Privacy Policy — Ufarmer

Effective date: 29 July 2026

Last updated: 29 July 2026

Data controller: Xavfsiz Tarmoq LLC ("Ufarmer", "we", "us")

Contact: support@ufarmer.uz

This Privacy Policy explains what personal data the Ufarmer mobile application ("the App") collects, why we collect it, who we share it with, how long we keep it, and how you can access or delete it — including how to delete your account and all associated data.

By creating an account or using the App you agree to this Policy.

———

1. Data We Collect

1.1 Data you provide

• Account data — phone number, PIN code, full name, selected role (farmer, agronomist, supplier, buyer). Used for registration, authentication and access control.

• Profile data — photo, region/district, farm name, land area, crops grown. Used to personalise services and recommendations.

• Identity verification — passport / ID data and biometric facial match processed by MyID, the Uzbekistan national digital identity service. Required by law for financial services such as instalments, insurance and lab orders.

• Financial data — bank card token, transaction and order history, balance, instalment (BNPL) applications. Used to process payments, orders and instalment plans.

• Agronomic data — fields, field boundaries and coordinates, crop calendars, harvest records, lab sample requests. Used for the core farming features of the App.

• Content you upload — photos and videos of plants and fields, documents, voice messages, chat messages. Used for disease scanning, marketplace listings, support and chat.

• Support communications — messages you send to our support team or to other users in chat. Used to provide support and to enable the marketplace.

1.2 Data collected automatically

• Device data — device model, operating system and version, app version, language, unique device identifier. Used for compatibility, security and crash diagnostics.

• Usage data — screens opened, features used, session duration, timestamps, referral source of the install. Used for product analytics and improvement.

• Diagnostic data — crash reports, error logs, and a trail of the actions preceding a crash. Used to fix defects and improve stability.

• Network data — IP address and the approximate region derived from it. Used for security, fraud prevention and abuse detection.

• Push token — Firebase Cloud Messaging registration token. Used to deliver the notifications you have enabled.

1.3 Data collected with your explicit permission

These are requested only when you use the related feature, and can be revoked at any time in your device settings.

• Precise location — to show nearby agro-services, suppliers, logistics and markets on the map, and to attach coordinates to a field you create. We do not track your location in the background for advertising.

• Camera and microphone — to photograph plants for disease detection, record videos of your fields, scan QR codes, and record voice messages in chat.

• Photo library — to select existing images for scanning, listings or chat, and to save images you choose to save.

• Notifications — to send order, chat and agronomic reminders.

• Biometrics (Face ID / Touch ID / fingerprint) — used only locally on your device to unlock the App. Biometric templates never leave your device and are never transmitted to or stored on our servers.

1.4 What we do NOT do

• We do not sell your personal data.

• We do not use your data for third-party advertising or ad targeting.

• We do not track you across other companies' apps and websites.

• We do not knowingly collect data from children (see section 8).

———

2. Legal Basis for Processing

We process personal data on the following grounds.

• Performance of a contract — to provide the account, orders, payments and services you request.

• Legal obligation — identity verification, tax, accounting and financial reporting requirements under the legislation of the Republic of Uzbekistan, including the Law "On Personal Data" (No. ZRU-547).

• Consent — location, camera, microphone, photo library, notifications and marketing messages. You may withdraw consent at any time.

• Legitimate interests — security, fraud prevention, and improving the App, balanced against your rights.

———

3. How We Share Data

We share personal data only as described below, and only to the minimum extent necessary.

• Google (Firebase Cloud Messaging) — push token and device identifier, to deliver push notifications.

• Yandex (AppMetrica) — device and usage data, crash reports and a pseudonymous identifier, for analytics and crash diagnostics.

• MyID — identity and biometric verification data, for the identity verification required by law.

• Payment providers and partner banks — transaction data, card token and order amount, to process payments and instalments.

• Insurance and laboratory partners — the data strictly needed to fulfil the order you placed.

• Logistics and marketplace counterparties — name, contact phone, delivery address and order contents, to complete a transaction you initiated.

• Cloud hosting providers — stored application data, to host the service.

• Government authorities — data required by a lawful request, to comply with the law.

All processors act under contract, may use the data only for the purposes we specify, and are bound by confidentiality and security obligations.

Other users see only what your role and your actions expose — for example a public marketplace listing, your display name and photo in chat, or the contact details required to complete an order with you.

