Saroi Privacy Policy
Effective date: 20 October 2026 · Version 1.0
1. Who is responsible
Saroi is operated by sole proprietor YaTT “SOBIROV AKBARSHOH BOBURJON OʻGʻLI”, who is responsible for processing personal data in the Saroi app, saroi.uz and related services. For privacy, deletion, consent withdrawal or SMS opt-out requests, email info@saroi.uz. The operator handles these requests directly.
This notice describes our processing; reading it is not a substitute for consent where consent is required. The Law of Uzbekistan On Personal Data applies. Optional features can be avoided without using them.
2. What we process and why
| Data | Purpose and source |
|---|---|
| Account and sign-in data | Your name, email, photo, role, language, password hash, provider identifiers and tokens, sessions, IP address and device/browser details let us create and protect your account. Google, Apple or Telegram provide information when you choose their sign-in method. Telegram can also provide your phone number with its permission. Passkeys provide a public key and credential/device metadata; fingerprint and Face ID templates remain on your device. |
| Phone and SMS records | Your encrypted confirmed number, keyed hash, masked number, code hash, request time, hashed IP address, language, delivery status, provider reference/cost and consent version support verification and abuse prevention. Older app versions may have no recorded consent version. |
| Profile and property content | You provide contact details, visibility settings, social links, listing addresses/coordinates, descriptions, photos, 3D scans, room layouts and reviews to publish and manage property information. |
| Communication and transactions | Chats and attachments, viewing contact name/phone/email, feedback, enquiries, leases, drawn signatures, payment records/proofs, maintenance requests and notary bookings support your interactions with other parties. |
| Applications and documents | Owner/agent/notary applications may contain phone numbers, encrypted PINFL, cadastral or licence/certificate details and uploaded documents. Private files and access logs support review and document delivery. |
| Identity verification | If OneID becomes available and you initiate it, we receive its identifier, name, birth date and PINFL, stored encrypted, plus verification status/dates. SMS confirmation alone does not establish your identity or property ownership. |
| AI assistant | Your prompts, replies, conversation history and information retrieved by the assistant's tools, potentially including your listings, leases and financial summaries, are processed to answer your requests. |
| Preferences and notifications | Favourites, saved searches/filters, alert settings, push tokens and notification history provide saved results and notifications. Notifications may contain a sender's name and message preview. |
| Location and technical records | With device permission, location centres the map while the app is open. Searches send map bounds to the server; we do not maintain a device-location history. Server/security logs include IP addresses and request/device details. |
Processing supports the services you request, necessary security and legal obligations, and consent where required by law. We do not sell personal data or use it for third-party advertising. We do not intentionally request biometric templates, genetic data or payment-card details. Files, photos and messages can still contain personal or sensitive information you upload: avoid unnecessary identity documents, information about children, bank-card details and third-party data. Obtain the necessary permission before sharing another person's data.
3. What other users can see
Profile names, photos, roles, bios, visible social links, listings, tours and reviews can be public. Profile phone access is restricted to relevant interactions; contact details you submit in a viewing request, chat or document are shared with its recipients. This can include your email. Transaction parties see the records needed for their transaction. A relevant owner or agent may see phone confirmation, identity-verification status, prior lease counts, payment performance and reviews. Recipients may retain their own copies; deleting data from Saroi does not erase those copies.
4. SMS verification and stopping messages
Saroi sends requested verification codes for Uzbekistan numbers (+998), not advertising campaigns. Enter your own number. The send-code action explains SMS consent; current clients record its version. Eskiz.uz (XK “BEST INTERNET SOLUTION”) and mobile operators receive the number and message to deliver it.
Codes expire after 5 minutes and allow up to 5 attempts. A resend requires at least 1 minute; account, number, IP and daily service limits apply. Removing a confirmed number or deleting an account removes its account link, not an SMS block. To block future verification requests to your number, contact info@saroi.uz. We may verify your control of it. The suppression record retains a keyed number hash, masked number, request source/date, handling note and administrator reference, rather than the full number. It remains while the block is needed. A message already handed off for sending may still arrive.
5. Service providers and countries
The main API, database and website are hosted in Oracle Cloud in Frankfurt, Germany. Cloudflare R2 stores uploaded files; its processing locations depend on the service configuration and infrastructure. These services involve processing outside Uzbekistan.
Other recipients include Eskiz and Uzbekistan mobile operators for SMS; OpenRouter and the selected model providers (Google, OpenAI or Anthropic) for assistant requests and tool results; Expo for push notifications and app updates; Apple and Google for sign-in, push delivery and native maps; Telegram for sign-in; and OpenFreeMap for web map requests. Their infrastructure may process data in the USA and other countries. Model-provider retention and processing also follow the selected provider's terms. Do not send sensitive information to the assistant. Third-party sign-in and external links use the provider's own privacy terms.
We disclose data to authorities when legally required and to service providers for their relevant function. Uzbekistan law sets conditions on cross-border storage and transfers; this notice does not certify that every provider has a particular adequacy status or certification. You can ask us about recipients and applicable transfer safeguards at info@saroi.uz.
6. Retention and deletion
Account/profile data, listings and assistant history normally remain until you delete the relevant content or account. Sessions remain until expiry or removal. Confirmed phone data remains until unlinking or account deletion. SMS challenge records are scheduled for deletion after 24 hours; SMS send and consent metadata after 90 days. Account deletion removes the user reference from retained SMS send records. Suppression records remain separately to honour the block.
Deleting either participant's account deletes the shared direct conversation from Saroi. Self-service account deletion is blocked by leases (including ended leases), owned listings with lease history, agency ownership or a notary profile, because other parties depend on these records. Contact us to review deletion, correction, transfer or necessary retention in these cases. OneID records, if present, remain until removal or account deletion; there is no automatic fixed verification-data deletion period.
Private-file deletion is queued and retried. Logs and backups have no single guaranteed automatic deletion deadline; data may remain in restricted operational copies after removal from the live service. Contact us for a review of a particular record. We retain data required for legal obligations or disputes for the applicable period and remove it when no longer needed.
7. Your choices and rights
You can edit your profile, remove a phone link, manage notification permissions, delete assistant conversations and request account deletion in the app. Email info@saroi.uz to request access and information about processing, correction, restriction, removal from public information, deletion, or withdrawal of consent. We may ask for proportionate identity confirmation; do not send a passport or PINFL unless specifically necessary. Withdrawal may prevent the affected feature from working. Requests are handled within applicable legal deadlines; a reasoned refusal to provide information must be given in writing within 10 days under article 22. You may complain to Uzbekistan's authorised personal-data authority or a court.
The assistant provides suggestions; it does not make legally binding rental decisions for you. Other users make their own decisions about transactions.
8. Security and device storage
We use encrypted connections, encrypted confirmed phone numbers/PINFL, hashed verification codes, access controls and temporary private-document links. No service can guarantee absolute security. Contact info@saroi.uz about a suspected incident; we handle required notifications under applicable law.
The website uses session cookies and local settings/cache. The app stores authentication credentials in secure device storage and caches settings/data locally. Sign-out is not a guarantee that every local cache or downloaded file is erased; device settings can clear app/browser storage. We do not currently use advertising or analytics trackers. Map, sign-in and other selected third-party services receive the requests described above.
9. Children and changes
Saroi's rental services are designed for adults. We do not automatically verify every user's age. Contact us if a child has supplied personal data so we can assess removal and applicable consent requirements.
The current notice and its translations are available at saroi.uz/privacy. Russian is the primary text; Uzbek and English are translations. We publish changes with a new date/version and seek fresh consent when required. Privacy contact: info@saroi.uz.