Privacy Policy — Fresh Express

1. Who processes the data

The data controller is TO BE FILLED IN (tax id TO BE FILLED IN), address: TO BE FILLED IN. "We" below means that company.

This policy covers Fresh Express (the shopper app), FreshExpress Admin (for store owners and managers), FreshExpress Restaurant (for restaurant partners) and the freshexpress.uz website.

For any privacy question or request: TO BE FILLED IN.

2. What data is collected

Account data. To register and sign in:

phone number — required; it identifies the account;
first and last name;
date of birth and gender — optional, only if you enter them;
profile photo — optional;
app language and notification settings.

Orders and delivery.

basket contents and order history;
delivery addresses, their map coordinates, and the region and district resolved from those coordinates;
the note you leave with an order and the contact number;
the history of order status changes.

Payment. The payment method, amount, order number, transaction id and payment status are stored.

Your full card number, expiry date and CVV never reach us and are never stored on our servers. Payment happens on the licensed provider’s own side.

Location.

In the shopper app, location is read only with your permission and only while the app is open — to find the delivery point on the map.
For a user in the courier role, the current coordinate is stored while a delivery is in progress so the shopper can see the courier on the map. One record is kept — the latest position; no movement history is accumulated.

Voice and microphone. If you use voice ordering:

the microphone records only while you hold the button;
the audio, its transcript and the list of products the AI proposed are kept with the order history, so what was said can be checked if there is a dispute;
the audio is sent to the speech-to-text providers listed below.

Device and technical data. The push notification token, app version, chosen language, request time and IP address in server logs.

Activity. Favourites, viewed products, the reviews you leave and your cashback balance.

3. Why the data is used

To provide the service — creating your account, taking the order, processing payment, handing it to a courier and delivering it. Legal basis: performance of our contract with you.
To communicate — push notifications and SMS about order status, and an operator call where needed.
To make voice ordering work — speech-to-text and matching what you said against the catalogue. Legal basis: your consent to microphone access, which you can withdraw at any time.
To improve the service — analysing unmatched queries and errors, and refining catalogue names.
To meet legal obligations — retaining accounting and tax records and answering lawful requests from authorities.

We do not sell your data and do not pass it to advertising networks. The apps contain no third-party advertising SDKs.

4. Who the data is shared with

Only the minimum needed for the service to work, and only with the providers below. Each is bound to use the data solely for the purpose we specify:

Provider	Data	Purpose
Sayqal (BissBuy)	phone number	sending the SMS sign-in code
WLCM	order number and total, payment status	taking payment by card, Click, Payme and Uzum
Google Firebase Cloud Messaging	the device push token	delivering order-status notifications
OpenAI	the audio and text of a voice order	speech-to-text and understanding the order
ElevenLabs	the voice-order audio and the reply text	speech-to-text and reading the reply aloud
Aisha	the voice-order audio	Uzbek speech-to-text
OpenStreetMap / Nominatim	the delivery point coordinates	showing the map and resolving the region/district
Telegram	order contents, address and contact number	notifying the staff who fulfil the order

In addition, the courier fulfilling your order sees your name, phone number and address, and store staff see the order contents.

The speech-to-text providers and Firebase run servers outside Uzbekistan, so that data is transferred across borders. If you do not use voice ordering, no audio is sent at all.

5. How long the data is kept

Account data — for as long as the account exists, and up to 30 days after a deletion request.
Order and payment records — for the period required by accounting law; after account deletion these records remain in a form that no longer identifies you.
Voice recordings and transcripts — 90 days, then deleted automatically.
Server logs — up to 30 days.

6. Security

All traffic between the app and the server is encrypted with HTTPS/TLS.
There is no password — sign-in uses a one-time SMS code sent to your phone number.
Access to the database and file storage is limited to authorised staff and restricted by role.

No system is perfectly secure. If you notice unauthorised access to your account, write to TO BE FILLED IN straight away.

7. Your rights

to know that your data is being processed and to get a copy;
to correct inaccurate data — name, date of birth and addresses can be edited in the app itself;
to withdraw consent — microphone, location and notification permissions can be turned off in your phone settings at any time;
to request deletion of your account and the data tied to it;
to object to processing and to lodge a complaint.

Send a request to TO BE FILLED IN. We answer within 30 days.

8. Account deletion

How to delete your account and the data attached to it is described on a separate page: Account deletion.

9. Children

The service is not intended for anyone under 16 and we do not knowingly collect their data. If you know a child’s data has ended up in the app, write to us and we will delete it.

10. Permissions the app asks for

Microphone — for voice ordering only. Decline it and the rest of the app works in full.
Location — to find the delivery point on the map. The address can also be typed in by hand.
Notifications — to tell you when the order status changes.
Photo library / camera — only when you pick a profile photo.

11. The website and cookies

The freshexpress.uz pages use no tracking pixels and no advertising cookies. Your chosen language may be stored in the browser; it is not used for anything else.

12. Changes to this policy

When the policy is updated, the "Last updated" date on this page changes. We announce material changes separately — in the app or by SMS.

13. Contact

Privacy matters: TO BE FILLED IN
General support: TO BE FILLED IN, TO BE FILLED IN
Postal address: TO BE FILLED IN