———

4. Account Deletion and Data Deletion

You can request deletion of your account and all associated personal data at any time. Deletion is free and does not require you to contact us by any other channel. [BOLD]

4.1 How to delete your account in the App

1. Open the App and sign in.

2. Go to Profile → Settings → Delete Account.

3. Read the confirmation screen, which lists what will be deleted and states that your request is reviewed within 5 business days.

4. Tap Delete.

Your deletion request is submitted at that point and you are signed out immediately. No further action is required from you, and you do not need to install anything, create any other account, or contact us by any other channel.

4.2 Alternative method

If you cannot access the App, send a deletion request from the phone number or email associated with your account to support@ufarmer.uz with the subject line "Account deletion". This route is optional — it exists only for users who have lost access to the App.

4.3 Review of your request

Because your identity is already established by the fact that you were signed in when you made the request, we do not ask you to prove it again.

We review every deletion request within 5 business days. If no further information is needed, an administrator deletes the account and we notify you at the phone number registered to it. We contact you only if the account carries an unresolved obligation, such as an active instalment plan or an unpaid order, which must be closed before deletion.

We never require you to explain why you want your account deleted, and we do not try to persuade you to keep it.

4.4 What is deleted

Upon confirmation we permanently delete or irreversibly anonymise:

• your profile, phone number, name, photo and role assignments;

• your fields, crop calendars, scans, uploaded photos, videos and documents;

• your chat messages and support history;

• your marketplace listings, cart and saved addresses;

• your device identifiers, push tokens and analytics identifiers.

4.5 What is retained, and for how long

The following is retained only where the law requires it, and is not used for any other purpose.

• Financial and transaction records — retained for the period required by the accounting and tax legislation of the Republic of Uzbekistan, currently five years from the date of the transaction. Where possible these records are detached from your identity.

• Records required for an ongoing dispute, insurance claim, instalment obligation or legal proceeding — retained until that matter is resolved.

An account with an unsettled financial obligation, such as an active instalment plan or an unpaid order, cannot be deleted until that obligation is closed. We will tell you this at the moment you make the request.

4.6 Timing

Once an administrator approves the request, your access ends immediately and all data listed in 4.4 is removed from our production systems within 30 days and from encrypted backups within 90 days.

———

5. Your Other Rights

You may, at any time:

• access the personal data we hold about you and request a copy;

• correct inaccurate or incomplete data — most fields are editable directly in Profile → Edit Profile;

• withdraw consent for location, camera, microphone, photos or notifications in your device settings, without losing access to the rest of the App;

• object to or restrict processing based on legitimate interests;

• opt out of marketing messages in Settings → Notifications;

• complain to the State Personalisation Agency of the Republic of Uzbekistan or to your local data protection authority.

To exercise these rights, write to support@ufarmer.uz. We respond within 30 days.

———

6. Data Retention

We keep personal data only for as long as your account is active, or as long as needed for the purpose it was collected for.

• Account and profile data — until account deletion.

• Agronomic data such as fields, calendars and scans — until account deletion.

• Chat messages — until account deletion.

• Analytics and diagnostic data — up to 24 months, in pseudonymous form.

• Financial and transaction records — 5 years, as required by law.

• Backups — a rolling 90-day window.

———

7. Security

We protect personal data using TLS encryption in transit, encryption of sensitive data at rest, PIN and optional biometric protection of the App, role-based access control, and monitored access logging. Payment card data is handled by certified payment providers; we store only a payment token, never the full card number or CVV.

No method of transmission or storage is completely secure. If a breach affecting your personal data occurs, we will notify you and the competent authority as required by law.

———

8. Children

The App is intended for users aged 18 and over, since it provides financial and commercial services. We do not knowingly collect personal data from children under 13. If we learn that we have collected data from a child under 13, we delete it promptly. If you believe a child has provided us with personal data, contact support@ufarmer.uz.

———

9. International Transfers

Personal data is primarily stored on servers located in the Republic of Uzbekistan, in accordance with national data localisation requirements. Some processors, namely Google and Yandex, may process pseudonymous technical data outside Uzbekistan under contractual safeguards.

———

10. Changes to This Policy

We may update this Policy. When we make material changes we will update the "Last updated" date and notify you in the App or by push notification before the change takes effect. Continued use of the App after the effective date constitutes acceptance of the updated Policy.

———

11. Contact Us

Xavfsiz Tarmoq LLC

Email: support@ufarmer.uz

In-app: Profile → Support chat

If you have questions about this Policy or about how your data is handled, we will respond within 30 days.