iHisobchi Privacy Policy

Version 4 · Effective 14 September 2026
Data controller: NEXUSAI LLC (Republic of Uzbekistan)
Service: Telegram bot @iHisobchi_bot, Mini App app.ihisobchi.uz, website ihisobchi.uz, desktop helper E-IMZO Agent
Public address of this document: https://ihisobchi.uz/privacy.en.html
Languages: Russian (original), English, Uzbek. In case of any discrepancy between translations, the Russian text prevails.
Legal basis: Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 02.07.2019 (the "Law")

Independent Google sign-in — addendum dated 14 September 2026

When choosing “Continue with Google” in the web app or PWA, the user accepts the offer and this Policy using the checkbox on the sign-in screen. Google confirms the account and provides the Google identifier and profile name to create an account and support subsequent sign-ins. The Service stores a hash of the identifier and the encrypted name; Google tokens are not retained for further access. These data remain until account deletion, subject to the deletion periods in Section 6.

This sign-in method does not require a phone number or SMS. A Google account is not automatically merged with a phone account; companies and roles are not transferred between them. Telegram retains its existing registration with a mandatory phone number. The data categories below apply to the sign-in methods and features the user chooses.

Only openid profile is requested; no access to Gmail, Google Drive or contacts is requested. When visiting Google, Google’s Privacy Policy and terms also apply. Business documents are not sent to Google through this sign-in mechanism.

To protect sign-in, the web app uses technical cookies lasting up to 10 minutes and a single-use completion grant lasting up to 2 minutes. The ordinary Service session is stored in the browser under the existing rules; we do not use Google sign-in cookies for advertising. Users of web accounts without Telegram may request a copy, correction or deletion of their data, or withdraw consent, through support@ihisobchi.uz after account ownership is checked. A phone number is not required for such requests.

This addendum applies to voluntarily selected Google sign-in. Publishing it does not cause data from existing phone or Telegram accounts to be sent to Google.

Summary (does not replace the full text)

• Who we are. NEXUSAI LLC, TIN 312689489, Uzbekistan. We are an independent developer and not affiliated with Telegram.
• What the Service does. It helps entrepreneurs in Uzbekistan issue and sign business documents (VAT invoices, waybills, contracts, acceptance acts) through Didox, the national electronic document interchange platform, and E-IMZO, the national qualified electronic signature system.
• What data we take. Only what is required to produce a document: your Telegram ID, phone number, full name, TIN/PINFL, your company details, and your documents. Plus whatever you voluntarily upload (bank statement, photo, voice, files).
• We do not sell your data. We do not pass it to advertisers, we do not build advertising profiles from it, and we do not train AI models on it.
• Who we share with. Only parties without whom the service cannot work: Didox, E-IMZO, your bank, the SMS operator, and AI providers for features you switch on yourself. Full list in Section 5.
• Where it is stored. Primary servers in Finland (EU); the electronic-signature node in Tashkent, Uzbekistan. See Section 5.6.
• How to delete it. The /revoke_consent command in the bot, or an email to support@ihisobchi.uz. We respond within 30 calendar days at the latest.
• Age. The Service is intended for business users aged 18 and over.
• Contact. support@ihisobchi.uz · @nexusai_uz

0. Data controller

• Legal name: NEXUSAI Limited Liability Company
• Registered address: 559 Bursilik St., Samarobod MFY, Parkent District, Tashkent Region, Uzbekistan
• TIN: 312689489
• Economic activity code (OKED): 62010 (software development)
• Bank account: 20208000907376902001
• Bank: JSC "TBC BANK", Tashkent
• Bank code (MFO): 01180
• Director: MAʿRUFOV JAVOXIR MAʻMUR OʻGʻLI
• Website: https://ihisobchi.uz
• Support: support@ihisobchi.uz
• Telegram: @nexusai_uz

1. General provisions

This Privacy Policy (the "Policy") sets out how personal data of users of the iHisobchi service (the "Service") is processed and protected.

