QoyHunter Privacy Policy

Personal data operator: "Third Space" · Website: https://qoyhunter.com · Application: https://app.qoyhunter.com · Contact: help@qoyhunter.com

1. General provisions

1.1. This Policy describes what personal data "Third Space" (the "Operator") processes in providing QoyHunter, for what purposes, on what legal bases, to whom it is transferred, how long it is stored and what rights the data subject has.
1.2. It has been developed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547), taking into account the principles of the GDPR.
1.3. The Service: the web application, the Telegram bot and Mini App, the website, the API.
1.4. By using the Service you confirm that you have read this Policy. If you do not agree — do not use the Service.

2. Definitions

Personal data — information about an identified or identifiable person. Data subject — the User or a team member. Processing — any operation with personal data. Operator — "Third Space". Processor — a person who processes personal data on instructions.

3. What personal data we process

3.1. Account/profile: phone/login, name, language; the e-mail address and the flag showing that it has been confirmed — on registration by phone/login an e-mail address is mandatory and is confirmed by a code sent in a letter, and access is also recovered through it; the password — only as an irreversible hash (it is not stored in clear text). For a telephone number, the method by which it was confirmed (the “Share contact” button in Telegram, a number typed in the bot, a code from an SMS, an administrator’s mark upon a request) and the time of confirmation are additionally stored: whether ownership of the number is treated as proven depends on that method.
3.2. Telegram: Telegram ID, username, chat identifier (for the bot and Mini App).
3.3. Farms and animals (Content): animals (ear tags, weight, pedigree, photos), feed, health and medications, shearing; the composition of the team and its roles. Photos are stored on the server.
3.4. Financial records of the farm — income and expenses; protected on a par with other data.
3.5. Payments/subscriptions: tariff, status, amounts, transaction identifiers. We do not collect or store full card details.
3.6. Technical data and logs: IP address, device and browser, the date and nature of requests, event and error logs.
3.7. Cookies/localStorage: session identifiers, the depersonalised visitorId (funnel analytics), language.
3.8. We do not deliberately collect special categories of personal data (human health, biometrics and the like).

4. Purposes and legal bases

• Registration, authentication and the account — performance of the contract; consent.
• Features of the Service (record-keeping) — performance of the contract.
• Subscriptions and payments — performance of the contract; requirements of the law (accounting and taxes).
• Notifications via the bot, service messages — performance of the contract; legitimate interest.
• Funnel analytics (visitorId) — legitimate interest; consent (for the optional part).
• Usage statistics (Google Analytics — clause 6.4, Yandex.Metrica — clause 6.5) — the Operator's legitimate interest: to understand how the service works and to find inconvenient places and failures. The data is pseudonymised; the right to object — Section 11.
• Security and anti-fraud — legitimate interest; the law.
• Support — performance of the contract; legitimate interest.
• Improvement of the Service — legitimate interest (depersonalised data).
• Compliance with the law — requirements of the law.

4.2. Consent may be withdrawn at any time (Section 11); withdrawal does not affect the lawfulness of the processing carried out earlier.
4.3. Where "legitimate interest" applies, we assess the balance and do not process the data if the rights of the data subject prevail.

5. Sources of data

Directly from the data subject; from the User (data of team members — the User must have a legal basis and must inform them); automatically (technical data, cookies, logs); from third parties (Telegram, payment providers — to the extent necessary).

