Privacy policy
Version: v1.0 · Effective: 10.10.2026 · Last updated: 10.10.2026
1. General provisions
1.1. This policy sets out how the Tasdiq ID service (the @TasdiqIDbot Telegram bot, the tasdiqid.uz website, the panel.tasdiqid.uz dashboard and the API; hereinafter the “Service”) collects, processes, stores and protects users’ personal data.
1.2. Data is processed in accordance with the Law of the Republic of Uzbekistan “On Personal Data”.
1.3. The policy applies to two categories of users: bot users — people who receive confirmation codes from websites and platforms via Telegram; customers — people who have signed up in the dashboard to connect the Service to their website or platform.
1.4. By tapping “I agree” in the bot or ticking the consent box when signing up in the dashboard, you confirm that you have read this policy and consent to the processing of your data.
2. About the operator
- Operator: Jakhongir Bakhtiyarov (founder and owner of Tasdiq ID)
- Taxpayer ID (STIR): 621273861
- Address: Yuqori Chirchiq district, Tashkent region, Uzbekistan
- Phone: +998 93 373 01 30
- Email: [email protected]
The operator processes data for the purposes and by the means it determines.
3. What data is collected
3.1. From bot users:
- Telegram identifier (ID), name and language — provided by Telegram when you open the bot;
- phone number — only if you tap the “Send phone number” button yourself;
- website user identifier — the identifier provided by a website or platform when you connect to it via a link;
- technical data — about message delivery (time, status) and security log entries;
- consent data — the time consent was given and the policy version.
3.2. From customers (dashboard): phone number (to sign in), name, organisation or project name, optionally an email (for invoices and alerts), the identifier of the Telegram account that confirmed the number, consent time and version, sign-in times and IP addresses (security log). The password is stored only as an irreversible hash (argon2id). Invoice details (legal name, taxpayer ID, address) are entered by the customer.
3.3. We do not collect: passport or other identity document data, biometric data, location, contact lists, the content of your Telegram chats, or bank card details.
3.4. For bot users, sharing a phone number is optional: without it, features that require a number may not work. To sign up in the dashboard, a number is mandatory — it is confirmed via Telegram to identify the account owner.
4. Purposes and legal basis
4.1. Data is used only for the following purposes:
- delivering confirmation codes and messages to you from the websites and platforms you use;
- providing the Service to customers: maintaining the account, confirming the owner, sending invoices and technical notifications;
- ensuring the security of the Service and preventing fraud and abuse;
- complying with legal requirements.
4.2. The legal basis is your consent (clause 4.3) and, for customers, the service agreement (public offer) and cases provided for by law.
4.3. Consent is given by tapping “I agree” in the bot or ticking the consent box in the dashboard sign-up form. The time of consent and the policy version are stored. You may withdraw consent at any time (section 8). Withdrawal does not affect the lawfulness of processing carried out before it.
4.4. Your data is not used for advertising, sold, rented out or shared for any other commercial purpose.
5. Confirmation codes
5.1. Confirmation codes are not stored in plain text: only a one-way hash of the code is stored in the database.
5.2. The validity period is set by the website requesting the code: from 1 to 15 minutes, 5 minutes by default. After 5 wrong attempts the code is cancelled. Requesting a new code cancels the previous one. An expired or used code cannot be reused; the code hash and the technical record of the request are permanently deleted after 90 days.
5.3. The Service uses the code only to deliver it to you and to check the code you enter.
6. Sharing with third parties
6.1. Connected websites and platforms. A website or platform you connected to via a link receives from the Service only: its own user identifier, the connection status, a flag showing whether a number is connected, and message delivery status. Your phone number, name and Telegram ID are not shared with the website. If a website sends you a code by phone number, the website already knows that number. A connected website processes your data as a separate operator under its own policy — please read it.
6.2. Technical service providers (processors). The Service uses:
- Cloudflare, Inc. — protects and transmits HTTPS traffic to the websites, dashboard and API (DDoS protection, encryption) and shows the Turnstile captcha at sign-up. IP addresses and technical browser data pass through the Cloudflare network;
- Telegram — message delivery (section 7);
- an email service — sending invoices and alerts to customers (only if an email is provided).
The database and backups are stored on a server located in Uzbekistan.
