Privacy Policy

1. Who we are and our role

ALIFCO MCHJ is a company incorporated in the Republic of Uzbekistan, taxpayer identification number (STIR) 313 113 129, with its registered office at Labzak 2A, Tashkent, Republic of Uzbekistan. We operate the Dona Platform.

For most of the personal data processed through Dona, ALIFCO acts as the controller — meaning we decide why and how the data is processed (for example, account registration, operating the marketplace, safety and fraud prevention).

Dona is an intermediary marketplace. Independent third-party Sellers list products, broadcast live video and sell to Buyers. When a Seller receives your order and delivery details to fulfil a purchase, the Seller acts as a separate, independent controller of the data it uses to process and deliver your order, and is responsible for its own handling of that data.

Our licensed payment providers (Payme, Click, ATMOS, UzCard and Humo) process your payment data as separate controllers or processors under their own terms and privacy notices. Some of our service providers (for example cloud hosting and delivery partners, providers of AI services, servers and other tools, and independent reviewers; see Product content you share is public) act as our processors, handling data on our instructions.

For any privacy question you can contact us at hello@dona.uz with a clear subject line, or by post at the address above.

2. The personal data we collect

We collect the following categories of personal data:

• Account and identity data — your phone number (used to register and sign in via a one-time code / OTP), and any name, username, profile photo or other profile details you provide. Registration is by phone number with OTP.
• Seller data — for Sellers, business or individual registration details, contact information, and information needed for payouts and compliance. To verify a Seller we also collect their surname, first name and patronymic, PINFL, passport details, phone number, email, residential address, business and company details, bank details, the documents they upload, and a photo of their face with their passport — see Seller verification (KYC) below.
• Order and delivery data — items ordered, delivery address, recipient name and contact number, order history and preferences.
• Transaction data — the status and record of your payments, refunds, wallet balance, coins and reward vouchers, and the payment method type used. We do not collect or store full card numbers — full card details are handled by the licensed payment providers.
• Device, usage and diagnostics data — device model and operating system, app version, language settings, IP address, identifiers, crash and performance logs, and how you interact with the Platform.
• Device and app-installation identifier — a random identifier created on your device the first time you install our app or visit our website. It is not derived from your phone number, your account, or any hardware identifier issued by your device manufacturer, and on its own it does not identify you by name. We use it to recognise the same installation across sign-ins, which is what lets us see whether several accounts are being used from one device — see safety and fraud prevention below. On the website it is stored in a first-party cookie and in your browser's local storage (see the Cookie Policy); in the apps it is stored in the device's secure storage. Clearing your browser storage, or uninstalling and reinstalling the app on Android, creates a new identifier.
• Advertising identifier and campaign data — in our mobile apps only, and only for the advertising measurement described below. On iOS this is Apple's advertising identifier (IDFA), which we can read only if you allow tracking when iOS asks; if you refuse, or never answer, we never read it. On Android it is Google's advertising ID, which you can reset or opt out of in your device settings. We also record which advertisement, ad set and campaign an app installation came from, taken from the referral information Google Play and Meta attach to that installation. This is separate from our own analytics, which uses neither identifier — see Advertising measurement below.
• Approximate location — only where you grant permission, for example to help with address entry and delivery.
• Sign-in history and account security — to help protect your account, we keep a record of the devices you have signed in from, together with a coarse, city/region-level location derived automatically from the IP address of each sign-in (never your exact address). We also keep a history of changes to your saved delivery addresses. This is separate from the location above, which is only ever collected with your permission.
• Camera and microphone — accessed only with your permission: during live streams (for Sellers broadcasting, and for interactive features you choose to use), and the camera when you use it to take a photo — for example a product photo or, for seller verification, the photo of your face with your passport (see Seller verification (KYC)).
• Communications and content — chat messages, reactions, reviews and other user-generated content (UGC) you post, and the messages you send us for support or complaints.
• Messages and comments on our Instagram and Facebook accounts — the direct messages and comments you send to Dona's Instagram and Facebook accounts, the name and username those accounts show for you, and a phone number if you choose to share it — see Messages and comments on our Instagram and Facebook accounts below.

3. How we use your data and our legal bases

We use personal data for the purposes below, relying on the legal bases indicated:

• To provide the Platform and your account — registration, sign-in, operating the marketplace, live shopping, the wallet, coins and reward vouchers. Legal basis: performance of a contract with you and taking steps at your request.
• To process orders and payments — sharing what is necessary with the relevant Seller, payment provider and delivery partner. Legal basis: contract and, for records, legal obligation.
• To improve address search and courier work — after your order has been delivered, the building-level part of the delivery address (region, district, street, house number and the point on the map) — without your name, your phone number or your apartment number — is kept to improve address search and the work of couriers, and may be shown to other buyers as an address suggestion. The courier may confirm the address at delivery. Legal basis: our legitimate interests.
• To verify Sellers (KYC) — checking and confirming a Seller's identity and business details, an automated preliminary review of the application, paying the Seller and authorising withdrawals, preventing fraud, contacting the Seller about the application, and meeting statutory tax and accounting obligations; set out in full under Seller verification (KYC) below. Legal basis: the Seller's consent, with a separate consent for the photo of their face, and, once the seller relationship has ended, the legal obligation to keep tax and accounting records — never our legitimate interests. The offer a Seller accepts, and the Seller's orders, commissions and payouts, rest on the contract and on legal obligation.
• To enable live commerce and content features — showing streams, chat, reactions and reviews. Legal basis: contract and, for camera/microphone/location, your consent.
• For safety, moderation and fraud prevention — detecting abuse, protecting users and the Platform, and enforcing our policies. This can include comparing data such as sign-in IP address, delivery address, or the device and app-installation identifier described above across accounts, to detect patterns associated with fraud or abuse — for example several accounts placing orders from the same address, or a large number of accounts being created and used from a single device, in a way that suggests abuse of a promotion or of our coins, reward vouchers and live-shopping games. Where a device shows such a pattern we may refuse new sign-ins and new registrations from that device. Blocking a device does not by itself close, suspend or restrict any account: action against an account is taken separately, on its own grounds, and under the Account Management & Deletion Policy. We will tell you the reason on request, and you can ask us to review the decision — see Your rights. This does not cover the data a Seller gives us for verification: we use it to prevent fraud only on the basis of the Seller's consent (see Seller verification (KYC)). Legal basis: our legitimate interests and legal obligation.
• For support and communications — responding to enquiries and complaints, sending service messages. Legal basis: contract and legitimate interests.
• To answer messages and comments on our Instagram and Facebook accounts — replying to what you write, pointing you to the app or to Dona Yordam, and, if you ask to sell on Dona and share your phone number, letting our team contact you; set out in full under Messages and comments on our Instagram and Facebook accounts below. Legal basis: contract and legitimate interests, as for support and communications; and, where you ask to sell on Dona and leave your number, taking steps at your request.
• To improve and secure the Platform — analytics, diagnostics and security. Legal basis: legitimate interests.
• For personalised recommendations — choosing which products to show you first in our apps from what you have done on Dona, set out in full under Personalised recommendations below. Legal basis: our legitimate interests. Personalisation is part of the service, whether or not you are signed in. You can reset it at any time in Settings → Reset my recommendations — in current versions of the app, in part or in full, as that section sets out — and you can object to it by writing to us, as set out under Your rights.
• For AI-assisted features — checking seller and streamer applications, helping new sellers through their application, preparing advice for sellers, checking product listings, answering questions in the support chat and in live-stream chat, hiding abusive live-chat comments, checking live-stream video for prohibited content, rating rehearsals before live access, coaching hosts during live streams, and partner matching between streamers and shops, with the help of third-party AI service providers; set out in full under AI-assisted features below. The AI is a helper that can make mistakes; the most serious decisions are made only by people, and you can object to any decision it makes. Legal basis: contract and our legitimate interests — except for a seller application (the application check, and what the assistant reads about where the application stands), which is part of seller verification and rests on the Seller's consent (see Seller verification (KYC)). For product content, the legal basis also includes your consent (see Product content you share is public).
• For advertising measurement and retargeting — finding out which of our advertisements actually bring people to Dona and lead to an order, so that we stop paying for advertising that does not work, and showing Dona's advertisements to people who have already used Dona (retargeting). This is the one purpose for which data about you is shared with companies outside Dona for their own use — Meta Platforms and Google — and it is set out in full under Advertising measurement below. Legal basis: your consent, given through Apple's tracking prompt on iOS and through Settings → Ad measurement in the app on both platforms, and — where the applicable law does not require consent for this — our legitimate interests in measuring our own advertising; retargeting rests on your consent alone. Refusing costs you nothing: every part of Dona keeps working, and what refusing does and does not reach is set out in full below.
• To advertise Dona and Sellers' goods with Sellers' content — product photos, titles, descriptions, videos, recordings of live streams and a shop's name, logo and page, including the people who appear in them, but never seller verification (KYC) data; set out under Sellers' content in our advertising below. Legal basis: the contract — the content licence in the Seller Services Agreement — and, for the image, voice and name of a person who appears in that content, the consent the Seller gives in that licence and confirms it has obtained from that person.
• For legal, tax and accounting compliance — keeping records required by law. Legal basis: legal obligation.
• Marketing messages — when you allow notifications, we send you order updates and also offers, discounts, new products and live broadcasts, including reminders about products you viewed or left in your cart. You can switch off each kind separately at any time in the app under Settings → Notifications, or turn notifications off in your phone's settings. We do not send promotional SMS; we text you only about steps you must take, for example a problem with an order. By email we send order and account messages and occasionally offers, and every promotional email has an Unsubscribe link.

Where we rely on consent, you may withdraw it at any time (for example in your device settings for camera, microphone and location, or by contacting us); withdrawing consent does not affect processing already carried out.

