Privacy Policy

This Policy applies to the qrok.uz website, tips pages, the POS app, the admin panel and the Telegram bot @qrokuzbot (together, the "Service"). It is drawn up in accordance with the Law of the Republic of Uzbekistan «On Personal Data» and forms part of the Public Offer.

1. Controller

The controller of personal data is a legal entity being registered in the Republic of Uzbekistan that provides the Service ("we"). Its name and details will be published in the Public Offer after state registration.

For data questions, write to Telegram @qrokuzbot or to privacy@qrok.uz.

2. What data we process

Waiters connected by a venue:

• name and phone, supplied by the venue: once a day we read the staff list from its POS software;
• bank card number for tips, personal Click transfer link;
• photo and savings goal, if the waiter has added them;
• Telegram ID and name, messages, files and voice messages sent to the bot;
• the waiter's ID in the venue's POS software.

Venue contact persons: name, role, phone, Telegram, email, correspondence with us; a photo of the UzQR plate and the data from the connection request.

Venue guests:

• when a tips page is opened: the venue, waiter, bill number and amount, table number from the link on the receipt, and time of opening;
• feedback and phone number, only if the guest left them.
• when a bill is paid by UzQR and the venue has connected the UzQR API — from the UzQR operator: the amount, payment ID, masked card number (first and last 4 digits), card type and, if the operator provides it, the payer's phone number. We never receive the full card number.

We do not receive tip transfer amounts or guests' card details for tips: the transfer takes place in the guest's payment app, bypassing us.

Everyone who writes to the bot: Telegram name and ID, messages, files, voice messages and their transcripts, selected language.

Telegram groups the bot is added to: the bot receives the group's messages but stores only other bots' payment messages, in groups the venue has set to "Payment notifications". People's messages in groups are not stored.

Website visitors: IP address, browser type and request time in technical logs.

3. Why

• To show guests a waiter's tips page with the waiter's transfer details.
• To print the venue's UzQR code and the tips code on the pre-bill.
• To send a waiter the connection link and service messages about their tips page, by Telegram or SMS.
• To connect venues, set up the POS, respond to requests and report failures.
• To count tips code scans for venue statistics and calculation of the service fee.
• To protect the Service from abuse and investigate failures.

We do not sell data, do not use it for advertising and do not share with the venue anything beyond what the Service needs to work.

4. Legal bases

• Consent of the waiter, contact person or guest. A waiter gives it by connecting to the bot via the link and sending their data; a contact person by submitting a request; a guest by leaving feedback.
• The agreement with the venue (Public Offer).
• Legitimate interest of the venue and ours, for a single invitation: the venue gives us the waiter's name and number, and we send a connection link to that number. Everything else a waiter tells us about themselves, and it is processed only with their consent. We keep the name and number while the waiter is on the venue's staff list; 30 days after they are removed from it we erase the number, card and photo and release their chat.
• Legal requirements, where the law requires data to be retained.

5. Where data is stored and who receives it

Data is stored on the servers of Cloudflare, Inc. (USA) in the European Union and the USA. This is permitted by Article 27¹ of the Law «On Personal Data» as amended on 26 March 2026: EU countries are on the list of countries with adequate protection approved by Cabinet of Ministers Resolution No. 415 of 29 July 2026, and the USA is included for companies participating in the EU-U.S. Data Privacy Framework, which include Cloudflare. We also rely on your consent for the transfer.

We share data only with those without whom the Service cannot work:

• Cloudflare: storage, website operation, transcription of voice messages;
• Telegram: delivery of bot messages;
• a telecom operator and an SMS aggregator in Uzbekistan: the phone number and the message text, when we send an SMS;
• the UzQR operator (the Central Bank's clearing system) — the bill amount and number when a payment code is created, and the fiscal receipt link, if the venue has connected the UzQR API;
• the venue to which the waiter is connected: the waiter's name, photo and scan statistics.

A waiter's card number is visible to guests on their tips page, which is the reason the waiter provides it.

We do not process biometric data: photos are not used for facial recognition.

6. How long we keep data

• Waiter and contact data: for as long as the agreement with the venue is in force and 30 days after it ends or after a request to delete it.
• Tips code scans: 3 years, for statistics and billing.
• Correspondence, files and feedback: 3 years from the last message.
• Website technical logs: up to 30 days.

7. Your rights

You may:

• find out what data we hold about you;
• correct or supplement it;
• withdraw consent and ask us to delete your data;
• appeal our actions to the competent authority or a court.

A waiter can change their card, photo and goal through the bot. For anything else, write to @qrokuzbot or privacy@qrok.uz; we will respond within the time limits set by law. Once consent is withdrawn, the waiter's tips page is disabled.

8. Cookies and browser storage

The website does not use advertising or analytics cookies. The browser remembers the selected website language; the admin panel uses a login cookie.

9. Security

Data is transmitted only over an encrypted connection; access to the admin panel requires a one-time code and is limited to our staff; all changes are logged. In the event of a data breach, we notify the competent authority and the affected persons within the time limits set by law.

10. Changes to this Policy

A new version is published on this page with its date. If the changes are material, we will inform venues and waiters through the bot.