Privacy Policy

SAT Tashkent Staff · Last updated 14 September 2026

This policy covers the SAT Tashkent Staff mobile app only. The student app is a separate product and has its own policy.

Every statement here was written from what the app's source code actually does and checked against it line by line.

1Who this is for

SAT Tashkent Staff is an internal work tool. It is used by employees and contractors of SATASHKENT (“SAT Tashkent”, “we”) — mentors, branch managers, moderators, support, finance staff and administrators — to do their job: to see their groups and schedule, run lessons, answer students, review submissions, and handle payments.

It is not a consumer app. Accounts cannot be created in the app. An account exists only because an administrator created it in the SAT Tashkent admin system. There is no sign-up, no self-service registration and no public content.

Students do not use this app. The student app is a separate product with its own privacy policy.

2Who controls the data

The data controller is SATASHKENT (“SAT Tashkent”), Tashkent, Republic of Uzbekistan — the same controller as for the student app.

Questions, requests and complaints about personal data go to the data protection contact at privacy@satashkent.uz. Use that address rather than a support channel, so the request can be verified and tracked properly.

3What the app handles

The app is a window onto SAT Tashkent's own systems. Almost nothing originates on the phone: the app requests data from our servers, shows it, and sends back the changes you make.

3.1 About you, the staff member

DataWhyWhere it goesUsername and password at sign-inTo authenticate youSent once to our server over HTTPS. The password is never stored on the device.Session token and session cookiesTo keep you signed inToken in the iOS Keychain / Android Keystore; cookies in the app's private storageYour name, role, permission set, branch, and the contact details held on your staff profileTo show who is signed in and what you may doFrom our server; held in memory while the app runsThe username of the last successful sign-inTo pre-fill the fieldOn the device onlyYour branch selection, theme, language and notification preferencesTo remember how you like to workOn the device onlyApp version and build numberTo show it on the settings screen and to make a support call usefulOn the device; included when you report a problem

3.2 About other people, shown to you because of your job

When your permissions allow it, the app displays personal data belonging to students, leads, parents-of-record and other staff: names, contact details, group membership, attendance of lessons, assessment results, notes written by staff, payment and payout records.

You see only what your role grants. The permission map comes from the server on every sign-in; the app does not decide it.

This data is processed on our behalf, not collected by the app for its own purposes. It is shown to you to do your work and is governed by the same policy that governs the admin panel and the student app.

3.3 What the app stores on the phone

StoreWhatCleared wheniOS Keychain / Android KeystoreThe session tokenSign-out, uninstallApp-private cookie jarSession cookiesSign-out, uninstallApp preferencesBranch, theme, language, notification settings, last username, “there was a session here” flagUninstall (settings), sign-out (session flag)Read cacheRecently opened lists, so a list opens with rows instead of a spinner. Each entry expires (12 hours by default) and is capped in size. A screen showing cached rows says so.Sign-out, expiry, uninstall

Money is never cached as fact. Balances, payment statuses and payout requests are read from the network or shown explicitly as a last-known figure — never presented as current when they are not.

3.4 What the app does not do

The app requests no device permissions beyond internet access. It does not access, and has no code to access:

Never touched

LocationCameraPhoto libraryMicrophoneContactsCalendarHealth dataAdvertising IDDevice fingerprint

There is no analytics SDK, no crash-reporting SDK, no advertising SDK and no third-party tracker of any kind in this app. Its only network destinations are SAT Tashkent's own servers on *.satashkent.uz.

Detailed request logging exists only in debug builds used by developers. Release builds do not write request or response contents to the device log.

Nobody. No personal data handled by this app is sold, rented or disclosed to advertisers, data brokers or analytics providers.

Two things leave the app by your own action:

Phone calls. Tapping a phone number hands it to your phone's dialer. The call itself is placed by your device and your mobile operator, outside the app.
Single sign-on. If you sign in with SATashkent ID, an in-app web view opens our own SSO service at auth.satashkent.uz. Your password goes to that service, not to this app.

We disclose data to state bodies only where the law of the Republic of Uzbekistan requires it, and to the extent it requires.

5Where it is stored, and for how long

Personal data of citizens of the Republic of Uzbekistan is processed and stored on servers located in Uzbekistan, as required by the Law “On Personal Data” (ZRU-547, 2 July 2019).

On the phone: as set out in §3.3. Signing out deletes the token, the cookies and every cached list. Uninstalling the app removes everything the app stored.
On our servers, on the same schedule the student policy sets out: account data while the account is active; financial records up to 5 years after the transaction, for accounting and tax law; server and security logs up to 12 months; support correspondence up to 24 months after the issue is resolved; backups overwritten on a regular cycle, typically within 30 days. Account data is stored on servers in the Republic of Uzbekistan and/or in data centres operated by our infrastructure providers. The app does not decide any of this.

6How it is protected

All traffic uses HTTPS. The app makes no cleartext connection.
The session token is held in the platform's hardware-backed secure store (iOS Keychain, Android Keystore with encrypted preferences), not in plain preferences.
A session is restored at launch by asking the server, never by trusting a stored cookie — an account disabled overnight cannot reach the app the next morning.
The app enforces the permission map the server sends, and hides rather than disables what your role may not do.
Signing out clears the token, the cookies, the cached lists and the live connections in one step.

Your part: this app shows real students' personal data. Keep a screen lock on the device, do not sign in on a device other people use, and sign out when you hand the phone to someone else.

7Your rights

Under the Law of the Republic of Uzbekistan “On Personal Data” you may ask us to confirm what personal data we hold about you, to correct it, to block it, or to delete it, and to tell you who it has been disclosed to. Write to privacy@satashkent.uz.

Deleting a staff account is done by SAT Tashkent, not in the app: an account belongs to an employment relationship, and removing it is an HR action. Ask your administrator or write to the address above. You can always remove everything this app holds on your own device by signing out and uninstalling it.

If you are a student and want to exercise a right over your own data, do not write about it here — this policy covers the staff app. Use the contact in the student app's policy.

8Children

This app is for employees and contractors only. It is not directed at children and is not made available to them. Staff using it may see data belonging to students who are minors; that data is processed under the agreement between SAT Tashkent and the student's parent or guardian, not under this policy.

9Changes

If this policy changes in a way that affects what the app does with data, the new version is published here and the date at the top changes. Material changes are announced to staff through the usual internal channel.

10Contact

SATASHKENT

Tashkent, Republic of Uzbekistan

privacy@satashkent.uz · personal data

support@satashkent.uz · everything else

+998 91 787 65 75