Privacy Policy

Odiliy Inc, operating the Bronjoy platform (“Bronjoy”, “we”, “us” or “our”), respects your privacy. This Privacy Policy explains what personal data we collect when you use our website, mobile applications, Telegram Mini App and related services (together, the “Service”), why we collect it, how we use it, with whom we share it and the rights you have over it.

This Privacy Policy is part of, and should be read together with, our Terms of Service.

The controller of your personal data is:

• Odiliy Inc (operating as Bronjoy)
• Address: Tashkent, Republic of Uzbekistan
• Privacy contact: [email protected]

We process personal data in accordance with the Law of the Republic of Uzbekistan No. ZRU-547 of 2 July 2019 “On Personal Data” (with subsequent amendments) and its implementing regulations. Where applicable, we additionally observe other data-protection rules — for example, the General Data Protection Regulation (GDPR) for users located in the European Economic Area.

4.1 Data you provide directly

• Identity & contact: name, email address, phone number, profile photo (optional).
• Booking data: services chosen, dates and times, special requests, notes for the Provider.
• Payment data: cardholder name, card brand, last four digits and expiry month/year. Full card numbers and security codes are entered directly into Stripe and are never seen or stored by Bronjoy.
• Communications: messages you send to Providers or to our support team, reviews, ratings, photos.
• Preferences: language, theme, notification settings, favourites, marketing consents.

4.2 Data collected automatically

• Device & browser: type, model, operating system, browser, screen size, locale.
• Network: IP address, approximate location derived from IP, time-zone.
• Usage: pages visited, features used, search queries, click and scroll events.
• Diagnostics: crash reports, performance metrics, application logs.
• Cookies and similar technologies (see section 9).

4.3 Data we receive from third parties

• Telegram (when you sign in or use our Telegram Mini App): Telegram user ID, first and last name, username, photo, language code as provided by Telegram in initData.
• Stripe: transaction status, payout information, dispute notifications, last four digits of the card.
• Email and SMS gateways: delivery and read status of verification codes.
• Publicly available sources — business directories and online maps, official registers, and businesses' own websites and public social-media pages. We use these to build the unclaimed business profiles described in our Terms of Service. This concerns businesses rather than Clients, and includes an individual's data only where a sole proprietor has published their own business contact details.

We use personal data only for clearly defined purposes, with a corresponding legal basis under the Law “On Personal Data” of the Republic of Uzbekistan and other applicable laws:

• Account management — to register and authenticate you, provide access to your account and ensure its security (performance of contract; consent).
• Bookings and payments — to create, confirm, modify or cancel Bookings and to process related payments and refunds (performance of contract; legal obligation).
• Communication — to send you booking confirmations, reminders and important notifications about the Service (performance of contract; legitimate interest).
• Customer support — to answer your questions and resolve issues (performance of contract; legitimate interest).
• Fraud prevention and security — to detect and prevent fraud, abuse, and security incidents (legitimate interest; legal obligation).
• Product analytics and improvement — to understand how the Service is used and to improve features and performance (legitimate interest; consent where required).
• Marketing — to send promotional messages where you have given consent (consent).
• Compliance — to comply with applicable laws, court orders and lawful requests from public authorities of the Republic of Uzbekistan (legal obligation).

• Providers you book with — your name, contact details and the specifics of your Booking are shared with the Provider so that they can deliver the service.
• Stripe, Inc. — to process payments, refunds and chargebacks. See Stripe's Privacy Policy.
• Cloud hosting and infrastructure providers — to operate the Service, under written confidentiality and data-processing terms.
• Email and SMS providers — to deliver verification codes and notifications.
• Telegram — when you sign in via Telegram or interact with our Telegram bot or Mini App.
• Analytics and error-monitoring providers — to analyse usage and to detect and fix bugs, using aggregated or pseudonymous data wherever possible.
• Public authorities — only where this is required by the laws of the Republic of Uzbekistan or by a binding decision of a competent body.

We never sell your personal data, and we never share it with third parties for their own independent marketing.

The Personal Data Law of the Republic of Uzbekistan requires that personal data of Uzbek citizens be initially collected, accumulated and stored on servers located within Uzbekistan. We comply with this requirement and maintain a primary copy of such data in Uzbekistan.

Where strictly necessary for the operation of the Service (for example, to process a card payment via Stripe in the United States or to use cloud infrastructure in the European Union), we may transfer personal data outside Uzbekistan. Each such transfer is supported by appropriate safeguards — including contractual data-processing agreements, encryption in transit and at rest, and access controls — proportionate to the risk.

We keep personal data only for as long as is necessary for the purposes for which it was collected, after which it is securely deleted or irreversibly anonymised. The main retention periods are:

• Account data — while your account is active, plus up to 12 months after you delete it (to handle disputes and prevent re-registration abuse).
• Booking and transaction records — up to 5 (five) years from the date of the transaction, to comply with the accounting and tax legislation of the Republic of Uzbekistan.
• Authentication and verification logs — up to 12 months for fraud prevention.
• Customer support correspondence — up to 24 months from your last interaction.
• Marketing consent records — until you withdraw consent, plus 12 months for record-keeping.

We use cookies and similar local-storage technologies for the following categories:

• Strictly necessary — authentication tokens, session integrity, CSRF protection. These cookies cannot be disabled.
• Functional — remember your language, theme (light/dark) and consent choices.
• Analytics — aggregated usage statistics. Loaded only after you give consent through the cookie banner.
• Performance and error monitoring — diagnostics that help us fix issues quickly.

You can change your choices at any time through the cookie banner or your browser settings. Please note that disabling strictly necessary cookies will prevent the Service from working correctly.

Under the Law of the Republic of Uzbekistan “On Personal Data” you have the right to:

• be informed about the processing of your personal data;
• access your personal data and obtain a copy in a structured, commonly used format (data portability);
• request correction of inaccurate or incomplete data;
• request deletion of your personal data, subject to our legal retention obligations;
• request restriction of, or object to, certain processing activities;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with the State Personalisation Centre of the Republic of Uzbekistan or another competent authority.

To exercise any of these rights, write to [email protected]. We will respond within 30 (thirty) calendar days. To protect your account, we may need to verify your identity before fulfilling certain requests.

We apply technical and organisational measures appropriate to the risks, including TLS encryption in transit, encryption at rest for sensitive data, hardened server configurations, role-based access controls, regular vulnerability monitoring, encrypted backups and a documented incident-response procedure.

No system can be guaranteed to be 100% secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the competent authority in accordance with applicable law.

We do not use solely automated decision-making (including profiling) that produces legal or similarly significant effects on you.

We do use AI tools to support the Service — for example to write, translate and tidy up the business descriptions in our public catalogue, to improve search and recommendations, and to draft suggestions inside the Bronjoy dashboard. Suggestions that would affect a Booking, an account or money are always reviewed and approved by a person before they take effect, and you can ask us to explain any outcome by writing to [email protected].

The Service is not directed to persons under 16 years of age and we do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact [email protected] and we will promptly delete it.

We may update this Privacy Policy from time to time. The current version is always available on the Service and the “Last updated” date at the top of this page indicates when it took effect. For material changes, we will give you at least 14 days' advance notice by email or through an in-app banner before they take effect.

If you have questions about this Privacy Policy or wish to exercise any of your rights, please contact us:

• Privacy email: [email protected]
• Postal address: Odiliy Inc, Tashkent, Republic of Uzbekistan

You also have the right to file a complaint with the State Personalisation Centre of the Republic of Uzbekistan if you believe that your data-protection rights have been violated.