Privacy Policy

Who processes the data

Legal owner and provider: “MAVAR DASTURIY YECHIMLAR” MCHJ. Tashkent, Uzbekistan; phone: +998 97 013 00 00; general enquiries: hello@mavar.uz. Director: Azizjonov Dilshod. MAVAR is the master brand; Nira and ShopOS are MAVAR products. For data questions: Telegram @shopos_vesper_bot or hello@mavar.uz.

We operate in accordance with the Law of the Republic of Uzbekistan “On Personal Data” («О персональных данных», ЗРУ-547). Separate MAVAR services around the shop (for example, Nira) operate under their own terms — https://mavar.uz/en/terms/ — and are not part of this policy.

Who is whose operator: the shop and the platform

Each shop has its own owner. Customer data — name, phone number, address, order contents — is collected and used by the shop: the shop is the owner of this database.

ShopOS is the platform on which the shop operates. We process customer data on the instructions of the shop and to the extent necessary for the order to reach the seller. We do not use one shop’s database in the interests of another and do not send customers anything in our own name.

What we receive from the shop owner

When a shop is created: an address of the form name.shopos.uz and the shop name, email address, phone number, the owner’s Telegram ID (linking Telegram is mandatory — the login and password are sent there), login and password for the panel (the password is stored only as an irreversible hash). If you came via a link with tags, they arrive together with the application (see “What the website itself collects”).

During operation: shop settings, products and photos, the Telegram chat ID for order notifications, and payment system details if you have entered them. Payme and Click secret keys are stored by us, but they are not shown back in the panel and are not included in the data export.

Why: so that the shop works, so that you can log in to the panel, receive orders and regain access, and so that we can contact you about the shop and understand where registrations come from.

What reaches us from the shop’s customers

When an order is placed: name, phone number, email address (if the customer entered it), delivery address and city, comment, order contents and amount, and the selected delivery and payment methods. If the order is placed via Telegram, the Telegram user ID is stored — the shop uses it to reply to the customer.

Why: so that the order reaches the seller and is fulfilled. This data is visible to the shop owner in their panel; we do not use it for advertising and do not pass it on to anyone.

We do not accept card payments and do not see card data: when paying via Payme or Click, the customer pays in the payment system’s interface, and the money goes directly to the seller.

What the website itself collects

The shopos.uz pages use two visitor counters: Yandex Metrica (counter 112287633) and Google Analytics 4 (G-WTW69K6XS3). They set their own cookies in the browser and collect visit data: which pages were opened and how long they were viewed, where the visitor came from (referrer and UTM tags), device and browser type, approximate location based on the IP address, clicks on the page and on links, and events — for example, submitting the registration form (the “register_submit” goal). Why: visitor statistics and understanding where registrations come from.

Yandex Metrica Session Replay (Webvisor), which records actions on the page, is disabled on shopos.uz.

Counter data is processed by Yandex and Google on their own servers, which may be located outside Uzbekistan, and is kept under their own rules: https://yandex.com/legal/confidential/ and https://policies.google.com/privacy.

You can opt out in your browser: block cookies and trackers, or install the official add-ons that disable Google Analytics (https://tools.google.com/dlpage/gaoptout) and Yandex Metrica (https://yandex.com/support/metrica/general/opt-out.html). The website keeps working as usual.

First-visit tags — utm_source, utm_medium, utm_campaign, utm_term, utm_content and ref, plus the referrer, landing page and time — are stored by the page in the browser (localStorage and the shopos_acq cookie) for up to 30 days and sent together with the registration application. On the shop directory page, the selected language is also stored in localStorage.

The shop panel uses two service cookies: admin_session (login) and csrf_token (protection against request forgery). The panel cannot work without them; they contain no analytics or tracking.

The web server keeps an ordinary technical request log: IP address, time, page address, browser type. It is needed for the server to operate and for protection against attacks; we do not use it to profile visitors.

Where the data is stored

On a server in Tashkent, Uzbekistan: IP 46.8.195.68, AIRNET LLC network. The shop database and uploaded product photos are also kept there. The shop database and files are not taken outside Uzbekistan.

Backup copies of the database, shop files and configuration are made once a day, kept on the same server for two weeks and protected by access permissions.

Some communication inevitably goes through third-party services: order notifications, as well as the login and password after registration, are delivered by Telegram. It receives exactly what is needed to deliver the message and operates under its own rules. Website visit statistics are collected by Yandex and Google — see above.

Whom we share data with

We do not sell data to anyone or share it for advertising. Order data is received by the shop owner — that is what the order is placed for.

Technically, data passes through the services the platform and the website run on: Telegram (notifications, login and password), Yandex (Yandex Metrica) and Google (Google Analytics) — website visit data, and the Payme and Click payment systems if the shop has connected them. Where required by law, data may be provided to the authorised bodies of the Republic of Uzbekistan.

How long we keep data

For as long as the shop exists. The shop owner can delete a product, an order or a customer in the panel at any time.

After a shop is closed, the data is deleted, and it leaves the backup copies within two weeks, as the copies replace one another.

First-visit tags live in the browser for up to 30 days. Counter data is kept by Yandex and Google — the periods are set by their rules (links above).

Your rights

To find out what data about you is held, to obtain a copy of it, to correct anything inaccurate, to delete it, and to withdraw consent to processing.

If you are a customer of a shop, contact the shop: the database is the shop’s, and it is the shop that deletes the data. We will help if the shop is unavailable.

If you are a shop owner, write to Telegram @shopos_vesper_bot. You can obtain a copy of all shop data yourself and instantly: the “Download all data (ZIP)” button in the panel settings.

What we do not do

We do not collect special categories of data: health, religious beliefs, political views, biometrics. We do not give shops such fields.

We do not create shops for a children’s audience and do not target users under 18 years of age.

We do not use customer data to train models and do not transfer it to AI services. The AI description features work with the product texts written by the seller, not with customer data.

Changes to the policy

The date of the last change is shown at the top of the page. We notify shop owners of material changes at least 30 days in advance — by a message in Telegram and in the shop panel.