The Service comprises:

• the Telegram bot @iHisobchi_bot and the Controller's related bots;
• the Telegram Mini App (web app) at app.ihisobchi.uz;
• the website ihisobchi.uz and its sections;
• the auxiliary desktop application E-IMZO Agent, used to work with the USB electronic-signature key.

By using the Service, the user (the data subject) confirms that they have read and understood this Policy and give free, specific, informed and unambiguous consent to the processing of their personal data on the terms below.

Consent is recorded when the user presses the "✅ I accept" button on the consent screen and is stored in the Controller's database (users.tos_accepted_at, users.tos_version). The user can open the current text of this Policy at any time with the /privacy command in the bot or at https://ihisobchi.uz/privacy.en.html.

1.1. Relationship with Telegram

• The Controller is not affiliated with Telegram. NEXUSAI LLC is an independent third-party developer. Telegram does not own, operate, endorse or sponsor the Service and bears no responsibility for the Controller's processing of data.
• This Policy replaces Telegram's standard policy. Under the Telegram Bot Platform Developer Terms of Service, the Standard Bot/Mini App Privacy Policy applies to third-party bots and Mini Apps by default. Because the Service processes data more broadly than that standard document contemplates (electronic document interchange, qualified electronic signature, banking data, opt-in AI features), the Controller publishes its own policy — this document. It takes precedence for everything that happens on the Controller's side.
• What Telegram itself does is governed by Telegram. Message delivery, storage of chats on Telegram servers, and the operation of the Telegram app on your device are governed by the Telegram Terms of Service and the Telegram Privacy Policy. The Controller has no influence over those processes.
• What Telegram passes to the Controller. When you interact with the bot, Telegram passes technical account data: your numeric identifier (telegram_id), first and (if set) last name, username, interface language, and profile photo. When you open the Mini App, Telegram additionally passes a signed initData package containing the same fields, and the Controller's server observes the network IP address of the connection. Telegram does not pass your phone number automatically — it reaches the Controller only if you send it yourself.
• The bot does not read other people's conversations. The bot receives only messages addressed directly to it. Your private chats, channels, and conversations with other people are not accessible to the Service.

2. Categories of personal data processed

2.1. Data received automatically from Telegram

2.2. Data you provide yourself

2.3. Data retrieved from external systems by your TIN, with your consent

2.4. Data generated while the Service operates

The Didox password, tokens, and the Bank24 identifier are stored encrypted (symmetric Fernet encryption, AES-128-CBC with HMAC-SHA256). The encryption key is stored separately from the database in a protected server configuration file (ENCRYPTION_KEY). Plaintext passwords are never logged and never disclosed to third parties.

Special categories of personal data (health, racial or ethnic origin, political opinions, religious beliefs, criminal record, and biometric or genetic data) are not collected or processed by the Service. No voiceprint is created or stored — see Section 5.2.

3. Purposes of processing

Personal data is processed solely for the following purposes:

1. Providing the Service — user authentication, creating and signing documents (invoices, waybills, contracts, acts, etc.) via the Didox platform, and sending documents to counterparties.
2. Electronic document interchange (EDI) — transmitting data to Didox as required by Uzbek legislation on electronic documents.
3. Electronic signature (E-IMZO) — signing documents with the user's qualified electronic signature certificate, via the local agent or the remote Admin Agent.
4. Customer support — answering enquiries, fixing errors, notifying about operation status.
5. Security and audit — maintaining an action log (audit_log) to investigate security incidents and to meet anti-fraud obligations.
6. Billing and subscription accounting — verifying an active access token and calculating the trial period.
7. Financial analytics at the user's request — building the personal "Financial Health" report, optionally including AI parsing of a bank statement the user uploads (Section 5.1).
8. Speech and image recognition at the user's request — converting a voice message into text and reading a document photo, if the user uses these features (Section 5.2).
9. Diagnostics, security and stability — detecting and fixing technical errors via Sentry, including sampled backend performance traces (Section 5.3).
10. Producing materials on request — temporary processing of Material Agent input files and results (Section 5.4).
11. Bank statement reports — local parsing of the file, review and classification of transactions, and generation of a standard XLSX or an XLSX based on a user-selected template (Section 5.1.1).
12. Anonymous website visit statistics — understanding which pages of ihisobchi.uz are useful to readers (Section 5.5).

