1.Operator and scope
Operator
MisterDev — software developer, Republic of Uzbekistan, referred to below as "we".
What this policy covers
- Ulov+ — the app for car owners (iOS and Android, package
uz.misterdev.ulov) - Ulov — the app for service centres and their staff (iOS and Android, package
uz.misterdev.ulov.admin) - ulovgroup.uz — this website
- The server (API) that serves the apps
It does not cover a service centre's own internal procedures, or data you hand over outside the app.
Contact
All privacy questions and requests: info@ulovgroup.uz
2.Data we collect
Registration
- Phone number — confirmed with a one-time code (OTP) sent by SMS
- First and last name
- Password — stored only as a cryptographic hash (bcrypt), never in the clear
- Profile photo — if you upload one
Vehicle data
- VIN, licence plate and plate type
- Make, model, year, colour, current mileage (km)
- Vehicle registration document number
- Vehicle photos — only if you upload them
Service data
- Jobs sent to a service centre and their status
- History of completed work and the time it took
- Labour and parts prices — who can see them is described in §9.2
- Roadside assistance (SOS) requests and their status
Service centre staff (Ulov app)
- Staff member's name, phone number and role
- Who performed which job and how long it took
Technical data
- Push notification token (Firebase FCM and Apple APNs)
- Device language, operating system version and app version — for fixing bugs
- Session tokens (JWT)
What we do not collect
- Location — used on the device (to show what is nearby on the map) and not stored on the server as a movement history
- Payment card details — these stay with the payment provider
- Contacts, SMS history or call logs
- Advertising identifiers or third-party tracking pixels
3.Device permissions
Required
- Internet — for the app to run, sync data and talk to the service centre
Optional
| Permission | What for | If you decline |
|---|---|---|
| Location | Showing nearby service centres, car washes and fuel stations on the map; locating you when you call for roadside assistance | The map still works, but distance and "nearby" sorting are switched off |
| Camera and photos | Taking or uploading a vehicle or profile photo; scanning a VIN in the Ulov app | You can pick a photo manually and type the VIN in |
| Notifications | Telling you when the repair status changes and when the work is finished | You can check the status by opening the app |
| Vibration | Vibrating when a notification arrives | Only the vibration stops |
| Start on device boot | Keeping push notifications working after a restart (Android) | Push resumes once the app is opened again |
Declining an optional permission does not stop the app working — only that feature switches off. You can change permissions in your device settings at any time.
4.Purposes and legal basis
To perform the contract
- Storing and showing the vehicle and service history
- Connecting you with the service centre
- Sending a push notification when a job's status changes
- Passing a roadside assistance request to the relevant provider
On the basis of legitimate interest
- Protecting the account against unauthorised access and detecting abuse
- Fixing errors and improving the stability of the app
- Making maintenance suggestions based on mileage
On the basis of your consent
- Using your location
- Access to the camera and photo library
- Sending push notifications
Consent can be withdrawn at any time in your device settings.
Never used for
- Passing or selling data to third parties for marketing or advertising
- Building and selling a user profile
- Political or social purposes
- Automated decisions producing legal effects for you
5.Third-party services
We use the services below for specific features. Each receives only the minimum data its task requires.
| Service | What is sent | What for |
|---|---|---|
| Cloudflare R2 | Vehicle and profile photos | Storing and delivering images from a private bucket |
| Firebase Cloud Messaging (Google) | Push token, notification text | Delivering notifications to Android devices |
| Apple Push Notification service | Push token, notification text | Delivering notifications and the Live Activity panel to iOS devices |
| Eskiz | Phone number and one-time code | Confirming the number by SMS |
| Yandex Maps | Map tile requests | Rendering the map layer |
| Click / Payme | Payment amount and order identifier | Taking the payment. Card details are never passed to us. |
If you follow a link to a third-party site, that site's own privacy policy applies.
6.Where the data lives
The main database and the application server run on a server located in Uzbekistan.
Some of the services above run on international infrastructure, so the limited data sent to them may be processed outside Uzbekistan: images (Cloudflare), push tokens and notification text (Google and Apple).
Such transfers happen only to the extent needed to perform the feature concerned.
7.Storage and security
Technical measures
- All traffic between the app and the server is encrypted with HTTPS (TLS)
- Passwords are hashed with bcrypt and never stored in the clear
- Vehicle photos are held in a private Cloudflare R2 bucket, behind links that expire
- Database: PostgreSQL, with regular backups
- Sign-in attempts are rate limited and OTP codes are short-lived
Access control
- A user sees only their own data
- Service centre staff can reach only the data of their own centre
- Prices entered by another centre are hidden (§9.2)
- System errors and unauthorised access attempts are logged
No system is 100% secure. If your data is accessed without authorisation, we will notify you within the period and in the manner the law requires.
8.Retention periods
| Type of data | Period |
|---|---|
| Account data | While the account is active; fully deleted within 30 days of a deletion request |
| Vehicle and service history | While the account is active |
| Images (Cloudflare R2) | Within 30 days of account deletion, CDN cache included |
| Push tokens | Revoked on sign-out or when the app is removed |
| OTP codes | Deleted after confirmation, or automatically after a few minutes |
| Location | Not stored on the server as a movement history |
| Security logs | A limited period, for investigating abuse |
| Payment and subscription records | Up to 5 years for accounting and legal obligations, then deleted |
9.Your rights
9.1 Access and correction
You can view and edit the data held about you in the Profile section — name, phone number, vehicle details, photos.
9.2 Who can see service history and prices
When your car is taken in, that service centre sees the vehicle's past service history — what was done and when. This is deliberate: a car cannot be repaired safely without knowing about the previous work.
Labour and parts prices are not part of that. Each service centre sees only the amounts it entered itself; another centre's figures are closed to it.
9.3 Deletion
To delete the account entirely: Profile → Settings → Delete account. The procedure without the app is described on its own page.
9.4 Objection and restriction
Push notification and location permissions can be switched off in your device settings at any time. To request restriction of processing, contact us.
9.5 Getting a copy
You can request the full list of data held about you at info@ulovgroup.uz. We reply within 30 days.
10.Children's privacy
The apps are not intended for users under 13 and we do not knowingly collect data from them.
If a parent or guardian finds such a case, please write to info@ulovgroup.uz and the data will be deleted immediately.
11.Changes to this policy
How you are told
- The "Updated" date at the top of this page changes
- Significant changes are announced in the app
When changes take effect
Changes take effect 7 days after publication. Continuing to use the app after that is taken as acceptance of the new terms. If you do not agree, you keep the right to delete your account (§9.3).
12.Contact and complaints
- Email: info@ulovgroup.uz
- Phone: +998 97 001 70 40 (09:00 – 21:00, Tashkent time)
- Telegram: @ulovgroup
We handle requests within 30 days. If you are not satisfied with the response, you have the right to complain to the competent personal data authority of the Republic of Uzbekistan.