4. How we share your data

We share personal data only as needed:

• With Sellers — the order and delivery information a Seller needs to fulfil and deliver your purchase. The Seller is a separate controller for that data.
• With service providers (our processors) — cloud hosting, delivery/courier partners, communications and analytics providers, AI services, servers and other tools for checking and processing product content, independent reviewers, email, SMS, push-notification and messenger providers and printing partners — among them Slack (USA), through which our staff receive internal notices, for example about seller applications (see Seller verification (KYC)) — and third-party AI service providers, which run the AI features described under AI-assisted features when they use your personal data — all acting on our instructions.
• With Meta, for messages and comments on our Instagram and Facebook accounts — Instagram and Facebook are run by Meta Platforms, which carries your messages and comments to us and our replies to you, under its own terms and privacy policy. For what Meta does with them on its own platform it is a separate, independent controller; see Messages and comments on our Instagram and Facebook accounts.
• With third-party AI service providers, to run Dona AI on those messages — in the European Union, on our instructions; see Messages and comments on our Instagram and Facebook accounts.
• With third-party AI service providers, to run Dona AI and its helper tools on phone calls — the voice and the text of a call, on our instructions; when Dona AI answers, one provider can take over from another; see Phone calls to Dona — recorded, and answered with Dona AI.
• With a third-party AI service provider, for checks of live-stream video — still frames from live streams are sent to it to be checked for prohibited content and, for the live coaching, for how the stream is presented, and the provider returns the result; see AI-assisted features for what we cannot yet tell you about where this happens.
• With licensed payment providers — Payme, Click, ATMOS, UzCard and Humo, to process payments and refunds. They handle full card data separately under their own terms.
• With Google and Apple, to deliver notifications — our apps' notifications, for example about an order or the status of a seller application, are delivered through Google's and Apple's notification services.
• With DIDOX TECH, to check sellers in the state tax register — to confirm a Seller's business details, we send the STIR or PINFL the Seller entered to DIDOX TECH LLC (STIR 310529901), an e-document operator in Uzbekistan, which checks it against the state tax register of the Republic of Uzbekistan and returns the answer; see Seller verification (KYC).
• With UZINFOCOM, to verify Sellers' identity with MyID — if a Seller chooses MyID, the MyID module of UZINFOCOM Single Integrator LLC (STIR 204118319) in our app sends images of the Seller's face from their phone directly to UZINFOCOM's state biometric identification system MyID in Uzbekistan; our service in Uzbekistan (Tashkent) sends it the PINFL, passport details and date of birth the Seller entered, and receives the result of the check and the Seller's details held by the state register; see Seller verification (KYC).
• With Meta Platforms, for advertising measurement and retargeting — where you have not refused it, we send Meta the events set out under Advertising measurement below, together with your advertising identifier, your device and app-installation identifier, and an irreversibly hashed form of your email address, phone number and Dona account number. The readable email address and phone number are never sent. Meta is a separate, independent controller for what it does with that data afterwards, under its own privacy policy.
• With Google, for advertising measurement and retargeting — where you have not refused it, our apps report the same kind of events to Google (Google Analytics for Firebase), together with your advertising identifier. We use it to measure the advertising we buy from Google, which cannot be measured any other way, and to understand how the apps are used. Google is likewise a separate, independent controller for what it does with that data afterwards, under its own privacy policy. It is covered by the same refusal as Meta and the same switch.

These two are the only entries on this list that put data about what you do on Dona to work for our advertising — measuring it and, through retargeting, showing it to people who already use Dona, and, for marketing messages, reminders about products you viewed or left in your cart — and the only ones you have a choice about: Advertising measurement below sets out exactly what that choice reaches.

• Sellers' content, in our advertising — when we advertise with a Seller's content, as set out under Sellers' content in our advertising below, it is published in our own channels and through social networks and advertising platforms run by other companies — for example Facebook, Instagram and Google — under their terms.
• For legal and safety reasons — where required by law, a valid legal request, or to protect the rights, safety and property of users, the public or Dona.
• In a business transfer — if ALIFCO is involved in a merger, acquisition, reorganisation or sale of assets, data may be transferred as part of that transaction, subject to this Policy.

We do not sell your personal data. Sharing data with Meta or Google for advertising measurement is not a sale — we pay them to advertise, they do not pay us for data — but it is a real disclosure to another company, so we describe it plainly and let you refuse it.

5. International transfers

Dona runs on cloud infrastructure that may be located outside Uzbekistan (for example, in the European Union; for product content also in the United States, the Middle East and Asia). This means your personal data may be transferred to, and processed on, servers outside Uzbekistan, and payment providers may process payment data on their own systems.

Where personal data is transferred internationally, we apply appropriate security safeguards and take reasonable steps to ensure it is protected to a standard consistent with this Policy and applicable law. Please see the section on Uzbek personal-data law below, which explains how the data-localisation requirement affects this and how we are addressing it honestly.

Most of the AI features described under AI-assisted features run with third-party AI service providers in the European Union when they use your personal data or your own words, on our instructions. Three kinds of processing take place elsewhere, and the sections named here describe them: product content — which may be processed by third-party AI services, servers and people in the United States, Europe, the Middle East and Asia (see Product content you share is public) — the automated check of still frames from live streams, which are sent to a third-party AI service provider — a service that does not let us choose the country where the frames are processed, so we cannot tell you which country that is — and phone calls to Dona, whose voice and text go to third-party AI service providers (see Phone calls to Dona — recorded, and answered with Dona AI).

Seller verification data is handled as set out under Seller verification (KYC): documents and photos are stored, encrypted, only in Uzbekistan (Tashkent); the other verification data is stored in Germany (Frankfurt), which Cabinet of Ministers Resolution No. 415 of 29 July 2026 lists among the states that provide an adequate level of personal-data protection. The photo of a Seller's face passes briefly through servers outside Uzbekistan on its way to Tashkent and is not stored outside Uzbekistan; text from the application is checked on servers in the European Union; and internal notices to our staff about applications go through Slack, in the USA.

Advertising measurement is a further international transfer, and a different one in kind: it goes to Meta Platforms, Inc. and to Google LLC, and their group companies, which process it on their own infrastructure outside Uzbekistan — including in the United States, Ireland and other countries where they operate — under their own privacy policies rather than on our instructions. Refusing advertising measurement stops the app's half of that transfer entirely, and stops any advertising identifier being read or sent. Refusing stops both halves of that transfer: the app's, and the server-side record of a paid order described under Advertising measurement below.

Messages and comments on our Instagram and Facebook accounts pass through Meta's systems, which are outside Uzbekistan and run under Meta's own terms; Dona AI reads them with a third-party AI service provider in the European Union, and we store them in Germany (Frankfurt) — see Messages and comments on our Instagram and Facebook accounts.

Phone calls to Dona are stored in Tashkent, but their voice and text are processed by third-party AI service providers (two when Dona AI answers, each able to take over from the other) — see Phone calls to Dona — recorded, and answered with Dona AI.

6. Uzbekistan personal-data law and data localisation

The processing of personal data of citizens of the Republic of Uzbekistan is governed by the Law of the Republic of Uzbekistan "On Personal Data". As amended in 2026, that law requires three kinds of personal data to be stored in Uzbekistan: biometric data, genetic data, and the data of users of telecommunications operators working in Uzbekistan. Other personal data may be stored and processed outside Uzbekistan when one of the conditions the law sets is met — for example, that the country is on the list, set by the Cabinet of Ministers, of countries that ensure adequate protection of personal data. Databases that must be stored in Uzbekistan must also be registered in the State Register of personal-data bases. For product content we rely on your consent under Article 15 and on the other grounds the law provides.

We are committed to describing our actual processing honestly. Because Dona currently uses cloud infrastructure that may be located outside Uzbekistan, we treat such processing as an international transfer with security safeguards, as described above, and we are working to make sure that each such transfer meets one of the conditions the law sets, and that any data the law requires to be kept in Uzbekistan is kept there and registered. We will not claim a compliance status that is not in place. As our arrangements evolve, we will update this Policy and notify users of material changes.

If you have questions about how Uzbek personal-data law applies to you, contact us at hello@dona.uz.

7. How long we keep your data

We keep personal data only for as long as it is needed for the purposes described in this Policy — for example, while you have an account and to operate the Platform — and thereafter for as long as necessary to meet legal, tax, accounting, dispute-resolution and record-keeping obligations, or to establish, exercise or defend legal claims.

When data is no longer needed, we delete it or anonymise it. Some records (for example transaction and tax records) may be retained for the period required by applicable law even after you close your account. See the Account Management & Deletion Policy for how deletion requests are handled.

Sign-in history, device records, the device and app-installation identifier, the record of which accounts have signed in from a given installation, and the history of changes to your saved delivery addresses are kept for the life of your account, since they are what lets us detect and investigate suspicious activity. They are handled the same way as your other account data if you delete your account.

Seller verification data is kept for the whole of the seller relationship and for 5 years after it ends, then deleted; the photo of a Seller's face is deleted once a decision has been made on the application — see Seller verification (KYC).

Advertising-attribution records — which campaign an app installation came from — and the record of whether you allowed advertising measurement are kept for the life of your account and are removed with it. Events already sent to Meta are thereafter held by Meta under its own retention rules, which we do not control; that is a reason to refuse before rather than after, if you would rather they were not sent.

The records behind Personalised recommendations are kept as that section sets out: the in-visit list for 6 hours (signed out) or 24 hours (signed in) after your last activity; the account profile, rebuilt every hour from the last 90 days (180 days for sizes and colours) — or, after a reset, from what that reset leaves — until you delete your account or object; the recommendation preferences you set yourself, until you change them or delete your account; the activity records themselves, today without a fixed time limit, which a reset does not delete and which no longer carry your account once you delete it; the record of which products we showed you, also without a fixed time limit today, whose entries made while you were signed in are deleted with your account; and the record of each reset you make, kept with your account and deleted with it.