3.1. What the Controller does NOT do with your data

The Controller expressly undertakes:

• Not to sell, rent or trade users' personal data.
• Not to disclose data to advertisers, data brokers or marketing platforms.
• Not to build advertising profiles and not to use user data for ad targeting — neither its own nor anyone else's.
• Not to use user data to train artificial intelligence models and not to build training datasets from it — neither directly nor by passing it to third parties for that purpose. This is an explicit requirement of the Telegram Bot Platform Developer Terms of Service, and the Controller complies with it.
• Not to collect or retain data beyond what is necessary for the declared features to work (data minimisation).
• Not to send third-party advertising through the bot and not to share the user list for such mailings.
• Not to read the user's conversations with other people, or channels and groups unrelated to the bot.
• Not to request payment card details, one-time codes from unrelated services, Telegram account passwords, or any other data not needed to provide the service.

4. Legal grounds for processing

Processing is carried out on the following grounds:

• Article 19 of Law No. ZRU-547 — consent of the data subject, obtained electronically through the consent screen in the Service.
• Service agreement (public offer at https://ihisobchi.uz/oferta.html) — the Service cannot be provided without processing the listed data (phone, name, TIN), so this processing is necessary to perform the contract with the user.
• Legal requirements — retention of audit data for the minimum period necessary to meet the Controller's obligations.

Individual features (bank statement upload, voice Assistant, Material Agent, bank or inventory-system connection) are enabled only by a separate action of the user and operate solely on the basis of their consent. Declining them does not restrict access to the Service's core functionality.

5. Disclosure to third parties

The Controller does not sell personal data and does not disclose it for marketing purposes. Data is disclosed to third parties only in the following cases:

All recipients process the data only for the stated purpose and may not use it otherwise. Transfers are made over a secure TLS 1.2+ channel.

Data is transferred outside the Republic of Uzbekistan only to recipients located in countries with an adequate level of personal data protection, or on the basis of the user's explicit consent given when enabling the relevant feature.

5.1. Bank statement upload and AI parsing ("Financial Health" report)

The Service offers an optional "Financial Health" feature — a clear report on the state of the user's business. To enrich the report with actual receipts and payments, the user may choose to upload a bank statement file (Excel/XLS).

When such a file is uploaded:

• What is transmitted. The statement contents — transaction rows, counterparty names and TINs, amounts, dates and payment purposes — are transmitted to the external AI provider xAI "Grok" (x.ai) for automatic recognition and structuring. This is necessary because banks export statements in different, unstructured formats, and the AI normalises them.
• Why. The resulting data is used solely to build the user's own personal financial report — matching receipts to invoices, calculating turnover, and highlighting tax risks. The statement contents are used for no other purpose.
• It is voluntary. Uploading a statement is optional. The "Financial Health" report works without it, using document data from Didox with the user's consent.
• How the provider handles the data. Contents are transmitted in transit only, for one-off processing of the request. Under the xAI API terms, API request data is not used to train models and is automatically deleted on the provider's side within 30 days. On the Controller's side, the parsed result is stored as part of the user's data and is deleted together with their account (Section 6).
• Transport security. Transmission is over a secure TLS 1.2+ channel.

5.1.1. Local bank statement reports

The "Statement reports" feature is technically separate from the AI parsing described above. The source file is processed in an isolated local iHisobchi environment and is not transmitted to xAI or any other external AI provider. Only the owner of the active business can access the job and its templates.

• The source file, temporary decrypted copies, and generated XLSX files are encrypted at rest. Decrypted temporary files are deleted immediately after the processing stage.
• The source file and generated artefacts are automatically deleted within 24 hours at the latest. Structured transactions, user decisions, and row provenance are retained for no more than 180 days unless the user deletes the report earlier.
• The user may delete the data of a completed report. The source file, artefacts, structured transactions and visible job metadata are deleted; only a minimal, irreversibly anonymised security log remains.
• Templates saved by the user and separately confirmed rules are not deleted together with a single report: they are listed separately and retained until the user deletes them explicitly or deletes their account. Deleting a template covers all of its versions.
• A user-supplied XLSX template is checked for macros, external links and unsafe formulas. An unsupported template is rejected; the source file is not modified.

