Privacy Policy

The data controller is Abror Programming LLC, registered at Shota Rustaveli 1, house 1, Yakkasaray district, Tashkent 100070, Uzbekistan. For any privacy question or request, contact us at aerp.dev@gmail.com.

Account data: full name, surname, gender, date of birth, phone number and password (stored in hashed form).

Telegram sign-in data: when you sign in with Telegram, we receive your Telegram ID, username, first/last name and profile photo, as shared by Telegram's official OAuth login — we do not receive your Telegram password.

Verification data: one-time SMS/Telegram codes used to confirm your phone number, and the verification status of your account.

Profile and organization data: your avatar image, job title, role and permissions inside your organization's workspace, and the organizations you create or belong to.

Attendance and biometric data: if your organization enables the face-recognition attendance module, facial images captured at check-in/check-out points are processed to verify identity and record attendance for that organization's employees. This data is processed only for organizations that explicitly enable the module and is treated as a special category of personal data with additional safeguards described in Section 8.

Customer Data entered by your organization: HR records, sales, warehouse, financial and production data your organization stores in AERP, which may include personal data of your organization's employees or clients that your organization is responsible for as a data controller.

Usage and device data: log-in timestamps, IP address, browser and device type, pages visited and actions taken in the Service, collected for security, debugging and product-improvement purposes.

Communications: messages you send to our support team, Telegram bot conversations, and content of demo/quote requests submitted through the Contact page.

We use personal data to:

• create and manage your account and authenticate you, including via phone verification and Telegram sign-in;
• provide, operate and secure the AERP platform and its modules, including the optional attendance module;
• process subscriptions, invoices and payments for paid plans;
• respond to support requests, demo requests and other communications;
• send service notifications (e.g. security alerts, billing reminders, product updates) via email, SMS or Telegram;
• detect, investigate and prevent fraud, abuse and security incidents;
• analyze aggregated usage to improve the Service's reliability, performance and features.

We process personal data on the following legal bases, as applicable: performance of the contract you enter into by using AERP (account provisioning, billing); your consent (e.g. for biometric attendance data or marketing communications, which you may withdraw at any time); our legitimate interest in securing and improving the Service; and compliance with legal obligations, including the Law of the Republic of Uzbekistan "On Personal Data".

We use strictly necessary cookies and browser storage to keep you signed in, remember your language preference, and protect the Service against fraud and abuse. We do not use third-party advertising cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent you from signing in.

We do not sell personal data. We share it only in the following circumstances:

• with Telegram, when you choose to sign in with Telegram or interact with our Telegram bot, subject to Telegram's own privacy policy;
• with payment service providers, to process subscription payments — they receive only the data necessary to complete the transaction;
• with cloud infrastructure and storage providers who host AERP and the files/avatars you upload, acting under our instructions and confidentiality obligations;
• within your organization, where data you or your organization enter is visible to other members according to the roles and permissions your administrators configure;
• with authorities, where required to comply with a legal obligation, court order, or to protect our rights, users, or the public.

Personal data is primarily processed on servers located to serve customers in Uzbekistan and the CIS region. Where a service provider (e.g. a cloud host or Telegram) processes data outside Uzbekistan, we take reasonable steps to ensure an adequate level of protection consistent with applicable law.

Facial recognition for attendance is an opt-in module enabled only by an organization's administrator for its own employees, and is not enabled by default. Where this module is used:

• employees are informed by their organization before biometric processing begins;
• facial data is used solely to verify identity for attendance purposes and is not used for any other purpose, such as advertising or profiling;
• access to biometric records is restricted to authorized roles within the organization;
• organizations may request deletion of an employee's biometric data from us at any time, subject to legal retention requirements.

We retain personal data for as long as your account or organization remains active and as needed to provide the Service. After account or organization closure, we retain data for a reasonable period to allow export and to meet legal, accounting or dispute-resolution obligations, after which it is deleted or anonymized.

We apply technical and organizational measures appropriate to the sensitivity of the data, including encrypted transport (HTTPS), hashed passwords, role-based access control, and restricted internal access to biometric and financial data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, you have the right to:

• access the personal data we hold about you and obtain a copy of it;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data, where it is no longer necessary or where you withdraw consent;
• object to or request restriction of certain processing;
• withdraw consent at any time for processing based on consent, without affecting prior processing;
• where your data is entered by your employer's organization, exercise these rights first through your organization's administrator, who acts as the data controller for that data, or contact us directly and we will forward the request.

To exercise these rights, contact us at aerp.dev@gmail.com; we will respond within a reasonable time as required by applicable law.

The Service is intended for business use by adults and is not directed at individuals under 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will delete it.

We may update this Privacy Policy to reflect changes in the Service or legal requirements. We will post the updated version here with a new "Last updated" date and, for material changes, provide additional notice through the Service, email or Telegram.

For any question, request or complaint about this Privacy Policy or your personal data, contact us at aerp.dev@gmail.com or by post at Shota Rustaveli 1, house 1, Yakkasaray district, Tashkent 100070, Uzbekistan.