Privacy Policy

1. Who processes the data

Operator (owner and operator of the personal data database): [TO BE FILLED IN: company name], TIN [TO BE FILLED IN: TIN], address: [TO BE FILLED IN: legal address], phone [TO BE FILLED IN: phone], email pixibook.uz@gmail.com.

Person responsible for organizing the processing of personal data: [TO BE FILLED IN: person responsible for personal data processing].

2. What data we process

— Account: name, phone number, Telegram ID (if you log in via Telegram), email (optional), website language.

— Family: name, who belongs to it and with what rights, names of relatives you have added to events.

— Photos and videos, as well as information from the files: date and time of shooting, place of shooting (coordinates, if present in the file), phone or camera model; event titles, captions and stories.

— Technical data: cookies for login and language selection; a random browser tag for counting visits (only its fingerprint is stored, without the IP address); IP address and browser — in security logs and when documents are accepted.

— Payment: amount, plan, status and date of payment. We do not receive bank card data.

— Printed album order: recipient’s name, phone and delivery address.

3. Why

To provide the Service (store photos, sort them into events, show them to the family); to log in to the account and protect it; to send login codes and notifications; to accept payments and send receipts; to produce and deliver the printed album; to reply to requests; to compile anonymized visit statistics; to comply with legal requirements.

We do not sell personal data, do not show advertising and do not use family photos in advertising.

4. Legal grounds

Your consent to the processing of personal data (Article 21 of the Law), performance of the contract — the User Agreement, and legal requirements.

5. People in photos, children and faces

— The uploader is responsible for the people in the photos they share with the family. Data of minors is processed with the consent of their parents or guardians (Article 21 of the Law): by uploading photos of children, you confirm that you are their parent (guardian) or have obtained the parents’ consent.

— We do not recognize faces and do not create biometric data. If such a feature appears, it will be enabled only with the separate consent of the family Keeper, and face data will be stored only on servers in Uzbekistan and never transferred abroad (Articles 26 and 27¹ of the Law).

6. Where data is stored and transfer abroad

— Data and files are stored on servers in the city of Tashkent, Republic of Uzbekistan.

— AI assistants (restoration, colorization and others) process photos at an external provider, Replicate, Inc. (USA). A photo is sent there only if the family Keeper has given separate consent for this in the family settings and you yourself have started the assistant; only the selected photo is sent, without names or phone numbers (Article 15 of the Law).

— Login codes and notifications are delivered via Telegram (Telegram Messenger, a company outside Uzbekistan): for this, Telegram receives your phone number and the text of the message.

7. Who receives the data

Only those who help us provide the service, and only to the extent necessary: the server provider in Uzbekistan; Telegram (codes and notifications); the SMS provider (login codes if there is no Telegram); payment systems (payment); the AI service (with consent, see section 6); the printing house and delivery service (when a printed album is ordered).

We will notify you within three days of any transfer of your data to a third party not listed in this Policy (Article 23 of the Law).

Data is provided to government authorities only in cases provided for by law. Where the law allows it, we inform you of such a request.

8. How long we keep it

— Account, family, photos and videos — as long as the account (family) exists and the consent is valid; after deletion — another 30 days in case of cancellation, then they are deleted (periods after a subscription ends are set out in section 7 of the User Agreement).

— Security logs — up to 12 months. Anonymized visit statistics — up to 24 months.

— Payment documents — for the periods established by law. Records of document acceptance — for as long as the contract is in force and 3 years after it ends (for defence in a dispute).

9. Your rights

You have the right (Articles 22 and 30 of the Law): to know what data about you we hold and to receive information about its processing; to correct and supplement the data; to demand that processing be suspended or the data destroyed; to withdraw consent; to appeal against our actions to the authorized state body for personal data or to a court.

To exercise your rights, write to pixibook.uz@gmail.com or via the bot @pixibook_uz_bot. We reply within 10 days and correct inaccurate data within 3 days.

10. Withdrawing consent

Consent can be withdrawn in the same form in which it was given — via the website or the bot — or in writing. After withdrawal, we stop processing and delete the data in the manner set out in section 13 of the User Agreement; the Service cannot be used without consent.

11. How we protect data

The connection to the website is HTTPS only. Files are kept in closed storage and are served only to family members after their rights are checked, or via a valid “Share” link. Login codes are stored only as a fingerprint. Login to the admin panel takes two steps. Backups are stored separately.

12. Cookies

We use only necessary cookies: for login, form protection and language selection, plus our own tag for counting visits. There are no advertising or third-party counters on the website.

13. Changes

A new edition of the Policy is published on the website with its date; we announce significant changes in advance and ask you to accept the new edition.