5.2. Voice, photos and AI features

Voice message recognition. If the user sends a voice message to the bot, the audio file is transmitted to the provider Groq (api.groq.com, Whisper model) for speech-to-text conversion. The audio file is used only for recognition and is not retained by the Controller longer than needed to produce the reply.

Document photo recognition. If the user sends a photo of a document, the image is transmitted to xAI "Grok" to extract details (name, TIN, amounts, line items). The image is used only for recognition.

AI legal assistant and text Assistant. The user's question and the necessary context are transmitted to xAI "Grok" to generate an answer. AI answers are informational and do not constitute legal advice.

Live voice Assistant. The "Assistant" section of the Mini App supports a live voice mode (a real-time spoken conversation). The feature is available only to users for whom it has been explicitly enabled (opt-in) and does not appear in the interface otherwise.

• What is transmitted. During a voice session, the user's audio stream is transmitted to xAI "Grok" for real-time speech recognition and spoken response.
• Audio is not intentionally stored by either the Controller or the provider — it is a stream-and-discard mode. The only persistent trace of the conversation is the text transcript, stored in the user's Assistant chat history on the same terms as ordinary text messages.
• Voice is not used to identify the person. The Service does not build or store a biometric voiceprint; identity is always confirmed via the Telegram identifier (telegram_id), never by voice.
• It is voluntary. Text chat with the Assistant and all other Service functionality are available without using voice mode.
• Transport security. The audio stream is transmitted over a secure channel (TLS/WSS).

None of the AI providers receives the Didox password, access tokens, the Bank24 identifier, or any other user credentials.

5.3. Sentry error diagnostics

Sentry (Functional Software, Inc.) is used for error diagnostics and to protect the Service. The current production project is hosted in Sentry's Germany (DE, European Union) region, so diagnostic data may be transferred outside the Republic of Uzbekistan to this processor.

• What is sent: the technical error message and stack trace after secret scrubbing, application version and environment, route without secret query parameters, browser/device technical details, network IP information at the provider's transport layer, and sampled backend performance traces.
• Filters strip known Authorization fields, cookies, JWTs, Telegram initData, passwords and tokens. sendDefaultPii=false prevents the SDK from automatically enriching events with PII; free-text exception messages could theoretically contain an incidental identifier, and such cases are investigated and fixed. Session Replay is disabled.
• The data is used only for diagnostics, security and stability, and never for advertising or marketing profiling.
• Events and traces linked to a user request are transmitted only after the current consent version has been confirmed; before consent and after its withdrawal such events are discarded before being sent to the provider.
• Events are retained no longer than the period configured in the active Sentry tenant and the provider's applicable terms/DPA, then deleted by Sentry. The exact current period can be requested from the Controller using the contacts in Section 9.

5.4. Material Agent temporary files

When starting a Material Agent task, the user voluntarily uploads input files and, if a template is chosen, a template file. This data is transmitted to Anthropic (Claude) via the Files API and processed in Anthropic's Code Execution server environment to carry out the user's instruction. The resulting file is downloaded back into the Service; deletion of temporary Anthropic file IDs is requested when each session closes. Under the Anthropic API terms, API request data is not used to train models. Cross-border processing and retention on Anthropic's side are governed by the provider's applicable terms/DPA; current details can be requested from the Controller.

Local input files and generated results are stored in an isolated task directory for no more than 24 hours and are then deleted automatically. Templates saved by the user are retained until the user deletes them or deletes their account.