The records behind AI-assisted features — the records of the checks of seller and streamer applications, the advice for sellers, support chats, the assistant's record of its reminders, the records of problems found in live-stream video, the ratings of rehearsals, the tips sent to hosts during live streams and the records behind partner matching — are kept as that section sets out.

Product content — kept while it is listed or needed for the shop, for disputes and as the law requires; copies held by third-party reviewers for a task are deleted when the task ends; advertising already published may remain.

Phone calls to Dona: recordings, transcripts and call details are not deleted automatically after a set time; staff can play a recording for 180 days, and call data is deleted when the Dona account tied to the phone number is deleted — see Phone calls to Dona — recorded, and answered with Dona AI.

Recordings of live streams: a recording its owner — the shop, or the streamer who presented it — has not chosen to keep is kept for up to 30 days after the live stream ends; a saved recording, for 365 days. When its owner deletes a recording, or its 365 days end, it leaves their list straight away and is kept for 30 more days, during which its owner can restore it. A recording is deleted when its period ends; if Dona AI found a possible breach of our rules in that live stream that our team has not yet reviewed, it is kept until the team has; if our team blocked that live stream for breaking our rules, the recording is kept for 180 days from that decision, so that it can be reviewed if the decision is contested. We do not delete a recording straight away, even on request or when an account is deleted, because we need it for security and to meet legal requirements. The record of who saved, deleted or restored a recording, and when, is kept permanently.

Messages and comments on our Instagram and Facebook accounts, and the details kept with them, are kept as Messages and comments on our Instagram and Facebook accounts sets out: 365 days after the last message, longer only while a seller enquiry linked to them is open.

8. How we protect your data

We use technical and organisational security measures designed to protect personal data against loss, misuse, and unauthorised access, disclosure or alteration — including encryption in transit, access controls and monitoring. Full card details are never stored by Dona; they are handled by the licensed payment providers.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please help protect your account by keeping your device and phone number secure and by not sharing your one-time codes with anyone.

Product content you publish is public — see Product content you share is public; the measures here protect what we hold, not what others copy from a public page.

9. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and obtain information about how we process it.
• Correct data that is inaccurate or incomplete (you can also update much of your profile in the app).
• Delete your data, subject to legal retention obligations: we delete it from our systems and ask the providers we gave it to to delete it; we cannot delete copies others have made of public content.
• Object to or restrict certain processing, including where we rely on legitimate interests.
• Human review — object to a decision made about you by an automated system, including our AI, have a person review it and be told the main reasons for it; we consider the objection and tell you the result in writing within 10 days (see AI-assisted features).
• Withdraw consent at any time where processing is based on consent (for example camera, microphone, location, marketing, product content, or seller verification — see Seller verification (KYC)). Withdrawing your consent to product content means you will no longer be able to upload products or go live, and your shop will be closed.
• Data portability — receive certain data in a commonly used format, where applicable.
• Complain to the relevant authority (see below).

To exercise any right, contact us at hello@dona.uz with a clear subject line. We may need to verify your identity. We will respond within the period required by applicable law.

10. Children and minors

Dona is not intended for children below the minimum age required by applicable law. Users must meet that minimum age to register and use the Platform. We do not knowingly collect personal data from children below that age. If you believe a minor has provided us with personal data without appropriate consent, contact us at hello@dona.uz and we will take appropriate steps, including deletion where required.

11. Analytics we run ourselves — website and apps

We measure how our website and our mobile apps are used with our own first-party analytics, hosted on our own infrastructure. This data is never sold, shared for advertising, or sent to another company — it stays on our servers. On this website we use no third-party analytics service at all.

Our mobile apps additionally carry Google Analytics for Firebase, which reports app usage to Google. We are open about why it is there: the advertising we buy from Google cannot be measured without it. It therefore belongs to the separate Advertising measurement purpose set out below, it is covered by the same single refusal — Settings → Ad measurement — and until you have been asked it collects nothing at all. The first-party system described in the rest of this section is unaffected by it: that one stays ours and reaches nobody.

The rest of this section is only about that first-party system. Our mobile apps also run a separate advertising-measurement system that does send data to Meta and to Google; it has its own section, Advertising measurement, below, and you can refuse it without losing anything on Dona. The two are deliberately kept apart, and nothing described in this section is shared with Meta or Google.

On our website

What we record — the page path you visited (never the query string), the website that referred you (domain only), any campaign tags in the link you followed, your approximate country, region and city (resolved at the moment of your visit from your IP address using a geolocation lookup — the address itself is never stored, only a city-centroid map coordinate for the resulting location, never your exact position), and a coarse description of your device, operating system and browser. To tell one visit from another we store a random identifier in your browser's local storage, together with a session identifier.

What we deliberately do not do — on this website we do not store your IP address anywhere, we do not use cookies for analytics, and we do not fingerprint your device or attempt to identify you across other websites. There is no advertising pixel on dona.uz: the advertising measurement described below runs in our mobile apps, not here. The random identifier is not linked to your account unless you are signed in, and clearing your browser storage removes it entirely and makes you a new visitor.

Your controls — if your browser sends a "Do Not Track" signal, we send nothing at all. You can also clear your site data at any time to reset the identifier.

In our iOS and Android apps

The same first-party system runs inside the Dona app. It records which screens you open (the screen name only, never the content you are looking at), when the app is first installed on your device, when a session starts and when you open the app, your app version, your device model and operating-system version, your platform (iOS or Android), the language you use the app in, and your approximate country, region and city (resolved the same way as on our website — never your exact position).

To count devices without identifying you, the app stores two random identifiers in the app's own storage on your device: a device identifier, and a session identifier that groups the screens you open in one sitting and starts afresh after 30 minutes of inactivity. Neither of these two is an advertising identifier, and neither is ever sent to Meta or to anyone else: the analytics system described here does not read or use Apple's IDFA or Google's advertising ID. It also does not read your device name, device build fingerprint, contacts or precise location.

The app does read an advertising identifier — but only for the separate advertising-measurement purpose, never for the analytics described here, and only on the terms set out under Advertising measurement below: on iOS only if you allow tracking when iOS asks you, and on Android unless you turn Settings → Ad measurement off in the app or opt out in your device settings. As part of advertising measurement a coarse technical description of your handset — its model, operating-system and app version, screen size and density, language, time zone, mobile operator, processor cores and total storage — is sent to Meta and to Google; that is described in the same section.

Your account — while you are signed in, the app sends these records with your normal Dona login, so they are linked to your account. While you are signed out they carry only the two random identifiers above and no account. This is the same rule as on our website.

Your controls — you can switch this off at any time in the app under Settings → Usage analytics. Turning it off stops all collection by this analytics system and deletes both identifiers from your device. Deleting the app also removes them, and reinstalling starts new ones, unconnected to the old. Advertising measurement is a separate purpose with its own switch, Settings → Ad measurement; turning one off does not turn off the other, and each can be refused on its own. One exception, once: if you had already turned usage analytics off before advertising measurement existed, that refusal was carried across to it the first time, so that an app update could not read an old no as a new yes. After that the two are independent.

Both surfaces

Sign-in diagnostics — when enabled in supported versions, our optional first-party diagnostics record whether a sign-in code was requested, accepted by a delivery provider, published for verification, verified or refused, and whether an account was created or login credentials were issued or refused. We use random server-generated request and code-generation identifiers to relate these observations; they do not contain the code, phone number, IP address, device identifier or message contents. Before the account is resolved, these diagnostic records have no account link. After verification, supported outcomes can be linked to the account, with limited app/portal, platform, version and timing information. Provider acceptance does not prove delivery to your phone, and credentials issued does not prove that your device received them, that a session was saved or that sign-in completed. This collection respects the same usage-analytics choice and browser Do Not Track rule described above; an unknown or refused choice prevents collection. Signing in, registering and the separate security checks continue normally regardless of that choice. We do not reconstruct earlier sign-in attempts.

Seller application diagnostics — when enabled in supported versions of the Dona app and seller portal, this diagnostic records when a new seller application is created. This record is linked to your account and application and contains the creation time, whether you used the app or portal, and limited platform and version information. It does not contain your identity documents, bank details or the contents of application forms. Creating an application does not mean that identity verification is complete or that the application is approved. This diagnostic collection requires a supported client that can communicate your usage-analytics choice: it respects Settings → Usage analytics in the app and Do Not Track in the browser. If that choice cannot be determined, we do not collect this diagnostic record. We do not reconstruct these records from older applications. Your application and verification continue normally regardless of this analytics choice.

Supported save and submission observations — the same optional diagnostics can record a profile or explanation save, shop creation, a review being queued, a verification session moving to submitted, or the first submission stamp. These are separate server-confirmed writes, with their operation time and limited outcome information; one does not prove that a later step succeeded. They are linked to the account and, only when the native write identifies it, the exact application or shop. A missing application link remains missing. We do not copy form contents, documents, bank details or review reasons into these observations. Collection can miss events, so an absent record does not mean that you failed to act. These observations follow the same choice, Do Not Track and retention rules. Identity and document decisions and current verification status remain separate operational records governed by Seller verification (KYC); these diagnostics do not replace that purpose or its consent requirements.

Operational verification outcomes — separately from optional activity diagnostics, we may keep limited records of identity and registration-paper decisions, returns for correction, resubmission, verification resets, and application approval, closure or abandonment to review and reconcile seller verification. They contain an operation time, a limited outcome and method, and an account/application link only where the native operation identifies it. They do not copy documents, form contents, bank details, decision reasons or provider replies. These records remain governed by the purpose and consent requirements under Seller verification (KYC); a staff member’s browser analytics choice is not the Seller’s consent, and an optional usage choice does not replace KYC consent. Missing or unlinked records remain incomplete; an outcome count is not proof of a completed application, current approval, a successful payout or a complete history. These limited outcome records are retained pending our retention review; the separate document, photo and other verification-data rules under KYC continue to apply.

