VOSTOK TAXI Privacy Policy

Version of October 31, 2026

What personal data of Clients and Drivers we process, why we do it, who receives it, how long it is kept, and how Users can exercise their rights.

1. Who Processes the Data

1.1. The owner and operator of the personal data is VOSTOK TAXI Limited Liability Company, taxpayer ID 313096768, address: 72 Ipak Yuli Street, Mingtepa Community, Marhamat District, Andijan Region.

1.2. This Policy applies to the website https://vostoktaxi.uz/, the dispatch service, and the “Vostok Taxi” (for Clients) and “Vostok Driver” (for Drivers) mobile applications, together the “Platform.” It was prepared with regard to Law No. ZRU-547 of the Republic of Uzbekistan “On Personal Data” of July 2, 2019, and other mandatory requirements.

1.3. The Platform connects Clients and Drivers and provides the means of placing orders, communicating, and interacting; VOSTOK TAXI is not a carrier. The words “Client,” “Driver,” and “Order” have the meanings given in the Terms of Use.

1.4. We process only the data needed to run the Platform, perform the contract, and provide safety, support, and settlements, and to comply with the law.

2. What Data We Collect

2.1. About a Client: phone number; name; profile photo, date of birth, gender, and email, if the Client provided them; saved addresses; the addresses, route, comment, and selected conditions of an Order; Order history, Tariff, fare, and payment status; promo code use and account transactions; requests, ratings, and reviews; notes the dispatch service keeps about that Client; the phone’s position as described in clause 5.2.

2.2. About a Driver: name, phone number, date of birth, and gender; profile photo; driver’s license number, categories, and dates; copies of the identity document, driver’s license, and permits, including any personal identification number (PINFL) or taxpayer number shown in them; the make, model, color, and plate number of the vehicle, its documents and photos; the bank card number given for withdrawals, and withdrawal requests; location while working, and whether the phone reports it as simulated; time on line, Order history, income, bonuses, rating, and Order handling figures; home address, if the Driver uses going-home mode; requests.

2.3. From the application to become a driver on the website: first and last name, phone number; make and model of the vehicle and a comment, if given; the date and version of the consent given; the sender’s IP address. An application does not create an account.

2.4. Correspondence: chat messages between a Client and the Driver who accepted the Order, with marks for time, delivery, and reading; requests to the support service, the replies, and attached files. Authorized staff may read chat messages to review a request or a dispute.

2.5. Telephone calls to and from the dispatch service: the participants’ phone numbers, date, time, duration, the related Order, and the staff member who took the call. These conversations are recorded to review requests, for safety, and for quality control. The other party is told about the recording by a voice message before the conversation begins. Only authorized staff can listen to a recording, and each listening is logged.

2.6. In-app calls between a Client and a Driver, when this function is available: participants, date, time, duration, and call status. The voice passes through the company’s telephone exchange, and the participants’ phone numbers are not shared with each other. Such a call is recorded only if recording is switched on and both participants agreed on the call screen; their answer, the date, the IP address, and device details are kept.

2.7. Automatically: IP address, the device identifier created when the application is installed, device name, application and operating system version, push tokens, language, date and time of actions, error logs, sign-in and account protection data, cookies, and similar technical details.

2.8. For a payment, we receive the amount, status, and transaction ID. Payment by bank card is available only when it is switched on. The Client enters the card number in the form of the Payme payment system: we do not receive it and keep only the masked number, the expiration date, and the card token issued by Payme.

2.9. Website visit statistics: we count page views by day; pages that do not exist on the site (a 404 error) are not counted. To count unique visitors, the site computes from the IP address and browser data a pseudonymous hash that changes every month. The statistics hold only the counted views and this hash: the IP address itself is not stored, no cookie is used for them, and the records are deleted when the following month ends.

2.10. Phone details: the applications send the identifier that the phone’s operating system gives them. The server does not keep that identifier: it keeps only a hash of it made with a secret key held on the server, which is enough to tell whether it is the same phone. The phone’s model (Android and iPhone) and the time it was last started (Android only) are kept with it. These details are recorded for the sign-in session, for a Client when placing an Order, and for a Driver when accepting one.