5.5. The ihisobchi.uz website: cookies and visit statistics

• The ihisobchi.uz website sets no advertising or tracking cookies and uses no advertising pixels (Meta Pixel, Google Ads, Yandex.Metrica, etc.).
• Traffic is measured with Plausible Analytics (Plausible Insights OÜ, Estonia, EU) — a cookie-less web analytics service. It collects anonymous aggregate metrics: page address, referrer, country, device and browser type. Plausible does not assign visitors a persistent identifier, does not track them across sites, and does not build profiles. The data cannot identify an individual and is not linked to a user's Service account.
• The site's pages load Google Fonts web fonts (fonts.googleapis.com, fonts.gstatic.com, Google LLC). When a font is loaded, the visitor's browser sends Google its IP address and request headers — a technical characteristic of any externally hosted web resource.
• Strictly necessary cookies and local storage are used in the Mini App to remember the selected language, theme and authorisation session. They are not used for advertising and are not shared with third parties.
• If the Controller adds advertising analytics in the future, the Policy version will be incremented and consent will be requested again (Section 11), and the recipient will be added to the table in Section 5.

5.6. Where data is physically stored

• The primary infrastructure (database, file storage, application servers) is hosted in the Hetzner Online GmbH data centre in Helsinki, Finland (European Union). Finland is an EU member state and provides an adequate level of personal data protection.
• The electronic-signature node that handles E-IMZO interaction is hosted on a server in Tashkent, Republic of Uzbekistan.
• Database backups are stored encrypted (GPG) within the same infrastructure.
• The Controller reserves the right to relocate the infrastructure to the territory of the Republic of Uzbekistan; any such relocation will be announced through an update to this Policy.

5.7. Disclosure to a partner firm selected for a request ("Specialist help")

Until the user chooses a partner, the "Specialist help" section shows partners an anonymised task passport only: no TIN, name, phone number or other identifiers of the customer's business. The partner sees the public description of the request and coarse bands (tax regime, region, headcount), not the identity of the business.

After the user selects a specific partner firm and separately confirms consent in the request (text: docs/HELP_DISCLOSURE_CONSENT.ru.md, version v1), the Service discloses to that firm only the marked fields: TIN, name, director contact, and request attachments. Time-limited access to marked cabinet sections (documents, bank, reports) is granted with an end date and can be revoked with a button at any time.

From the moment of disclosure the partner firm processes the received data as an independent controller for the purpose of its contract with the customer, not under the Controller's instructions. The Controller is an information intermediary and is not a party to that contract. Consent to details already disclosed cannot be "undone" at the partner; the user may require the partner to stop processing. Until the separate in-request consent is given, identifiers and attachments are not disclosed to the partner.

6. Retention periods

• Core user data (users, businesses) — until consent is withdrawn or the account is deleted at the user's request.
• Audit log (audit_log) — 90 days from the entry, then deleted automatically.
• Didox tokens (didox_token) — until expiry, and no longer than 350 minutes.
• OTP codes — 5 minutes, then destroyed.
• Authorisation context cache in Redis — 60 seconds.
• Voice message audio files — deleted immediately after recognition; only the text is kept.
• Material Agent files and results — no more than 24 hours after the task is created; saved templates — until deleted by the user or with the account.
• Source bank statements and generated statement report files — no more than 24 hours; temporary decrypted copies are deleted immediately after processing.
• Structured transactions and decisions in statement reports — no more than 180 days; the user may delete them earlier by deleting the report.
• Statement report templates and separately confirmed rules — until explicitly deleted by the user or with the account.
• Sentry diagnostic events — no longer than the period configured in the active tenant and Sentry's applicable terms/DPA; the exact current period is provided by the Controller on request.
• Anonymous website visit statistics — retained by Plausible in aggregate form and not linked to the visitor's identity.

After account deletion, the user's data is removed from active tables within 30 calendar days, except for data that must be retained by law (e.g. security audit logs). Backups containing already-deleted data expire on the regular backup retention cycle and are not selectively restored.

7. Rights of the data subject

Under Articles 23–26 of Law No. ZRU-547, the user has the right to:

1. Know about the processing of their personal data and obtain a copy of it.
2. Demand correction of inaccurate or incomplete data.
3. Demand blocking or deletion of their data.
4. Withdraw consent to processing at any time.
5. Appeal the Controller's acts or omissions to the supervisory authority (Personal Data Protection Agency of Uzbekistan) or to a court.
6. Receive information about third parties to whom their data has been disclosed.