How long we keep it — we currently retain detailed first-party usage and application-diagnostic records pending a retention review; there is no automatic 13-month deletion cutoff. When collected, sign-in diagnostic records follow the same retained-until-review policy. Account-linked records remain account-linked while retained. You can request access, object or request deletion as described under Your rights. This does not change the separate retention rules for orders, payments, identity documents or other operational records.

Legal basis: our legitimate interests in understanding and improving our service, using the least intrusive method we could design.

12. Advertising measurement and retargeting — a separate purpose you can refuse

We advertise Dona on Facebook, on Instagram and through Google. To know whether that advertising works — whether an advertisement actually led to an installation, a sign-up or an order, rather than being paid for and ignored — and to show Dona's advertisements to people who have already used Dona (retargeting), our mobile apps share a limited set of events with Meta Platforms, Inc. and its group companies ("Meta") and with Google LLC and its group companies ("Google"). This is a separate purpose from the analytics described above; it is set out separately here because it behaves differently, and it is the one purpose for which data about you leaves our infrastructure and reaches another company for that company's own use. You can refuse it and keep every feature of Dona.

This section applies to our iOS and Android apps. There is no advertising pixel on dona.uz.

What it does

• In the app. Our app includes Meta's software development kit (SDK) and Google's (Google Analytics for Firebase). Where you have not refused advertising measurement, they report a small number of events — that the app was installed and opened, that an account was created or signed in to, that a product was viewed, searched for, saved or added to the cart, that a checkout was started, and that an order was placed, with its value and currency. Google's SDK also records which screens you open, by name.
• Nothing before you are asked. Google's SDK is shipped switched off: it collects nothing, not even that the app was opened, until the answer described under Your controls below has been given. If you refuse, it stays off and the identity it would have kept on your device is erased.
• Where you came from. When you install the app, Google Play and Meta pass on the referral information attached to the advertisement you tapped. We decrypt it on our own servers so that our own records show which campaign, ad set and advertisement brought that installation. On Android this information is real; on iOS Apple does not provide it, so there we only ever see aggregated results.
• From our servers. An app can be closed, lose signal, or have its network requests blocked, so the record of an order is also sent to Meta from our servers, through Meta's Conversions API — making our own payment records the source of truth rather than the phone. Each event carries an identifier that lets Meta discard the duplicate when the app has already reported the same order. Today this server-side route is used for Meta only; if we extend it to Google we will say so here first.
• Retargeting. Meta and Google can use these events, and the hashed contact details described below, to show Dona's advertisements — for example for a product you looked at — to people who have already used Dona, or to leave them out of advertising meant for people new to Dona (what Meta and Google call custom and remarketing audiences). We do this only where you have not refused advertising measurement: it is part of this purpose, under the same consent and the same refusal.

What is sent

• Your advertising identifier — Apple's IDFA on iOS, only if you allowed tracking when iOS asked; Google's advertising ID on Android, unless you have turned advertising measurement off in the app or opted out in your device settings. It is sent as it is, because it is what Meta and Google match on.
• Meta’s app-installation identifier — Meta’s SDK creates a separate random identifier on your device. Where advertising measurement is allowed and a valid advertising identifier is available, our app sends this SDK identifier to our servers so that events sent from the phone and our servers can be matched by Meta. It is sent as it is. Our servers clear it when tracking permission is withdrawn or the associated account is deleted. Dona’s own sign-in and fraud-prevention installation identifier is no longer sent to Meta for this purpose. Google’s SDK keeps its own separate identifier, created on your device for this purpose and erased if you refuse.
• A hashed form of your contact details — your email address, phone number and Dona account number are converted, before they leave our servers, into an irreversible cryptographic hash (SHA-256). Meta can compare that hash against hashes it already holds, but cannot read the original values from it, and we never send the readable ones.
• The order — its value, its currency and its order number.
• A coarse technical description of your device — model, operating-system and app version, screen size and density, language, time zone, mobile operator, processor cores and total storage. This is what Meta's SDK requires. It is not your device name, and it does not include your contacts, your precise location or the content you look at.
• Whether you allowed tracking. Every event carries the truthful answer, so that Meta applies the restrictions that answer requires. If you refused, we say you refused.

We do not send Meta what you wrote in chat, what you watched in a live stream, your delivery address, your saved cards, or the contents of your account.

Your controls — how to refuse

• iOS — when the app first asks whether Dona may track your activity across other companies' apps and websites, choose Ask App Not to Track. You can change your mind at any time in iOS Settings → Privacy & Security → Tracking. If you refuse, no advertising identifier is read, and Meta is told that tracking was not allowed.
• Android — open Android Settings → Google → Ads to delete your advertising ID or opt out of ad personalisation.
• In the app, on both platforms — Settings → Ad measurement. Turning it off takes effect straight away, not at the next restart: the app stops reporting to Meta, unbinds your account from Meta's SDK, and tells our servers that you have withdrawn, so no advertising identifier rides with any later event.
• What refusing stops — all of it. It stops the app reporting to Meta and to Google, it stops your advertising identifier being read or sent, it erases the identifier Google's SDK keeps on your device, and it stops our servers reporting a paid order to Meta through the Conversions API. An order you place after refusing is not reported to Meta or to Google at all, and nothing new about what you do on Dona reaches them for retargeting.
• Your refusal follows you, not the handset. It applies if you refused on this device or on any device your Dona account has been seen on, so changing or adding a phone does not quietly restart the reporting.
• What it cannot undo. Events already sent to Meta before you refused remain with Meta under its own rules, which we do not control, together with any advertising audience they had already been added to — a reason to refuse early rather than late. You can also object to our past records under Your rights above.
• Nothing is lost. Refusing advertising measurement does not restrict your account, your orders, your coins, your reward vouchers, or any part of the service. Nothing on Dona is priced, ranked or withheld according to that answer, and it is a choice separate from Settings → Usage analytics — you can refuse either one without the other.

Meta's role, transfers and retention

For what it does with this data once it has it, Meta acts as a separate, independent controller under its own privacy policy (opens in a new window). Meta processes it on its own infrastructure outside Uzbekistan, including in the United States and Ireland — see International transfers above. Our own attribution records, and the record of what you allowed, are kept for the life of your account.

Legal basis: your consent, given through Apple's App Tracking Transparency prompt on iOS and through Settings → Ad measurement in the app on both platforms, and — where the applicable law does not require consent for this — our legitimate interests in measuring our own advertising, which is the basis the server-side order record described above currently rests on. Retargeting rests on your consent alone. Where we rely on consent you may withdraw it at any time using the controls above; withdrawal does not affect what was already shared.

13. Personalised recommendations — part of the service, and how to reset them

In our apps, Dona chooses which products to show you first — on the home feed, in category and deals lists, in the order of search results (only when we know your interests), in the home shelves, under You may also like on a product page and the feed that continues below it, and in the "you may also need" shelves in your cart, at checkout and on your orders — partly from what you have done on Dona. The choosing happens only on our own infrastructure: the in-visit list and the account profile described here are never sent to Meta, Google or any other company, except that marketing messages about products you viewed or left in your cart are sent through email and push-notification providers. It is part of the service for everyone, signed in or not, and you can reset it at any time.

Separately, unless you have refused Advertising measurement (described above), we report some of the same actions to Meta and Google — a product opened or tapped in a list, a search together with what you searched for, a wishlist or cart addition, an order. Resetting your recommendations does not stop that reporting; only refusing advertising measurement does.

What we use

• Within your current visit — what you open, search for and tap; how long you pause on a product in a list and whether you watch its video or swipe through its photos; what you add to or remove from your wishlist or cart; the products you tap Buy now on during a live stream; the shops you follow; how long you watch a live stream and the products pinned while you watch; the comments you open or post on a product or a live stream; the reviews you open; and the checkout you reach. While you are signed in this is kept with your account. While you are signed out it is kept against a random visit identifier, never your account — personalised only for that visit, up to 6 hours; an objection is recorded against an account, and signing in on that device lets an objection you have made cover it.
• On your account, if you are signed in — a preference profile of the categories, brands and shops you lean towards, recalculated every hour from the last 90 days of that activity, your orders, the products you share and the shops you follow; the times of day and days of the week at which you tend to look at them, and how often you visit and order — used only to shape what is shown to you first; and the sizes and colours of what you have ordered or added to your cart in the last 180 days, so that a product page can open on the option most likely to fit you.
• What you tell us, if you are signed in — the recommendation preferences you can set in your profile: your sizes and your favourite colours, typed by you. They are optional, you can change or clear them at any time, and they take precedence over those learned from your orders.
• Your approximate region — worked out from your connection for each request, so that we can prefer sellers who ship from near you. It is never kept in your profile.

For this purpose we do not use what your chats say, the text of a comment you write, your delivery address, advertising identifiers, or the usage-analytics data described above. Products in sensitive categories — for example health, pharmacy or intimate products — are never used to build a profile.

