apps), Google, Telegram, Yandex and the email service transmit and process data through their own international infrastructure.
Under Articles 15 and 27-1 of the Law, data may be transferred to countries that ensure equal protection of personal data; Sweden is on the list of such countries (Cabinet of Ministers Resolution No. 415 of 29 July 2026). In other cases, data is transferred on the basis of your consent: sellers give it when signing up, and website visitors when submitting an inquiry (Section 1). You can withdraw your consent as described in Section 10. For data processed on the seller’s instructions, the seller ensures that this basis is in place (Section 5.3 of the Terms of Use).
7. Retention periods
We keep data until the purpose of processing has been achieved (Article 10 of the Law). Once the purpose has been achieved, the data is destroyed or depersonalized (that is, made impossible to link to a specific person) within the period set by law, except where the law requires it to be kept.
| Data | How long it is kept |
|---|---|
| Contact form and visit data | In the Savat team’s Telegram group, for as long as needed to handle the inquiry; deleted at your request |
| Seller account, store data, content, business verification files and support requests | While the account is active; destroyed or depersonalized once your deletion request has been carried out, except data the law requires to be kept |
| Data of buyers, orders, staff and couriers | While the seller’s account is active or until the seller deletes the data |
| Billing and accounting documents | Three years after the calendar year in which the tax is payable (Article 22 of the Tax Code) |
| Analytics data and session recordings | For the period set in the PostHog service; deleted at your request |
| Sign-in session | 30 days; the period is extended when the session is renewed |
| Anti-spam counters (IP address) | Only in the server’s memory (RAM), counted over 5-second and 10-minute windows; not written to disk and erased when the server process restarts |
| Cookies and browser storage | See the tables in Section 9 |
8. Security
We take legal, organizational and technical measures to protect data (Article 27 of the Law):
- The website, panel and apps communicate with the Savat servers only over an encrypted (HTTPS) connection.
- Passwords are at least 10 characters long; password resets and staff account activation are confirmed with an SMS code; you can add a passkey.
- Sign-in credentials are stored in protected form. You can view your active sessions in the settings and end sessions on other devices.
- Staff members see only the data that their role and permissions allow.
- Payment merchant account keys are not shown again in the panel.
- Business verification files are stored in separate protected storage and are checked when uploaded.
If we discover a data leak, we will notify the authorized state body in the manner set by law and warn the persons affected. If a leak occurs during a transfer abroad, we will notify that body within 24 hours and provide detailed information within 72 hours (Cabinet of Ministers Resolution No. 415).
10. Your rights
Under Article 30 of the Law, you have the right to:
- find out whether we hold your data and what it consists of;
- receive information about the bases, purposes, methods and periods of processing, the recipients of the data and transfers abroad (Article 22);
- require that incorrect or outdated data be corrected and completed (Article 11);
- require that processing be temporarily suspended if the data is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the purpose;
- object to a decision based solely on automated processing (Article 24);
- withdraw your consent and request the destruction of your data;
- file a complaint with the authorized state body or a court.
How to make a request. Send your request via Telegram or email (Section 13). We may ask for additional confirmation to verify that the request comes from the account holder. You can delete analytics and advertising cookies in your browser settings (Section 9).
Account deletion. The “Delete account” button in the panel settings opens a ready-made request email to hello@savat.app. In the email, state the store (seller) name and the phone number linked to the account; do not send passwords, confirmation codes, card details or document details.
What you can do yourself: correct profile, staff and courier data in the panel; export products (XLSX), customers (CSV), orders and financial transactions.
Consequences of withdrawing consent. If you withdraw your consent for data that is necessary to provide the service, we will not be able to continue providing the service and the account will be closed; data the law requires to be kept will be retained.
Response times:
- correcting or completing data: within 3 days of the request (Article 11 of the Law);
- once consent is withdrawn, data processed on the basis of your consent is destroyed no later than the working day following the day the request is received (Model Procedure, item 10); this does not apply to data the law requires to be kept;
- if we refuse to provide information, we will inform you of the reason in writing within 10 days (Article 22 of the Law);
- we respond to other requests within 10 days.
Buyers should first send requests about data in the seller’s channels to the seller, because the seller is the owner of that data. If such a request reaches Savat, we will forward it to the seller and help the seller carry it out. Savat itself handles requests concerning Savat accounts.
11. Minors
Savat’s services are intended for persons who are 18 or older and act on behalf of a business. We do not knowingly collect data of minors. Processing a minor’s data requires the written, including electronic, consent of a parent or guardian (Article 21 of the Law). If we learn that such data has reached us without that consent, we will delete it. If a seller adds a staff member or courier who is a minor, or if the seller’s buyers include minors, the seller is responsible for obtaining these consents.
12. Changes to the Policy
We update the Policy when the service or the legislation changes. Each new version is published on this page with its effective date. We will notify you of significant changes in advance through the panel or using the contact details you provided when signing up. If we need your consent for a new purpose, we will ask for it separately.
13. Contact
Send questions about the Policy and your data, as well as the requests described in Section 10, through these channels:
- Telegram: @savat_support (opens in a new tab)
- Email: hello@savat.app
- Phone: +998 90 416 28 97