Privacy Policy

Service: Hamyoncha Document date: 27.10.2026 Effective date: 27.10.2026 Version: 2.4

1. General provisions

This Privacy Policy (hereinafter — the Policy) defines the procedure for collecting, storing, processing and protecting the personal data of users of the Hamyoncha service (hereinafter — the Service).

The Policy is drawn up in accordance with the Law of the Republic of Uzbekistan dated 2 July 2019 “On Personal Data” No. ZRU-547 and other requirements of applicable legislation.

The Service operator (hereinafter — the Operator) is the party performing the processing of personal data.

2. Consent to processing

By starting to use the Service, the User consents to the collection, storage and processing by the Operator of the personal data specified in this Policy.

Consent is confirmed by the following actions:

first contact with the Service via the Telegram bot;
passing authorisation in the Telegram bot;
continued use of the Service’s features.

Using the Service requires a linked bank card. There is no free plan: both the free trial and the paid subscription are started only with a linked card (Section 4.1 of the Terms of Service), and without a trial or an active subscription the Service’s records cannot be worked with. By linking a card, the User agrees to the automatic import of its operations (Section 3.3). The User may unlink a card at any time: its import stops, and subscription auto-renewal from that card is switched off.

The User may withdraw consent at any time by deleting the account (see Section 8).

3. Data collected

The Operator collects and stores the data listed below. Some of it is entered by the User; some arrives automatically from a bank card the User has linked.

3.1. Identification data

Data	Source	Purpose
Display name	Entered manually by the User or taken from the Telegram profile	Addressing the User
Phone number	Shared by the User as a Telegram contact, or entered manually	Account identification; preserving the account when the Telegram account changes
Telegram ID	Automatically via the Telegram bot	Identifying the User in Telegram
Telegram username	From the Telegram profile (optional)	Inviting to a shared budget, display
Language (locale)	From the Telegram profile (optional)	Choosing the interface language

3.2. Financial accounting data entered by the User

Expenses — amount, category, comment, date;
Income — amount, source, comment, date;
Wallets and balance — cash and other wallets, their currency, and the balance calculated from the records;
Budgets — limits set by the User;
Categories — system or User-created;
Debts — amount, due date, comment and the counterparty name given by the User;
Planned payments — amount, comment, date and recurrence.

The counterparty name for a debt is entered by the User as free text. The Operator does not independently collect or verify third-party data; responsibility for entering such data rests with the User.

3.3. Data received automatically from a linked card

If the User links a bank card, the Operator automatically receives that card’s operation history through the payment provider:

amount, date and time of the operation;
merchant name and MCC — the merchant category code;
operation type (debit/credit) and its status;
the last known card balance;
the raw provider record in full — to prevent duplicate imports, investigate errors and reprocess incorrectly recognised records.

Import covers only linked cards and runs only during the free trial or an active subscription. The payment provider supplies operations for the current calendar month, so once a card is linked the Service may also receive operations made before it was linked, from the 1st of the current month. During the app’s initial setup the User chooses whether to import operations from the start of the month or only from the current day; for a card linked later, operations are imported from the start of the current month. Operations from previous months are not imported. Unlinking the card stops the import.

3.4. Linked card details

Card linking works as follows:

the full card number and expiry date are entered in the Service’s app (the Telegram Mini App), passed in transit to the payment provider, and are not stored by the Operator;
the CVV/CVC code is never requested and never entered;
the card is confirmed with a one-time SMS code the bank sends to the phone number linked to the card; the code is entered in the same app and is not stored either.

The Operator stores: the masked card number (first six and last four digits, e.g. 860049******8460), the payment system (Uzcard, Humo, MIR), the processing centre, the bank identifier, the cardholder name, the last known balance and card status, and the card identifier on the provider’s side.

If the User starts the free trial (Section 4.1 of the Terms of Service), the Operator additionally stores a card fingerprint of the card the trial was started on: a SHA-256 hash of the masked card number and the cardholder name. The full card number is not used to compute it. The fingerprint is used solely to ensure that no more than one trial is started per card, including across different accounts. It is kept for as long as the account exists (including after the card is unlinked) and is deleted together with the account (Section 8).

3.5. Recognition of receipts, statements and voice messages

Receipt images and PDF files are not stored. A file is processed only while it is being recognised; afterwards only its cryptographic hash (SHA-256) is kept — needed to detect a re-upload of the same receipt;
the recognition result is stored: amount, date, merchant, category, and — where the receipt lists them — the line items (name, quantity, price, VAT amount and rate, MXIK code) plus a textual representation of the receipt;
bank statements (Excel/CSV files) — the operation records extracted from the file;
voice messages — the audio file is not stored; after transcription only the text and the message duration (for usage limits) are kept.

3.6. AI assistant

The Service’s app includes an AI assistant that answers the User’s questions about their finances. If the User uses it:

to prepare an answer, the following are sent to the Google Gemini model (Section 5): the User’s message, the history of that conversation, the facts the assistant has saved (see below) and the information from the User’s own data needed for the answer: name, app language, balance, operations (amount, date, category, merchant), income, budgets, debts (including the counterparty name given by the User), planned payments, wallets and cards (name and balance), statistics and the forecast;
the Operator stores the conversations with the assistant — the User’s messages and the answers, plus the volume and estimated processing cost of each answer (for usage limits);
the assistant may save up to 15 facts the User has told it in a conversation (for example, the amount and date of their salary) to take them into account in later answers;
the assistant does not create or change the User’s records: a record it suggests is saved only if the User confirms it.