How to exercise these rights:

Requests are answered within 15 working days and in any event no later than 30 calendar days from receipt of a confirmed request.

8. Security measures, user age and incidents

8.1. Security measures

• Encryption at rest — Didox passwords, tokens and bank identifiers are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) at the application level; source statements, structured transactions, templates and generated reports are also stored encrypted.
• Encryption in transit — all traffic between the Service and external APIs runs over TLS 1.2+ (HTTPS/WSS).
• Mini App authenticity check — every Mini App request is verified against Telegram's signature (HMAC-SHA256 over initData); requests with an invalid signature are rejected.
• Access restriction — servers are accessible via SSH keys only; the database is not reachable from the internet.
• Rate limiting — request rate limits on the API and OTP service to prevent brute-forcing.
• Audit log — all critical actions (authentication, document creation, signing) are recorded in audit_log.
• Circuit breakers — automatic suspension of calls to external APIs during mass failures.
• Secret masking in logs — passwords and tokens are stripped from logs by a filter before they are written.
• Backups — regular encrypted database backups.
• Minimisation — only data strictly necessary to provide the service is processed.

8.2. User age

The Service is intended for entrepreneurs and organisations and is designed for users aged 18 and over. The Controller does not knowingly collect personal data of minors. If it becomes known that a minor's data was obtained without a legal guardian's consent, it will be deleted upon contact using the details in Section 9.

8.3. Incident notification

If a breach or other personal data security incident is detected that may harm users' rights, the Controller will:

• immediately take steps to contain the incident;
• notify affected users through the bot and/or by email without undue delay and no later than 72 hours after detection;
• notify the supervisory authority in the manner and within the deadlines set by Uzbek law;
• publish the findings of the investigation and the measures taken, at the request of an affected user.

9. Data Protection Officer

• Name: Maʻrufov Javokhir Maʻmur oʻgʻli
• Position: Director, NEXUSAI LLC
• Email: support@ihisobchi.uz
• Telegram: @nexusai_uz

The DPO appointment is formalised by the Controller's internal order No. 1-DPO of 28 April 2026.

10. Withdrawing consent

The user may withdraw consent to the processing of their personal data at any time by:

1. Using the /revoke_consent command in the bot — the fastest way.
2. Contacting support on Telegram: @nexusai_uz.
3. Emailing support@ihisobchi.uz with the subject "Withdrawal of consent to personal data processing" and stating their telegram_id or phone number.

Upon receipt of a confirmed request, the Controller stops processing and deletes the user's data within 30 calendar days, except where retention is mandatory by law (e.g. tax accounting requirements, mandatory security audit log retention periods).

Important: after consent is withdrawn, use of the Service becomes technically impossible, because processing the listed categories of data is a necessary condition of its operation. Documents already submitted to the state Didox system and signed with a qualified electronic signature cannot be deleted by the Controller — they are retained in Didox under that system's rules and Uzbek tax law.

11. Changes to this Policy

The Controller may amend this Policy. For material changes (a broader set of data, new purposes, new recipients) the Controller will:

• increment the version (TOS_VERSION) in the Service code;
• request the user's consent again at their next interaction with the Service;
• publish the current version of the Policy publicly at https://ihisobchi.uz/privacy.html.

Previous versions of the Policy are retained and can be provided to the user on request.

12. Supervisory authority

The supervisory authority for personal data protection in the Republic of Uzbekistan is the Personal Data Protection Agency under the President of the Republic of Uzbekistan.

• Website: id.personal.gov.uz
• Phone: +998 71 200 00 50
• Online reception: personal.gov.uz/ru/contact

The user has the right to lodge a complaint with the Agency about the Controller's actions.

This Policy is drawn up in accordance with the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 02.07.2019, and with regard to the Telegram Bot Platform Developer Terms of Service and the Telegram Mini Apps Terms of Service. It applies from the date stated in the header.