6. Cookies and analytics

6.1. Cookies/localStorage: session and authorisation (strictly necessary), language and settings, funnel analytics, web analytics (Google Analytics — clause 6.4; Yandex.Metrica — clause 6.5).
6.2. visitorId — a depersonalised visitor identifier (landing page → registration → activation → subscription), without name or phone, used in aggregated form. Strictly necessary cookies — legitimate interest; web analytics — legitimate interest with the right to object (Section 11); any other optional cookies — on the basis of consent.
6.3. Cookies are managed through your browser settings; disabling the necessary ones will break the Service.
6.4. Google Analytics — a web analytics service of Google LLC: it collects statistics on the use of the website, the application and related services — visit and action events (including Telegram bot events and subscription checkout events: tariff, amount, currency), technical browser and device data, pseudonymised cookie identifiers and an internal account identifier. The internal identifier (a random code, without name or phone) links the statistics of a single user across the website, the application, the Telegram Mini App and server-side events (the User-ID feature); some events are sent from the Operator's servers (the Measurement Protocol). Name, phone, payment details and the contents of Farm data are not transferred to the analytics; the IP address is used by the service only to determine the region and is not stored; advertising features and Google Signals are not used. You may object to the analytics through your browser settings (blocking cookies) or by a request to help@qoyhunter.com (Section 11).
6.5. Yandex.Metrica — a web analytics service: it collects statistics on visits to public pages (the website, the marketplace storefront, the blog, the delivery pages) — views and transitions, the referral source, technical browser and device data, pseudonymised cookie identifiers, a click and scroll map. Session recording ("Webvisor") is additionally enabled: the sequence of actions on the page is saved — pointer movements, clicks, scrolling and the contents of the pages viewed — in order to understand where the interface is inconvenient. Not recorded: the contents of the correspondence between a buyer and a seller, the name of the other party, contact details in responses to requests, and also the text entered in the reply field of the correspondence and in the phone field of the delivery form — these areas are marked in the markup as excluded from recording. The analytics operates on public pages and does not operate in the authenticated application (farm record-keeping). On the first visit a notice about the collection of statistics is shown. To object to the processing — Section 11 (a request to help@qoyhunter.com) or your browser settings (blocking cookies).

7. Retention periods

7.1. No longer than is necessary for the purposes, or as required by law.
7.2. As a guide: account data and Content — for the lifetime of the account (after deletion they are deleted, subject to backups); payments and accounting — for the period established by the tax and accounting legislation of the Republic of Uzbekistan; logs and security data — for the period necessary for those purposes; backup copies — for the period of their rotation.
7.3. Deletion: when a Farm or the Account is deleted — cascading deletion from the production systems; from backups — as they rotate; individual data may be stored longer as required by law or for disputes.

8. Transfer to third parties

8.1. We do not sell personal data. Data is transferred to the following recipients — to the extent necessary and on a lawful basis:

• Hosting provider — Hetzner Online GmbH (Germany, EU) — hosting and storage of data, including photos; a processor acting on the Operator's instructions.
• Payment providers — Payme, Click, Uzum (and, once connected, Telegram Payments) — processing of subscription payments; they act as independent operators of payment information, and full card details are processed on their side.
• E-mail provider (forwarding/SMTP) — delivery of service and informational messages to the address you provide.
• Telegram — operation of the Telegram bot and Mini App, sending of notifications and, once connected, acceptance of payment: the identifiers and messages necessary for these features are transferred.
• Google LLC (Google Analytics, USA) — web analytics (clause 6.4): pseudonymised usage statistics, including the linking of sessions by the internal account identifier; name, phone and Farm data are not transferred; transfer to the USA — clause 9.5.
• Yandex.Metrica (YANDEX LLC, Russian Federation) — web analytics and session recording on public pages (clause 6.5): pseudonymised statistics and recordings of actions, with the areas listed in clause 6.5 excluded; name, phone, correspondence and Farm data are not transferred; cross-border transfer — clause 9.6.
• cbu.uz (the Central Bank of the Republic of Uzbekistan) — obtaining public currency exchange rates; no personal data is transferred there.
• State authorities — upon a lawful and justified demand in the cases provided for by law.
  8.2. Confidentiality and security agreements are concluded with processors; processing is carried out only on the Operator's instructions. The list of recipients may be updated as providers are connected — while maintaining an adequate level of protection.