The User can delete individual saved facts and conversations in the app at any time. A deleted conversation is hidden from the app and is permanently deleted together with the account (Section 8).

3.7. Technical and marketing data

the Service access token — in hashed form only — and the time it was last used;
the date and time of last activity;
usage counters (number of recognition requests, voice message duration and their estimated cost);
a technical error log (error code and description);
if the User arrived via an advertising link — the source markers from that link (utm).

3.8. Data the Operator does not collect

The Operator does not collect or store:

passports or other identity documents;
bank account numbers;
the full bank card number or its expiry date (Section 3.4);
the CVV/CVC code — it is never requested at all;
the receipt and PDF files themselves (Section 3.5);
audio files of voice messages;
banking operations on cards or accounts the User has not linked;
geolocation;
contacts, device files or other Telegram conversations;
biometric data.

4. Purposes of using the data

The data collected is used for the following purposes:

providing the Service to the User (personal financial accounting);
identifying and authorising the User;
automatically importing operations from a linked card, categorising them and sending notifications about them;
recognising receipts, statements and voice messages and creating accounting records from them;
computing statistics, forecasts and analytics based on the User’s own data;
answering the User’s questions with the AI assistant, based on the User’s own data (Section 3.6);
sending notifications about budget limits, subscription term and payments;
providing the paid subscription service and the free trial, and processing payments (via Paylov);
metering Service usage and applying plan limits;
resolving technical issues and maintaining the security of the Service;
complying with legal requirements.

The Operator does not use the User’s data for advertising, sale to third parties or credit-scoring purposes.

5. Transfer to third parties

The Operator does not transfer personal data to third parties, with the following exceptions. In each case only the minimum data necessary for that purpose is transferred.

Paylov payment system — for linking a card, retrieving that card’s operation history and charging the paid subscription, the necessary data is transferred (card details, phone number, amount, subscription identifier). Card details are processed and stored on the Paylov side;
Google (the Gemini model) — receipt images, PDF files and text messages, in order to recognise the data they contain and suggest a category (a file is transferred only at the moment of recognition); and, if the User uses the AI assistant, their messages to it and the information from their data needed for the answer (Section 3.6);
Aisha (back.aisha.group) — the audio file of a voice message, for transcription into text;
Telegram — the Service runs through a Telegram bot and a Telegram Mini App, so all interaction with the User passes through Telegram’s servers (Telegram’s own privacy policy applies);
Authorised state authorities — in cases provided for by the legislation of the Republic of Uzbekistan, on the basis of an official request.

Each third party operates under its own privacy policy. The Operator is not responsible for their internal processes.

6. Storage and protection of data

6.1. Technical measures

access to the User’s data is performed only over encrypted communication channels;
the Service access token is stored in an encrypted (hashed) form and cannot be recovered to its original value;
the full card number and expiry date are not stored, and the CVV/CVC is never requested at all — the Operator retains only the masked number (first six and last four digits), the card identifier on the provider’s side and, if a free trial was started on the card, its fingerprint (Section 3.4);
card numbers, one-time codes and other sensitive fields are automatically masked in internal logs;
access to the User’s data inside the Service is protected by a unique access token tied to the account;
a linked card is used only to read operations; the only amount that can be charged to it is the subscription, including the automatic charge when the free trial ends unless the User has turned it off (Section 4.1 of the Terms of Use).

6.2. Retention period

Data is stored for as long as the User’s account is active.

When the User requests account deletion, data is not removed immediately but after a 7-day recovery window (see Section 8). During that window access to the Service stops, but the account can still be restored.

Anonymised payment logs may be retained separately, in line with accounting and financial control requirements.

7. User rights

The User has the right to:

be informed about the data being stored about them in the Service;
export all personal operations as an Excel file (.xlsx) using the export function;
edit any of their data or delete it;
delete the facts saved by the AI assistant and conversations with it (Section 3.6);
unlink a card at any time and thereby stop the automatic import;
withdraw consent and delete the account by sending a request to the Operator (Section 8);
cancel the subscription using the cancellation function;
contact the Operator directly or file a complaint with the authorised state body for personal-data matters.

8. Account deletion

The User may request account deletion at any time by writing to the Operator on Telegram (t.me/hamyoncha_official, Section 10) from the Telegram account the Service account is linked to. Deletion happens in two stages:

Stage 1 — a 7-day recovery window. Once the Operator has started the deletion on the User’s request, access to the Service stops and subscription auto-renewal is switched off, but the data is still retained. During those 7 days the User can restore the account by contacting the Operator the same way;
Stage 2 — permanent deletion. After 7 days the data is deleted automatically and irreversibly.

The following are deleted:

profile data (name, phone, Telegram ID/username);
all expense and income records, wallets, budgets, categories, debts and planned payments;
operations imported from a linked card and their raw records;
data recognised from receipts, including line items;
access credentials;
notification history;
conversations with the AI assistant and the facts it saved;
the fingerprint of the card the free trial was started on (Section 3.4);
linked cards (the corresponding link on the payment provider’s side is revoked at the same time).

Once the 7-day window has passed, deletion is irreversible — recovery is not possible.

9. Changes to the Policy

The Operator is entitled to make changes to this Policy. Changes are published as a notification through the Telegram bot. If the User does not agree with the new terms, they may delete their account.

10. Operator contacts

All questions and requests regarding personal data are sent to the following details:

Name: “HAMYONCHA” LLC (MChJ)
TIN/STIR: 313015542
Telegram: t.me/hamyoncha_official
Address: Samarkand region, Kattakurgan city, Damariq mahalla, Furkat street, building 22