AvtoBaho — Privacy Policy
Effective date: [date]
1. General provisions
This Privacy Policy describes which user data the “DTP zararini baholash” (road accident damage assessment) service collects, how it uses that data, who it shares it with and how long it keeps it. The service is available in three ways: the website https://baholash.uxti.uz, the AvtoBaho mobile app (Android and iOS) and an API for external systems.
The service uses artificial intelligence (AI) to give a preliminary estimate of the damage caused to a vehicle in a road accident. The service is free and contains no advertising or payments.
This Policy has been drawn up in accordance with the Law of the Republic of Uzbekistan “On Personal Data” (ZRU-547). By using the service, you confirm that you have read this Policy and agree to your data being processed as described in it. If you do not agree, do not use the service.
2. Operator
The personal data operator is the owner of the AvtoBaho service (the project team). For all questions and requests about your data:
- Email: [email address]
-
Telegram:
@avtobahola
3. Data we collect
We collect only the data needed for the service to work.
| Data | Source | Where it applies |
|---|---|---|
| Name, email, profile photo link, Firebase identifier | Your Google account, when you sign in to the app | Mobile app only |
| Vehicle photos (up to 20) | Uploaded by you | Website, app, API |
| Make, model, year, mileage, incident description | Entered by you (optional) | Website, app, API |
| Assessment result and AI response | Produced by the AI analysis | Website, app, API |
| Your feedback on an assessment (“accurate” / “not accurate”, comment) | Left by you | Mobile app only |
| Device identifier, platform (Android/iOS), notification (FCM) token, sign-in sessions | Mobile app | Mobile app only |
| Crash reports | Via Firebase Crashlytics | Mobile app only |
| IP address | Every request | Website, app, API |
| Email and comment in an account deletion request | Entered by you in the website form | Website |
The IP address is not written to the database: it is held temporarily in memory for rate limiting and appears in server logs.
About photos. Uploaded photos may show a licence plate, people or documents. The service does not hide them automatically. Make sure photos show only the vehicle damage, and do not upload photos in which other people’s data is visible.
We do not collect: precise location, contact lists, payment details, advertising identifiers. The website contains no analytics or advertising scripts.
4. Purposes of use
Data is processed only for the following purposes:
- assessing vehicle damage and providing you with the result (including the PDF report);
- maintaining your account in the mobile app and keeping your assessment history;
- protecting the service from abuse (rate limiting, detecting fraudulent requests);
- checking and improving assessment quality based on your feedback;
- detecting and fixing failures;
- responding to your requests, including account deletion requests.
Your data is not used for advertising and is not sold.
Legal basis — your consent. Submitting the assessment form on the website, and in the app signing in with a Google account and uploading photos, constitutes consent. You may withdraw consent at any time (section 8).
Status of the result. Assessments are fully automated and performed with AI. The result is a preliminary, approximate estimate; it does not replace an official valuation report or an expert opinion and has no legal effect on you.
5. Who we share data with
To perform an assessment, your photos are sent to AI services located abroad. This is how the service fundamentally works; assessment is impossible without it.
| Recipient | What is shared | Purpose |
|---|---|---|
| AI services: Anthropic (Claude), Google (Gemini) [and OpenAI (GPT) — if used] | Downscaled vehicle photos, make, model, year, mileage, incident description | Identifying damage and estimating prices |
| The AI service’s internet search | Vehicle and spare part names | Finding spare part prices in public sources |
| Google Firebase | Account identifier, device data, notification token, crash reports | App sign-in, app protection (App Check), crash monitoring |
Your name, email and account data are not sent to the AI services.
Cross-border transfer. The servers of the services listed above are located outside the Republic of Uzbekistan, including in the United States. By using the service, you consent to this data being transferred abroad.
Retention by AI services. [How long the AI services retain submitted data and that they do not use it to train models — to be stated once the plans are confirmed.]
Data is not shared with anyone else, except where a competent public authority lawfully requires it in cases provided for by law.
6. Storage location and retention
The database and uploaded photos are stored on the service’s server: [hosting provider, country]. Photos are stored on the server as downscaled copies.
| Data | Retention period |
|---|---|
| Mobile account (name, email, profile photo link) | Until the account is deleted |
| Assessments, photos and feedback in the mobile app | Until you delete them or the account is deleted |
| Assessments and photos made through the website and API | [period, e.g. 90 days]; currently not deleted automatically |
| Sign-in sessions, device and notification tokens | Until you sign out of the app or the account is deleted |
| Account deletion requests | [period] |
| Server logs (with IP address) | [period] |
| Backups | [period] |
The PDF report is not stored on the server: it is generated anew each time it is requested.
7. Deleting your data
You can delete your data at any time.
- A single assessment. If you delete an assessment in the app, its record and photos are deleted from the server immediately.
- Account, in the app. If you delete your account in the app settings, the account, all assessments, photos, feedback, sessions and notification tokens are deleted immediately. The app also deletes your sign-in record in Google Firebase.
-
Account, without the app. Leave a request at
https://baholash.uxti.uz/delete-account, giving your account email. To verify who made the request, a staff member reviews it and completes it within 30 days. - Website assessment. The website has no accounts, so to have an assessment deleted, send the result link to the contact in section 11.
Deleted data may remain in backups for the period stated in section 6. Data previously sent to AI services is deleted according to their own retention practices (section 5).
8. Your rights
You have the right to:
- be informed that your data is being processed, and of the purposes and methods of processing;
- access your data and obtain a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted or its processing stopped;
- withdraw your consent (in which case you will no longer be able to use the service);
- apply to the competent public authority for personal data or to a court if you believe your rights have been violated.
Send your request to the contact in section 11. Response time: [period, e.g. 10 business days]. To confirm your identity, we may ask you to write from your account email.
9. Security and access
The following measures are used to protect data:
- all communication is encrypted over HTTPS;
- in the mobile app each user sees only their own assessments, and photos are served through signed links valid for 1 hour;
- the number of requests is limited (website form, sign-in, daily assessments);
- the type and size of uploaded files are checked, and corrupted files are rejected;
- only authorised staff can sign in to the admin panel with a password, and passwords are stored hashed.
Result link on the website. The website has no accounts: the result page opens through a link containing a random 16-character code, and anyone who knows the link can view it. Share the link only with people you trust.
Staff access. Authorised staff of the service can view assessments and photos for quality control and to handle requests.
No system can guarantee absolute security. If a data security breach is discovered, we will give notice as required by law.
10. Children and changes to this Policy
The service is not intended for anyone under 18, and we do not knowingly collect their data. If we learn that such data has been collected, we will delete it.
We may update this Policy. The new version is published at https://baholash.uxti.uz/privacy with its effective date. We will announce significant changes through the app or the website. The Policy is available in Uzbek, Russian and English; in case of any discrepancy, the Uzbek text prevails.
11. Contact
For questions and requests about this Policy and your data:
- Email: [email address]
-
Telegram:
@avtobahola
Last updated: 11.11.2026