How long it is kept

• The in-visit list holds at most your last 100 actions and is deleted 6 hours after your last activity while you are signed out, or 24 hours after it while you are signed in.
• The account profile is rebuilt every hour, so activity older than 90 days drops out of it — older than 180 days for sizes and colours — (the shops you follow stay in it until you unfollow them or run a full reset), and it is deleted when you delete your account or object.
• The recommendation preferences you set yourself are kept until you change or clear them, and are deleted when you delete your account. A reset does not change them.
• The activity records themselves are kept today without a fixed time limit. A record made while you are signed out identifies you by no more than a random visit identifier — which we keep with the device and app-installation identifier, the IP address and the approximate location of that visit — and a one-way code of your app installation that changes every 72 hours, kept only so that we can count distinct devices and detect abuse. When you delete your account, your records no longer carry your account, your orders or that code; the visits we can tell were yours lose your account and the installation identifier, IP address and location kept with them; and what remains only counts towards totals. A record made while signed out that we cannot tell was yours — for example, one made on a device another Dona account also uses — keeps those details and that code.
• The record of which products we showed you, and where, is kept today without a fixed time limit — with your account if you were signed in, otherwise with the visit identifier alone — and what it holds with your account is deleted when you delete your account.
• The record of each reset you make — which reset and when — is kept with your account and is deleted with it. A reset made while you are signed out is not recorded.

Your controls — how to reset it

• In the app — Settings → Reset my recommendations, in current versions of the app, whether or not you are signed in. It offers the three resets below. Each asks you to confirm and takes effect on that device straight away: the app sends it to our servers, then reloads what is on screen (for Clear search history it also clears the device's search history), and every list loaded after that is chosen from what is left. Running a reset again is harmless. Older versions of the app do not have it but are personalised all the same: update the app to use it, or object by writing to us, as set out below.
• Reset recent recommendations — the in-visit list is deleted straight away, and at the next hourly rebuild your account profile is rebuilt from your orders, delivered purchases and the shops you follow: everything else you did before the reset — your searches included — no longer counts towards it, and what you do after it counts as before. Your recently viewed products stay, and the shops you follow stay followed and still count.
• Full reset — you start over like a new user. Everything you did before the reset is ignored from then on: the in-visit list, your account profile, your recently viewed products, your search history on that device and the lists we use to avoid showing you the same product twice on that device are deleted straight away, the sizes, colours and times of day learned from before the reset drop out at the next hourly rebuild, and a new profile is built only from what you do after it. The shops you follow stay followed, but those you followed before the reset no longer count. The recommendation preferences you set yourself stay until you change them.
• Clear search history — your searches before the reset stop shaping your recommendations: they are removed from the in-visit list straight away and no longer count towards your account profile from the next hourly rebuild. Your search history is also deleted from that device. Everything else stays.
• While you are signed out there is no account profile to reset: a reset clears the current visit — its in-visit list and, for a full reset, the lists of what we have shown you on that device — and nothing is recorded. Clear search history removes only your searches.
• What a reset does not change. Your activity records are not deleted: they are kept as set out under How long it is kept, for your orders, fraud prevention and analytics as before, and still count — as one among many — towards what is popular or trending on Dona and towards the links between similar products, which are the same for everyone. We also still record which products we showed you, and that record counts towards how often each product has been shown. Products are still ordered — by popularity, freshness, quality, discounts and variety — and what you do after the reset shapes them for you again. How often you visit and order is not reset either.
• If you do not want personalised recommendations at all, write to hello@dona.uz (see Your rights). We record your objection against your account, and personalisation stops for it — while you are signed in, and while you are signed out on any device your account has been used on — except that the recommendation preferences you set yourself still apply until you clear them. If you want it back, write to us again. We cannot tell from an email which device is yours, so a device that has never been used with your account is covered only once you sign in on it, and without an account there is nothing we can record the objection against; until then, a reset clears the current visit. We keep the record of your objection until you withdraw it by writing to us again, or until you delete your account.
• It is separate from Settings → Usage analytics and Settings → Ad measurement: a reset does not switch off either of them, and refusing either of them does not reset your recommendations.

Legal basis: our legitimate interests in showing you products you are likely to want. You can object to that processing at any time by writing to us, as set out above.

14. AI-assisted features — a helper that can make mistakes

Some parts of Dona use artificial intelligence (AI) — models from third-party AI service providers. In our apps and websites it is called Dona AI. It is a helper: it reads, explains, sorts and suggests, and it can be wrong. The most serious decisions are made only by people, and you can object to any decision the AI makes — see What people decide below.

Where Dona uses AI

• Checking a seller application. When you submit your application to sell, an AI reads it together with your shop's basic details — set out under What the application check sees below — and does one of three things: opens your shop for selling, sends one or two parts of the application back to you with a short note on what to fix, or passes it to our team. It never refuses an application. If it opens your shop, people still review your documents, and only their approval opens withdrawals. If it opens your shop before all the required documents are uploaded, you have until the deadline we show you — currently 14 days — to upload them; after that, new listings do not go on sale until you do.
• The Dona AI assistant for new sellers. In Dona Yordam, our support chat, Dona AI answers your questions while you apply and helps you finish your application. To answer, it can see where your application stands — which steps are done, which types of document are still missing, any part sent back to you and why, the result of the application check, your shop's status and your document deadline — but not the content of your documents, your identity details or your bank details. It may ask about your business and suggest ways to start. It may also write to you first — to welcome you, about an unfinished application, a part sent back to you, your document deadline, or first steps once your shop opens — at most once in 24 hours and only during the day, Tashkent time. Before such a message is sent, it is checked automatically and by a second AI; if either check fails, a fixed text is sent instead. If you ask it in the chat to stop, it stops writing to you first for that application; it recognises that request itself, so if it keeps writing, ask for a person in the chat. Two notices about the application itself are still sent: that your shop has opened with a document deadline, and that the deadline has passed.
• Checking a streamer application. When you apply to become a Dona streamer, an AI reads your application — your handle, display name and bio, your region, whether you are an adult (never your date of birth), your experience and preferred categories, whether you added an intro video and how many studio photos (never the video or the photos), whether a guardian's consent is needed, how many times you applied before, and whether an earlier account was closed or is under a sanction on Dona — and does one of three things: approves it, sends one question back to you, or passes it to our team. It never refuses an application. It never receives your phone number, PINFL, passport details or date of birth, and contact details and long numbers in what you typed are masked before it sees them. A person verifies your identity after approval, and money you earn can be withdrawn only once they have. The Dona AI assistant in Dona Yordam also helps people applying to become a streamer, using the same kind of information about their application.
• Dona Maslahatchi, the Advisor for sellers. An AI prepares short advice for each shop from that shop's own data — its sales, orders, products, traffic and reviews: daily while the shop is active, weekly otherwise. It changes nothing in your shop; what to do with the advice is up to you. The advice never contains a buyer's name, phone number or address; it may quote short excerpts from published reviews of the shop's products, without the author's name and with contact details removed.
• Checks of product listings. An AI checks new and changed listings — their text, photos and video — against our listing rules. If it finds a problem, it tells you what to fix, and the listing may be taken off sale until the problem is resolved; you correct it and explain the change in a comment, which the AI also reads. A listing still declined after your corrections goes to a stronger AI model and, if that model agrees, to our team. The AI writing tools you can choose to use on a listing work only from the product details you give them, and nothing they produce goes on sale until you publish it. Listings are product content, so these checks may also be done by other AI services and by people, as described under Product content you share is public.
• Dona Yordam, the support chat. Dona AI answers first in the support chat, for buyers, sellers and streamers. To answer, it can look up your own orders and returns, your coin balance and, for a seller, the shop and its orders — never a phone number, an address, payment details or a buyer's identity, and nothing about payouts. It explains; it does not act on your account. When it cannot help, or whenever you ask for a person, it offers to pass the chat to our support team and does so once you confirm. Card, passport and PINFL numbers typed into the chat are masked before a message is stored or reaches the AI.
• Live-stream chat. An AI reads the chat of live streams. Where the host has switched it on, Dona AI answers viewers' questions about the products on show, using the product details, the recent chat and — to tell which product is on screen — a short clip of the stream. The same AI hides abusive comments and warns their author in a private notice; after repeated warnings, the author cannot write in that stream for the time the warning states.
• Checks of live-stream video. While a live stream is on air — a rehearsal only you can see included — a still frame is taken from its video every 4 seconds and sent to an AI, which checks it for content our rules prohibit: nudity or sexual content, a risk to a child, violence or weapons, drugs or the sale of tobacco or alcohol, scams or moving a sale off Dona, prohibited goods, and other unsafe content. The frame shows whatever the camera sees, including the presenter's face and anyone else in view; no sound and no chat is sent with it. Dona does not store the frames. When the AI sees violence, weapons, drugs, tobacco or alcohol sales or a scam, the person on camera gets a private warning; when it is highly confident, over several frames in a row, that a stream shows nudity or sexual content or puts a child at risk, it ends the stream straight away. Anything else it finds is recorded for our team.
• Rehearsal ratings and live coaching. Before you can go live publicly, your rehearsals — live streams only you can see — are rated. When a rehearsal of at least 5 minutes ends, an AI watches and listens to its recording — its picture and its sound, including what is said, and its title — and rates it from 1 to 5 on four things: how you present, the video quality, the sound quality, and the studio and lighting, with a short note and a tip for each. If the average of the four is 4 or more, you are allowed to go live publicly; if it is lower, you are not yet, and you receive the scores and the tips so that you can rehearse again. Every rating says that Dona AI made it. It can be wrong, and you can ask for a person to review it, in Dona Yordam or as set out under What people decide; a person's decision always takes precedence over the AI's. A rating never takes away permission you already have. The recording is kept for the periods set out under How long we keep your data, whether or not you choose to save it, and the rating uses it during that time. During every live stream, rehearsals included, the same still frames that the check of live-stream video uses are also checked for how the stream is presented — whether someone is presenting, whether the picture is dark, how it is framed and whether products are shown — and Dona also measures how bright the picture is. From this, Dona AI sends short tips that only the person presenting sees: never the viewers, and never in the chat. If for a set time — currently 5 minutes — nobody is presenting, the picture is dark or the frame is empty, Dona AI first warns the person presenting with a countdown and then ends the stream, a rehearsal included; it also ends a stream after the third warning about the same kind of prohibited content within 15 minutes. When a public live stream is ended in either of these ways, you are asked to acknowledge it, or to contest it, before you next go live.
• Partner matching between streamers and shops. So that we can suggest which streamers and shops may work well together, an AI reviews the recording of each public live stream of 3 minutes or more after it ends — its picture and its sound, including what is said — and scores how it was presented; every night an AI also writes a short description of each shop and each streamer from their activity on Dona, and Dona AI prepares advice for streamers. A separate AI checks what it writes before it is shown. Rehearsals, re-streams and test streams are never reviewed for partner matching. A shop sees about a streamer: their name, handle and photo, region, the categories they stream, the languages they speak on air, their live hours, number of streams and audience (in ranges until they have 5 streams), their rating from shops, their studio equipment, the AI description and — from the reviews of their streams — a performance level (top, strong, growing or new) with a score from 0 to 100. A streamer sees about a shop: its name, logo, region, categories, number of products, price level, how quickly and how often it accepts streamers (in ranges), how many streamers work with it, whether it has an offer for streamers, its rating from streamers, a few of its products and the AI description. Both sides see the reasons for a suggestion, from a fixed list — for example the same region, a distance rounded to 10 km, or shared categories or languages — and never money, contact details or an exact location. A shop also sees the review of each stream run for it: its score, level, the scores behind it, strong moments, a summary and notes for the shop; the presenter's mistakes and coaching are shown only to the presenter, with their full review. Shops see this in the seller portal and the Dona app, streamers in the Dona app. If you disagree with how you are described or scored, you can object as set out under What people decide; our team can take your card down.

