Privacy Policy

1. Who processes the data

The data controller is the SmartPay service available at smart-pay.uz. You can reach us at support@smart-pay.uz or by phone at +998 50 052 00 05. Security matters: security@smart-pay.uz.

2. What the app collects

• Merchant account data — the email address and password you enter when signing in, plus the confirmation code sent to your email or Telegram. The password is transmitted only at sign-in and is never stored on the device.
• Access key (API key) — issued after a successful sign-in and kept on the device in encrypted form using Android facilities, so you do not have to enter the password on every launch.
• Operation data — amounts, currency, statuses, order numbers, payment descriptions, receipts attached by customers and information about the cashiers of your outlet. This data belongs to your account and is downloaded to be shown on screen; a copy is cached on the device so the app works offline.
• Technical device information — device model, app version, interface language, an internal installation identifier and the notification token. They are needed to deliver notifications to your phone and to inform you about updates.
• Biometrics — if you enable fingerprint sign-in, the check is performed entirely by Android. The app only receives a confirmed-or-not result and has no access to the fingerprint itself.

3. What the app does not do

The app does not request access to location, camera, microphone, contacts, calls, SMS or files on the device. It does not collect browsing history, does not show ads and does not share data with advertising networks. Customers' bank card details never reach the app.

4. Why the data is needed

• to show incoming payments and let you approve or decline them;
• to notify you about a new operation;
• to keep the operations history and statistics of your outlet;
• to protect account sign-in and investigate unauthorised access attempts;
• to inform you about a new version of the app.

The data is not used for profiling or automated decision-making about you, and is not sold.

5. Who the data is shared with

Data is processed on the service servers and is not shared with third parties, except where it is required to operate the service or by law:

• telecom operators and mail providers — to deliver confirmation codes and notifications;
• Telegram — if you chose to receive codes and alerts through the service bot;
• Google (Firebase Cloud Messaging) — in builds with push notifications enabled, only the device token and the notification payload are transmitted;
• authorised state bodies — upon a lawful request.

6. How long the data is kept

Operation records are kept while your merchant account exists and afterwards for the period required by law for settlement documents. The local copy on the device is removed when you sign out, clear the app data or uninstall the app. The notification token is deleted on sign-out and on uninstall.

7. How the data is protected

All exchange with the server goes over HTTPS. Signing in is confirmed with a code from email or Telegram, and the access key on the device is stored in encrypted Android storage. Access to the dashboard is password protected and can additionally be locked with a fingerprint.

8. Your rights

You may request a copy of your data, its correction or the deletion of your account, withdraw your consent and turn off notifications in the app settings. Write to support@smart-pay.uz — we reply within 30 days. Deleting the account ends access to the service; records of completed payments are retained to the extent required by law.

9. Cookies on the website

The smart-pay.uz website uses cookies to keep you signed in to the dashboard and to remember the chosen language and theme, as well as traffic counters if the service owner has enabled them. The app does not use cookies.

10. Changes to this policy

We may update this policy. The current version is always available at smart-pay.uz/privacy and the date of the last change is shown at the top of the page. We will announce material changes in the app or by email.