6.3. Public authorities. Data is provided to competent authorities only in the manner established by law, upon an official request.
6.4. In all other cases your data is not shared with third parties without your consent.
7. The Telegram platform
7.1. The Service works through the Telegram messenger. Telegram’s servers may be located outside Uzbekistan. Your messages to the bot, your name, Telegram ID and the phone number you send pass through Telegram.
7.2. Telegram processes data independently under its own policy, and Tasdiq ID is not responsible for it. We recommend reading Telegram’s privacy policy.
7.3. Data held in the Service’s database is stored on a server in the Republic of Uzbekistan as described in section 9.
8. Your rights
8.1. You have the right to:
- obtain information about your data and how it is processed;
- request correction of inaccurate or outdated data;
- request restriction or blocking of the processing of your data;
- request deletion of your data;
- withdraw consent at any time;
- lodge a complaint if you believe your rights have been violated (clause 8.4).
8.2. Bot commands:
| Command | What it does |
|---|---|
| /stop | Stops sending messages. Data is not deleted. |
| /relink | Updates your phone number (data correction). |
| /lang | Changes the language of the bot and code messages (Uzbek, Russian, English). |
| /delete_me | Immediately deletes your phone number, name, language and links to websites. The Telegram ID remains marked as deleted — so that no messages are sent to you. The consent record and the security log are kept for the periods stated in section 9. |
8.3. Requests. Send requests to access, correct, block or delete data (including deleting a dashboard account) to [email protected]. To verify your identity, we may ask you to write from your Telegram account. We respond within 30 days.
8.4. Complaints. If you are not satisfied with our response or believe your rights have been violated, you may contact the competent authority for personal data or a court.
9. Storage location and retention
9.1. Data in the Service’s database is stored on a server in the Republic of Uzbekistan.
9.2. Retention periods:
| Data | Period |
|---|---|
| Telegram ID, name, language, phone number, links to websites | While you use the Service; immediately after the /delete_me command, or within 30 days of a request |
| Dashboard account data (phone, name, organisation, email) | While the account is active; within 30 days of a deletion request (invoices are kept for the period required by accounting law) |
| Confirmation codes | A code is valid for 1–15 minutes (section 5); the code hash and request record are deleted after 90 days |
| Technical data on message and webhook delivery | 90 days |
| Security (audit) log | 12 months |
| Consent record (time and version) | For the duration of consent and 3 years after — to prove consent was given |
| Backups | Kept encrypted for 14 days; data deleted from the main database disappears from backups within 14 days |
9.3. Data that the law requires to be kept longer is stored with restricted access until that period ends, and then deleted.
10. Security
10.1. The following measures are used to protect data:
- bot users’ phone numbers are stored encrypted (AES-256-GCM); Telegram ID and name are not encrypted because they are needed for delivery, but access to them is restricted;
- confirmation codes, API keys and customer passwords are stored only as hashes;
- all connections are protected by HTTPS; the database is not directly reachable from the internet;
- each customer’s data is isolated from other customers;
- access to data is limited to necessary staff, and administrator sign-in is protected by two-factor authentication;
- sign-ins and changes are recorded in an audit log;
- an encrypted backup is made every day.
10.2. No system is 100% secure. Therefore, never share one-time codes with others and report suspicious activity immediately.
10.3. Security incidents. If data is disclosed without authorisation, we will notify the competent authority and affected users (via the bot or by email) in the manner and within the time limits set by law, and take measures to mitigate the consequences.
11. Minors
11.1. You must be at least 18 years old to use the Service. We do not knowingly collect data from minors.
11.2. If we find that a minor’s data has been collected, we will delete it. If you believe your child’s data has been entered, write to [email protected].
12. Changes to this policy
12.1. When the policy is updated, the new version is published on tasdiqid.uz and the version number and date change.
12.2. If the purpose or scope of processing changes significantly, we will notify you via the bot or dashboard and ask for new consent. Until new consent is given, the previous terms apply; if you do not consent, you may stop using the Service.
13. Contact
Questions, requests and complaints: [email protected] or +998 93 373 01 30
Operator: Jakhongir Bakhtiyarov (founder and owner of Tasdiq ID), taxpayer ID: 621273861, address: Yuqori Chirchiq district, Tashkent region, Uzbekistan, phone: +998 93 373 01 30.