What the application check sees

• What it reads: your registration form; your legal or business name; your shop's name and description; the note about what you do; any explanation you wrote; the categories of your shop and your products; which types of document you uploaded, how many and in what file format; and the titles of up to 20 of your products.
• What it never receives: your tax number (STIR), registration number, PINFL, passport details, bank or card details, your address, phone number or email address, your full name or the director's name as entered for your documents, your face photo, or the content of any document you upload. If you are a sole trader, the legal or business name it reads can contain your own name.
• Numbers and contact details typed into the free-text fields — card, passport, PINFL or tax numbers, phone numbers, email addresses — are masked before the AI sees them; your shop's name is sent as you wrote it.

What people decide

• The AI never approves or rejects your documents, never opens withdrawals, never refuses a seller or streamer application, never closes, suspends or bans an account, and never takes away anyone's permission to go live or gives them a strike. People make those decisions.
• On its own, the AI can open a shop for selling and send part of an application back; approve a streamer application or send a question back; take a listing off sale until a problem with it is resolved; rate a rehearsal and, from that rating, allow you to go live publicly or not yet; hide a live-chat comment or stop its author writing in that stream for a while; warn or coach the person on camera, or end a live stream, in the cases described above; pause a conversation on our Instagram or Facebook accounts for 24 hours; and describe and score streamers and shops for partner matching. Our team can review each of these.
• You can object and ask for a person. Write to us in Dona Yordam or at hello@dona.uz to object to a decision an AI made about you, have a person review it and be told the main reasons for it. We consider every objection and tell you the result in writing within 10 days. If you disagree with the result, you can complain to the authorised state body for personal data or go to court, as set out under Contact us and how to complain. For a listing, you can also correct it and resubmit it in the app, as described above.

It can make mistakes

AI can misread, leave things out or rely on out-of-date information. What Dona AI tells you — an answer, advice, a suggestion or a reminder — is help, not a promise that it is right, and it is not legal, tax, accounting or other professional advice. An AI answer does not change our published rules or the terms that apply to you. Check anything important against the official source, your application form or our team before you rely on it.

To the extent the law allows, we are not liable for loss that arises solely from your relying on an AI answer or suggestion. This limit never applies to loss we cause intentionally, or to decisions about your application, your account or your listings: those decisions are ours, and you can object to them as set out above. It does not limit any right you have under the mandatory law of the Republic of Uzbekistan. In particular, if you buy on Dona as a consumer, your rights under consumer-protection law — including where information about a product turns out to be inaccurate — stay exactly as they are.

Where it is processed, and by whom

When the features above work with your personal data or your own words — the checks of seller and streamer applications, the assistant, the advice for sellers, the support chat, the live-stream chat, partner matching and the rating of rehearsals — the AI runs with a third-party AI service provider in the European Union, in an EU region or the provider's EU multi-region. For these, the provider acts as our processor: it handles that data on our instructions, to return the AI's answer to us, not for its own purposes. That is unlike Advertising measurement above, where Meta and Google are separate controllers, and refusing advertising measurement does not affect it. Checks of product listings and the writing tools work with product content — text, photos, video — not with who you are, and the provider may process them outside the EU. The check of live-stream video, and the live coaching that uses the same frames, is the exception. The frames are sent to a third-party AI service provider, a service that does not let us choose the country where they are processed, so we cannot tell you which country that is or promise that it is in the EU; the provider handles them under its terms for that service, and Dona does not store them. If this changes, we will update this section. See also International transfers.

Anything that is product content — a listing's text, photos and video, the comments you write when you fix a declined listing, and live streams and their recordings, including for rehearsal ratings and partner matching — may also be processed by other AI services, servers and people in the United States, Europe, the Middle East and Asia, as described under Product content you share is public.

How long it is kept

• The record of each check of a seller application — its result, any note sent to you and a short note for our team — is kept for 12 months, then deleted.
• Advice for sellers is kept for 90 days, then deleted.
• Support chats, including your conversations with Dona AI and the assistant, are deleted 12 months after the chat is closed, unless a case opened from it is still being worked on; files attached to a chat are deleted after 90 days.
• The record of the reminders the assistant sends you is kept for 12 months.
• The record of each check of a streamer application is kept for 12 months, then deleted.
• When the check of live-stream video finds a problem, a record of it — the stream, the kind of problem, how confident the AI was and what was done — is kept, today without a fixed time limit. The frames themselves are never stored.
• The rating of each rehearsal — the four scores, the notes and tips, and the decision on it — is kept for 12 months, then deleted.
• The tips sent to a host during a live stream, and the reason a stream was ended, are kept with the record of the stream, today without a fixed time limit.
• For partner matching, the review of a live stream is kept for 12 months and the notes it was built from for 30 days; earlier versions of a shop's or streamer's description, and advice for streamers, are kept for 90 days. The current description is rebuilt every night and stops being shown when the shop or streamer account is closed.

Legal basis: for the check of a seller application, and for what the assistant reads about where a seller application stands, the Seller's consent to seller verification (see Seller verification (KYC)), never our legitimate interests. For the rest: performance of our contract with you — including handling your application to stream, and deciding whether you may go live publicly, at your request — and our legitimate interests in keeping the marketplace safe, answering people quickly, helping sellers and streamers succeed and helping them find each other. You can object to processing based on legitimate interests, and ask for a person to review a decision, as set out under Your rights.

15. Seller verification (KYC) — what we check, where it is kept, and your consent

To sell on Dona, a Seller's identity and business details must be verified (seller verification, or KYC). This section sets out what we process for it, why, on what legal basis, where it is kept and for how long. It applies to people who apply to sell and to Sellers; it changes nothing for buyers.

What we process

• Your surname, first name and patronymic, PINFL, passport details, phone number, email, residential address, business and company details, bank details, and the documents you upload.
• A photo of your face with your passport, taken to confirm your identity.
• If you choose to verify with MyID: the result of the MyID check and your details held by the state register (see Identity check with MyID below). We never receive the images of your face that MyID takes.

What we use it for

Only to: check and confirm your identity and business details; carry out an automated preliminary review of your application; pay you and authorise withdrawals; prevent fraud; contact you about your application; and meet our statutory tax and accounting obligations.

Legal basis — your consent

• Your consent. We process this data on the basis of the consent you give in the seller application. It is a condition of selling on Dona: if it is not given, or is withdrawn, seller services cannot be used. Your buyer account remains.
• A separate consent for the image of your face. We treat an image of your face — in the photo, or in the MyID check — as biometric data under Article 26 of the Law on Personal Data, so we process it only with your separate consent, given with its own checkbox and never bundled with the first.
• After the relationship ends, we keep the data only because the tax and accounting laws require it (legal obligation), for the period set out below.
• Not legitimate interests. We do not rely on our legitimate interests for any of this data.
• The contract. The offer you accept — the Seller Services Agreement — and your orders, commissions and payouts rest on that contract and on our legal obligations under accounting and tax law.

Where it is kept, and where it travels

• Documents and photos are stored only in Uzbekistan (Tashkent), encrypted.
• The rest of the data is stored on servers in Germany (Frankfurt): Cabinet of Ministers Resolution No. 415 of 29 July 2026 lists Germany among the states that provide an adequate level of personal-data protection.
• The photo, on its way to Tashkent. For the check, the photo is processed automatically by the Dona system: the presence of a face is detected and the photo is encrypted. To do this, the photo passes through servers outside Uzbekistan — a network provider and our servers in Germany (Frankfurt) — and is processed there briefly; it is not stored there. For the photo, no face matching is performed and no biometric template is created. Only an authorised employee reviews the photo.
• The automated review of your application processes text data on servers in the European Union — never your PINFL, tax number (STIR), bank details, address or photos. What it reads is set out under What the application check sees in AI-assisted features above.
• Internal notices to our staff. A notice about your application — your name, phone number, city, shop name and any rejection reason — is sent to our staff through Slack, a service in the USA.
• Notifications to you about the status of your application are delivered through Google's and Apple's services.