3. Data Sources

3.1. Data comes from the User, the User’s device, the Driver or Client on a specific Order, payment and map services, the support service, the taxi fleet, and government bodies in cases provided by law.

3.2. A Client who orders a trip for another person must tell that person that contact details will be shared and obtain the necessary consent.

4. Purposes and Grounds for Processing

We use data for the following purposes:

• registration, sign-in, and account protection;
• calculating the fare, passing Orders to Drivers, following their progress, and keeping Order history;
• communication between the Client, the Driver, the dispatcher, and the support service;
• receiving payments, refunds, accounting, and tax records;
• safety, fraud prevention, and review of complaints and disputes;
• diagnostics, statistics, and improving the service in anonymized or minimally necessary form;
• meeting obligations to government bodies and protecting legal rights.

4.1. The grounds for processing are the data subject’s consent, the conclusion and performance of a contract, an obligation under the law, and other grounds expressly provided by legislation.

4.2. Promotional messages are sent only with the necessary consent. They can be refused in the message or application settings, through the link in an email, or by contacting the support service.

5. Location, Cookies, and Device Permissions

5.1. Location is used to determine the pickup point, find a nearby Driver, build a route, show the vehicle’s movement, calculate the fare, and provide safety. How it is used to prevent fraud is described in clause 5.7.

5.2. The Client application uses location only while it is open on the screen: to determine the pickup point and show nearby vehicles, for which the coordinates are sent to the server. The pickup point can also be set on the map without location permission. In addition, the application sends the phone’s latest position with the Order and once at each stage of the Order (search, Driver on the way, Driver at the pickup point, Trip), if it has a recent position at that moment. The server stores it with the Order. No continuous tracking of the Client takes place, and the application has no permission to use location in the background.

5.3. The Driver application regularly sends the vehicle’s precise location to the server the whole time the Driver is on line, including when the application is not on the screen or the screen is off; during this time a permanent notification is shown on the device. When the Driver goes off line, sending stops. The server stores a history of the Driver’s locations (no more than one record per minute), and during an Order without a destination also the points of the route traveled, from which the fare is calculated.

5.4. The dispatcher sees the location of a Driver who is on line. A Client sees only the location of the Driver who accepted their Order, from acceptance until the trip ends. A Driver sees the pickup point and route of the Order, but not the location of the Client’s device.

5.5. Access to location, microphone, camera, photos, notifications, or other device functions is given through the device settings. The microphone is needed for in-app calls; the camera and photos are used only when the User chooses or takes a profile photo. Refusing may make the function that needs the permission unavailable.

5.6. The website uses only technical cookies: one remembers the selected language, and the other protects the site’s forms from forged requests. Visit statistics do not use cookies. Cookies can be restricted in the browser settings.

5.7. Checks for suspicious activity. To prevent fraud, the phone’s position is compared with the vehicle’s position. For each stage of an Order, the server stores the position of the Client’s phone with its accuracy and time, the mark the phone’s system gives if the position is simulated, and where the vehicle was at that moment. It also notes when a Driver’s location is reported as simulated or behaves as a real receiver does not. A similar phone model and start time is treated only as a hint, because many people use the same models. A staff member reviews these details and decides what to do; they do not by themselves restrict an account. One consequence is automatic: a Driver’s position that is simulated or unreliable is not counted toward the fare, and a wait during which the phone reported a simulated position is not charged, as described in the Terms of Use.

6. Who Receives the Data

6.1. After an Order is accepted, the Client receives: the Driver’s name and photo, phone number, call sign, rating, and number of trips; the make, color, and plate number of the vehicle; the vehicle’s location and the status of the trip. The Driver receives: the pickup point, route, comment, and selected conditions of the Order, the payment method, and the status of the trip. The Client’s name and phone number are not given to the Driver.