9. Cross-border transfer and storage of data

9.1. Where the data is stored. The Operator's infrastructure (including the servers of Hetzner Online GmbH) is located in the European Union. The processing and storage of data, including photos, take place on servers in the EU.
9.2. Lawfulness of cross-border transfer and of storage abroad. Under the legislation of the Republic of Uzbekistan on personal data (taking into account the amendments introduced by Law of the Republic of Uzbekistan No. ZRU-1125 of 26 March 2026), the requirement to process and store data on technical facilities physically located in the territory of the Republic of Uzbekistan applies only to certain categories of data — biometric and genetic personal data, and also the data of subscribers of telecom operators. The personal data processed in QoyHunter (phone/login, name, Telegram identifiers, IP address, payment information, Farm Content) does not fall within those categories, and the Operator is not a telecom operator. Therefore its processing and storage outside the Republic of Uzbekistan, in a jurisdiction with an adequate level of protection (the EU, the GDPR regime), are lawful and do not require the database to be located or registered in the Republic of Uzbekistan.
9.3. Bases and safeguards. Cross-border transfer is carried out on the basis of the Operator's legitimate interest, the data subject's consent and/or for the performance of the contract, to a jurisdiction with an adequate level of protection, applying contractual, organisational and technical safeguards: traffic encryption (TLS), encryption of backup copies, segregation of access and data minimisation.
9.4. Special categories. Data for which the law requires storage in the territory of the Republic of Uzbekistan (biometrics, genetics) is not collected in QoyHunter. The storage architecture is reviewed regularly for compliance with the legislation in force; if the requirements change, the Operator brings the processing into compliance in good time.
9.5. Web analytics (USA). Pseudonymised web analytics data (clause 6.4) is transferred to Google LLC (USA). Such transfer is carried out on the basis of the Operator's legitimate interest (keeping the service running and improving it), in a minimised form (without name, phone or Content), applying Google's contractual data processing safeguards. You may object to it in accordance with Section 11.
9.6. Web analytics (Russian Federation). Pseudonymised web analytics data and session recordings (clause 6.5) are transferred to YANDEX LLC and are processed on servers located in the territory of the Russian Federation. The legal basis for such transfer is the Operator's legitimate interest — to understand the behaviour of visitors to public pages and to find inconvenient places in the interface; the data is transferred in a minimised form — without name, phone, the contents of correspondence or Farm Content. You have the right to object to such processing: a request under Section 11, or the blocking of cookies through your browser settings, stops the transfer.

10. Security

10.1. Measures: traffic encryption (HTTPS/TLS); passwords stored only as an irreversible hash; segregation of access by roles and least privilege; control of access to servers, logging, backups; restriction of access for employees and contractors to what their duties require.
10.2. Absolute protection does not exist; we take measures to minimise risks and to respond.
10.3. Incidents: in the event of a significant risk — response measures and notification of data subjects and of the authority in the cases provided for by law.

11. Rights of the data subject and how they are exercised

11.1. Rights: access; rectification; erasure (the "right to be forgotten"); withdrawal of consent; objection; restriction of processing; portability (export).
11.2. How to exercise them: on your own in the application (edit the profile and Content, export data, delete a Farm or the Account); by a request to help@qoyhunter.com (we may ask for confirmation of identity).
11.3. Response time — within the period established by the legislation of the Republic of Uzbekistan, as a rule no later than 30 days.
11.4. The exercise of rights may be limited by requirements of the law (retention of payment and accounting data) or by the protection of the rights of third parties.

12. Minors

The Service is not intended for persons under 18; we do not deliberately collect children's data. The personal data of a minor is processed only with the consent and under the responsibility of a legal representative. Regarding a child's data collected without consent — help@qoyhunter.com.

13. Changes to the Policy

The current version is published at https://qoyhunter.com/privacy together with its date; material changes are notified through the Service, the bot or e-mail.

14. Contacts and complaints

14.1. Operator: "THIRDSPACE" MCHJ, INN/STIR 312095041, e-mail help@qoyhunter.com.
14.2. Questions about personal data and the exercise of rights — help@qoyhunter.com (we seek an out-of-court resolution).
14.3. Complaint: to the authorised body of the Republic of Uzbekistan in the field of personal data — the State Personalisation Centre under the Cabinet of Ministers of the Republic of Uzbekistan, and also to a court.

15. Language of the document

This is an English translation of the Policy executed in Russian and Uzbek. In case of any discrepancy in interpretation, the UZBEK version shall prevail.