The check in the state tax register

To confirm your business details, the STIR (taxpayer identification number) or PINFL you entered is checked against the state tax register of the Republic of Uzbekistan through the e-document operator DIDOX TECH LLC (STIR 310529901). The answer — registration status, taxpayer type, VAT status, whether the director and bank details match — is kept as evidence for your application.

• What is sent, and to whom. Only the STIR or PINFL you entered, and only to DIDOX TECH, an e-document operator in Uzbekistan. For this check it is sent to no one outside Uzbekistan.
• What is kept, and where. DIDOX TECH's full reply comes back to our servers in Germany (Frankfurt), where it is compared with what you entered, and is not stored: only the details listed above are kept, with the rest of your verification data.
• How long. With the rest of your verification data, and never longer — at most for the whole of our relationship and 5 years after it ends (see How long it is kept).
• Legal basis. Your consent to seller verification, as for the rest of this data.

Identity check with MyID

If you choose to confirm your identity with MyID, the state biometric identification system of UZINFOCOM Single Integrator LLC (STIR 204118319) in Uzbekistan, the check works like this.

• Your face. The MyID module of UZINFOCOM in our app captures images of your face and sends them from your phone directly to UZINFOCOM, which compares them with your photo in the state register. Our servers never receive or store these images, and we create no biometric template.
• What is sent, and to whom. To start the check, our service in Uzbekistan (Tashkent) sends UZINFOCOM the PINFL, passport details and date of birth you entered. Before MyID opens, the app also checks your phone for signs of tampering (root or jailbreak, an emulator); only that result is sent to us.
• What UZINFOCOM processes (Annex 2 to its contract with us). When you identify yourself through MyID, UZINFOCOM Single Integrator LLC (STIR 204118319) processes the following personal data:

- data you provide yourself: the series and number of your identity document or your PINFL; your date of birth; your phone number and e-mail address; - data obtained by a request to the information systems of the authorised state bodies: your digital photo portrait; PINFL; the series and number of your identity document; date of birth; the date the document was issued; surname, first name and patronymic in the state language (Latin script); surname and first name in English; sex; the place of issue and the expiry date of the document; life status; country of birth; place of birth; nationality; citizenship; and your permanent and temporary registration address; - data passed to UZINFOCOM automatically during identification: if you use a mobile device, its model, the operating-system version, its unique identifiers and mobile-network data; and the data and status of your actions (date, time, success or failure) and other information about your identification actions.

• What comes back, and where it is kept. UZINFOCOM returns the result and your details held by the state register — surname, first name, patronymic, PINFL, date and place of birth, gender, nationality and citizenship, passport details and registered address. They are stored encrypted only in Uzbekistan (Tashkent). Our servers in Germany (Frankfurt) receive only the result of the check (passed or not, and the date) and whether the name you typed matches your passport — never the name held by the register or any other register data.
• What it decides. If the check passes, your identity is confirmed automatically. Because one person may have only one shop on Dona, it is not confirmed if the check shows that you have, or had, a shop on another Dona account. If it is not confirmed, you can try again or verify with a photo instead, and you can ask for a person to review it.
• How long. With the rest of your verification data, and never longer — at most for the whole of our relationship and 5 years after it ends (see How long it is kept).
• Legal basis. Your consent to seller verification and your separate consent to the processing of an image of your face.

How long it is kept

• For the whole of our relationship with you as a Seller and for 5 years after it ends (tax and accounting requirements); then it is deleted.
• The photo of your face is deleted automatically once a decision has been made on your application.
• A record for which this Policy states a shorter period keeps that period — for example the record of the automated application check (see AI-assisted features).

Withdrawing consent, and your other rights

• You can withdraw either consent at any time in the Dona app or in the seller dashboard, or by writing to us at hello@dona.uz. Withdrawing does not affect processing already carried out. After it, seller services cannot be used and your identity check cannot be completed; your buyer account remains. Data that tax and accounting law requires us to keep is kept for the period above.
• You also have the rights set out under Your rights: to see and correct this data, to have it deleted once we are no longer required to keep it, and to object to the result of the automated review and have a person look at it (see What people decide in AI-assisted features).

16. Sellers' content in our advertising and marketing

Sellers publish content on Dona — product photos, titles, descriptions, videos and live streams — together with a shop's name, logo and page. We may use that content, including recordings of live streams, to show and promote Dona, the Seller and the Seller's goods and to advertise and market them, without limiting the purpose to a particular campaign: on Dona; on our own and other companies' websites, apps and social-media pages; through advertising platforms run by other companies; by email, SMS, push notifications and messengers; and offline — including printed marketing materials, outdoor advertising and events. This includes, for example, recommending products to buyers, cross-selling (showing a product next to related products), reminding buyers about products they viewed or left in their cart, and featuring products together with buyers' reviews of them. For that we may edit it: crop it, cut excerpts from videos and recordings, translate it, add captions and combine it with other material. The contractual permission for this is the content licence in the Seller Services Agreement.

• People who appear in it. Where a Seller's content shows a person — the Seller, its representatives or presenters — their image, voice and name, as they appear in the content, may be used in the same way, including in print, outdoor and other offline use and in messages to buyers. The Seller consents to this and confirms that it has obtained the consent of each such person. If you appear in a Seller's content and did not agree to this, write to us at hello@dona.uz.
• Buyers' reviews and questions. Reviews, questions and answers you post may be shown with the product and the shop, and in our advertising and marketing, under your display name — never with your phone number or email address, and never with your profile photo in print. The permission is set out in the Terms & Conditions.
• Never verification data. We never use seller verification (KYC) data in advertising or marketing — not the documents, the photo of a face with a passport, or the PINFL, passport, bank or contact details.
• How long. For as long as the Seller's agreement with us lasts. Advertising and marketing already published before it ends need not be withdrawn, but no new material is made from that Seller's content afterwards.
• From when. The licence in this form applies to a Seller from the moment they accept the version of the Seller Services Agreement that contains it — we will ask at the next product upload or live stream, and new Sellers accept it when they open their account. Until a Seller accepts it, the version that Seller accepted earlier applies.
• Legal basis: the contract — the content licence in the Seller Services Agreement — and, for the people who appear in the content, the consent the Seller gives in it and has obtained from them.

17. Messages and comments on our Instagram and Facebook accounts — answered by Dona AI

When you write to Dona's Instagram or Facebook account — in a direct message, or in a comment under one of our posts — an automated assistant called Dona AI reads what you wrote and answers. This section sets out what that involves. It covers only what you send to our own Instagram and Facebook accounts; Instagram and Facebook themselves are run by Meta (see below).

What we receive

• the name and username that your Instagram or Facebook account shows, and the identifier Meta gives your account for ours;
• the text of your messages and comments, the link to the post a comment is under, and when each was sent;
• a phone number, only if you choose to share it — for example when you tell us you would like to sell on Dona;
• what we work out ourselves: the language you write in, what the conversation is about (for example buying, selling, becoming a streamer, or help) and a one-line summary.

Card, passport and PINFL numbers in a message are masked before the message is stored or reaches the AI. We do not receive your profile photo.

Why we use it

• To answer you — to reply to your question and point you to the Dona app or to Dona Yordam. Legal basis: contract and legitimate interests, the same as for support and communications.
• If you ask to sell on Dona and share your phone number — so that our team can contact you, and so that the conversation stays with your enquiry and you do not have to repeat yourself. Legal basis: taking steps at your request.
• For the safety of the service — to recognise attempts to misuse the assistant (see below). Legal basis: our legitimate interests.

A helper, not a person

Dona AI says it is Dona AI in its first message, after a break of seven days, and whenever you ask. It answers only from an approved description of Dona, it can be wrong, and it may decline questions about Dona's business. It does not discuss a specific order or account in these messages — for that, use Dona Yordam in the app. A second AI checks each reply before it is sent. Our team can also write to you from the account; Dona AI then carries on, having read what the team wrote.

If someone tries to make the assistant break its rules, keeps asking for business information it does not share, or repeatedly claims to be Dona staff, the conversation is paused for 24 hours: what you write is recorded, but Dona AI does not answer until the time has passed, and our team can lift the pause sooner. When one of our safety checks stops or flags a message, we also keep a security record — the kind of problem and a short excerpt with contact details masked — for 180 days. The pause is an automated decision: you can object to it and ask for a person to review it, as set out under Your rights and AI-assisted features.

Who processes it

• Meta Platforms — Instagram and Facebook carry your messages and comments to us and our replies to you, under Meta's own terms and privacy policy. For what Meta does with them on its own platform it is a separate, independent controller.
• Third-party AI service providers — Dona AI runs on third-party AI models in the European Union. They act as our processors: they handle the text on our instructions, to return the AI's answer to us, not for its own purposes — as set out under AI-assisted features.
• Our team — our staff can read these conversations. When a person has to step in, they are told by an internal notice (through Slack) that carries neither the text of the message nor a phone number.

Where and for how long

We store these messages with the rest of Dona's personal data that the law does not require to be kept in Uzbekistan, in Germany (Frankfurt), which Cabinet of Ministers Resolution No. 415 of 29 July 2026 lists among the states that provide an adequate level of personal-data protection.

• The incoming message and comment notices we receive from Meta are kept for 14 days.
• The conversation — the messages and comments and the details listed above — is kept for 365 days after the last message, then deleted. If it is linked to a seller enquiry that is still open, it is kept while the enquiry is open and for 365 days after it closes.
• A security record, if one was made, is kept for 180 days.

If our team opened a seller enquiry from the conversation, the enquiry record — the phone number, the name your account shows and a short summary — is kept in our sales records, separately from the conversation: the 365-day deletion above does not remove it, and we delete it when you ask us to, the same way.

Your rights

To use any right under Your rights for one of these conversations — to see it, have it corrected or deleted, or object — write to us in Dona Yordam in the app or at hello@dona.uz, and tell us which Instagram or Facebook account you wrote from. We may need to verify your identity.

18. Product content you share is public — who processes it, where, and how we use it

By product content we mean what you share with us to sell, show or describe goods on Dona: product photos and videos; titles, descriptions, attributes, prices and variants; your shop's name, logo and page; your live streams and their recordings — including the image and voice of the people who appear in them; questions and answers about products; and the explanations and comments you write about a listing, for example when you fix a declined listing.

• It is public. Dona is a public marketplace, and product content is shared in order to be shown to anyone — on Dona and outside it. Once it is published, anyone can see it, save it, copy it and share it further, including outside Dona, and we cannot control or undo what other people do with it. Share product content only if you agree to it being public. Do not put identity documents, other people's personal data (such as phone numbers, addresses, or the face or voice of a person who has not agreed), or anything confidential in product content.
• Who processes it. To check listings and live streams against our rules, to describe, translate, classify and moderate them, to keep the marketplace safe and to improve our service — now and as our service develops — we process product content with artificial-intelligence services, servers and other tools operated by third parties, and we may have it reviewed by people, including independent contractors who are not our employees and do not work under our direct management. They act on our instructions and receive only what the task needs.
• Where. These services and people may be located in the United States, Europe, the Middle East and Asia — mainly India, Bangladesh, Nepal, Pakistan, Uzbekistan, Kyrgyzstan, Tajikistan, Kazakhstan and similar countries. Product content, and the personal data it contains, may therefore be transferred to and processed in those countries, including countries whose laws do not provide the same level of protection as the laws of Uzbekistan.
• Security. We remain responsible for protecting personal data as the law requires; we take reasonable measures and choose providers with care. But third parties run their own systems and no system is completely secure, so we cannot guarantee that content processed on systems outside our control will never be accessed by others — and nothing can protect content that you have made public from being copied.
• Never your verification data. Seller verification (KYC) data — identity documents, the photo of a face with a passport, PINFL, passport, bank and contact details — is never processed in this way; it is handled only as described under Seller verification (KYC).
• Advertising and marketing. We may use product content to promote Dona, your shop and your goods, as described under Sellers' content in our advertising and marketing.
• Your agreement. Before your next product upload, your first one, or your next live stream, we will ask you once to confirm that you agree to this Privacy Policy as updated on 12 October 2026, and to the Terms & Conditions and the Seller Services Agreement (a streamer: the Streamer Agreement) in their current versions. If you have already accepted these versions — for example when you opened your account after 12 October 2026 — you are not asked again. By confirming — and by uploading or publishing product content or going live afterwards — you consent to the processing, transfer and use of your product content described in this section, including in the countries named above.
• If you do not agree. Product content can only be accepted on these terms. If you do not agree, or later withdraw your consent (by writing to us — see Your rights), you will not be able to upload products or go live on Dona, and your shop will be closed. Content already published, or already used in advertising, may remain public. The shop closure applies to sellers. A streamer who does not agree will not be able to go live or rehearse, and may leave the streamer programme at any time ("Leave the programme" in the Dona app); the earned balance is not lost — it is paid as set out in Annex 1 to the Streamer Agreement (clause 4.4(a)).
• Legal basis: your consent as described above; performance of the agreement that applies to you (the Seller Services Agreement or the Streamer Agreement); and our legitimate interests in a safe, trustworthy marketplace.

19. Phone calls to Dona — recorded, and answered with Dona AI

When you call Dona's call center, or we call you, the call may be recorded and written down word for word, and an automated assistant called Dona AI may take part. You will hear a short notice about this first. When you call us, a recorded message plays it; if you have already heard it on an earlier call from the same number, it is not repeated. When we call you, our agent says it at the start of the call, and the recording and Dona AI begin only after the agent has confirmed that they said it: nothing before that is recorded. If you carry on with the call after the notice, we take it that you have heard it. This section explains what that means.

What we record and receive

• the audio of the whole call and a word-for-word transcript;
• the phone number you call from or we call, and the date, time and length of the call;
• what we work out ourselves: the language, what the call is about, a summary, the caller's mood during the call, a rating of how the agent handled the call, and the support request (ticket) we create from it;
• what our staff add to the call record: notes on lines of the transcript, marks that a line was heard wrongly, and written messages that a supervisor sends to the agent during the call.

We do not make a voiceprint or a voice ID, and we do not use the recording to identify you by your voice.

How Dona AI takes part

• Dona AI may answer your call, at any hour, and talk with you. It is an artificial intelligence and says so whenever you ask. A person from our call center joins in working hours, or calls you back, when you ask or when Dona AI cannot help.
• If you agree during the call, Dona AI remembers you. It can keep your name, your language, the voice you chose and a short note about what your last call was about (used for up to 180 days), and uses them when you call again from the same number. They stay until you say, for example, "forget me", or your Dona account is deleted. Without your agreement we keep only the fact that this number heard the notice, and the language of the call, so the notice is not repeated.
• It helps our agents as the call goes on. It turns the speech into text, shows the agent suggestions and information, rates how the conversation is going, and corrects mistakes in the transcript. To spell names and words correctly, both the transcription and the correction may also receive some details about you and your account: your name, your region and your role (buyer, seller or streamer), the names of your shops, the titles and status of your recent orders, the agent's name, and the text of your earlier calls.
• We use your data when AI processes your calls. When we process calls with AI, we use your data — your account, your orders and your earlier contacts with us — and the whole call is monitored and used for this purpose, including the audio, the text and the transcription.
• After the call it writes a summary, and it creates and follows up support requests (tickets). For example, so that an agent can call you back, and so that you do not have to repeat yourself.

Dona AI can make mistakes. You can ask for a person to review anything it decided or wrote, as set out under Your rights and AI-assisted features.

Why we do this

• To help you and to create and follow up your support request. Legal basis: contract (steps at your request) and our legitimate interests.
• Service quality, training our staff, and resolving disputes. For example, checking what was said when an order, delivery or refund is disputed. Legal basis: our legitimate interests.

Who can listen

Supervisors of the call center may listen to a call live, speak quietly to the agent during it, send the agent a written message, or join the call. A written message is kept with the call record. Our staff listen to recordings and read transcripts only as their work requires, and opening a call or a recording is logged.

Where it is kept, and who processes it

• We store recordings and transcripts only in Uzbekistan. They are kept on Dona's own call server in Tashkent, and recordings are stored encrypted.
• Processed outside Uzbekistan by third-party AI services, on our instructions. While a call is going on, its voice is sent for live processing, to turn the speech into text and, when Dona AI answers, to hold the conversation. The text of the call is sent to suggest answers to the agent, to rate the conversation and to correct the transcript, and after the call to write the summary. This is done by third-party AI service providers outside Uzbekistan. When Dona AI answers your call there are two providers, and each can take over from the other, so the call keeps working if one is down. The voice is processed only while the call is live, and we do not store it outside Uzbekistan. They never use the data to train their models, but may keep it for a short time, up to 30 days, only to check for misuse.
• So the data leaves Uzbekistan while it is processed. See International transfers.
• A support request created from a call, with its summary, is kept with the other support data described under How long we keep your data.

How long we keep it

We do not delete call recordings, transcripts, summaries or call details automatically after a set time. Our staff can play a recording for 180 days after the call; after that it is no longer played, but it stays in storage. They are deleted when the Dona account tied to your phone number is deleted: the transcripts, summaries and notes of calls from that number, up to that moment, are deleted; the recordings are blocked at once and then deleted from storage; and the number is removed from the call details (the call entry itself stays, without the number, for our statistics). This is automatic for Uzbek phone numbers (+998 and nine digits); for any other number, write to us as set out under Your choices and rights. If you say, for example, "forget me" to Dona AI during a call, it deletes what it remembered about you, the facts noted from your calls and the mood marks on your calls, but not the recordings and transcripts. If a call is part of a dispute, complaint or legal claim, we keep it for as long as that needs. A call summary that becomes part of your order or support case is kept as long as that order or case record.

Your choices and rights

• You do not have to be recorded. If you prefer not, end the call and write to us instead, in Dona Yordam in the app or at support@dona.uz.
• You can say, for example, "forget me" to Dona AI during a call, or delete your Dona account; both are explained under How long we keep it.
• You can ask for access to the recording and transcript of your calls, to correct the transcript, or for their deletion. Write to hello@dona.uz with the subject "Privacy request", give the phone number you called from and the approximate date and time; we may need to verify that the number is yours. We will answer you promptly. We may keep some data longer if a law or a dispute needs it, as set out under How long we keep your data.
• The other rights under Your rights apply, including a human review of an automated decision and the right to complain.

20. Cookies and similar technologies

Our website and apps use cookies and similar technologies for functionality, security, preferences and analytics. For details of what we use and how to manage your choices, please see the Cookie Policy.

21. Changes to this Policy

We may update this Privacy Policy from time to time. The current version takes effect on the date shown above. If we make material changes, we will notify you by appropriate means — for example, an in-app notice or a message to your registered contact — before the changes take effect where required. Your continued use of the Platform after an update means you have read the updated Policy. We encourage you to review it periodically. Where a change needs your consent, we will ask for it in the app (for product content: once, at your next upload or live stream).

22. Contact us and how to complain

If you have questions, requests or complaints about privacy, contact us first so we can help:

• Email: hello@dona.uz (please use a clear subject line, e.g. "Privacy request")
• Post: ALIFCO MCHJ, Labzak 2A, Tashkent, Republic of Uzbekistan

If you are in Uzbekistan and are not satisfied with our response, you may also contact the competent Uzbek authority responsible for personal-data protection, or the relevant consumer-protection body or the courts, in accordance with the laws of the Republic of Uzbekistan. Mandatory rights under Uzbek law are not affected by this Policy. See also our Terms & Conditions.