6.2. Data may be processed by service providers and, if the Driver or vehicle belongs to a taxi fleet, by that fleet. They receive only what is necessary and must keep it confidential and secure. At present these are:

• SMS with confirmation codes and notifications: the phone number and message text go to the SMS provider Eskiz and to telecom operators;
• push notifications: the push token and notification text go to Google Firebase Cloud Messaging and, on iPhone, also to Apple Push Notification service;
• maps and address search: coordinates and the query text go to Yandex services; routes are built by the company’s own routing server or by a Yandex service;
• payment by bank card, when switched on: the Payme payment system;
• communications and server hosting: telecom operators and hosting providers.

When a Driver presses the navigator button, the coordinates of the address go to the Yandex Navigator application on the Driver’s device.

6.3. Data is given to government bodies, courts, emergency services, and other persons when the law requires it, when it is needed to protect life and health, or to establish, exercise, or defend legal claims.

6.4. The providers named in clause 6.2 may process data on servers outside Uzbekistan. Cross-border transfer takes place only with a lawful basis and protective measures. The location and registration of personal data databases in Uzbekistan are governed by the mandatory requirements of Uzbek law.

7. Retention and Account Deletion

7.1. Data is kept no longer than necessary for the stated purposes. The period may be extended by accounting, tax, and other legal requirements, an unfinished settlement, a complaint, a fraud investigation, or a dispute.

7.2. Recordings of conversations with the dispatch service are deleted after 180 days. Application logs on the server are deleted after 30 days, and web server logs after 14 days. Website visit statistics are deleted when the following month ends. Suspicious-activity evidence (positions stored with Orders, device details on Orders, noted location anomalies, and the review files built from them) is deleted after 180 days, and the hash, model, and start time of a phone not seen for 180 days are erased. A Driver’s location history is kept for 120 days, except that each Driver’s newest record is kept regardless of its age, because it shows the vehicle’s last known place. No separate automatic period is set for other data, such as Orders and the route points of an Order, chat messages, support correspondence, driver applications, and activity records: clause 7.1 applies to them.

7.3. Once the purpose has been met, data is deleted or anonymized unless there is a lawful basis to keep it. Removing the application from a device does not delete the account or the data.

7.4. An account can be deleted in the application: in the Client application, under Menu → Settings → “Delete account”; in the Driver application, under Profile → Settings → “Delete account.” If you cannot sign in, call the dispatch service: 1425 or +998 55 204 14 25. More details: https://vostoktaxi.uz/en/account-deletion.

7.5. When an account is deleted, the following are deleted: name, phone number, date of birth, gender, email, password, profile photo, copies of a Driver’s documents and license details, saved addresses and cards, notifications, devices and sign-in sessions, and the phone’s hash, model, and start time. For a Client, the positions of the phone stored with Orders, the device details on those Orders, and any review file about the Client are also deleted. For a Driver, the location history including the newest record, noted location anomalies, any review file about the Driver, home address, withdrawal cards, and the Driver’s position and device details on Orders are also deleted.

7.6. For accounting, settlements, and the resolution of disputes, trip history with addresses, payments, Driver account transactions, and withdrawal requests are kept, but they are no longer linked to a name or phone number. Ratings, recordings of calls with the dispatch service, support correspondence, and Order chat messages are also kept without the phone number; a recording is deleted when its period in clause 7.2 ends. The number stays in call records and in message history only if the same number still has another account. An application to become a driver submitted on the website is not deleted along with the account.

8. How We Protect Data

8.1. We use access control, logging of actions, secure transmission, system updates, and other organizational and technical measures suited to the nature of the data and the risks. Passwords are kept only as hashes; payment card tokens and withdrawal card numbers are kept encrypted.

8.2. Users must protect their phone, confirmation codes, and sign-in details. Suspicious activity should be reported to the support service immediately.

9. User Rights

9.1. A User has the right to learn about the processing of their data, access it, demand that it be corrected, temporarily restricted, or destroyed, withdraw consent, and appeal unlawful processing in the manner established by law.

9.2. Requests are sent to support@vostoktaxi.uz. To protect the data, we may ask the User to confirm their identity and link to the account. If data must be kept by law or to resolve a dispute, we will say so in our reply.

9.3. Withdrawing consent does not affect the lawfulness of earlier processing. If the service cannot be provided without certain data, the relevant function or account may be restricted after withdrawal.

10. Data of Minors

10.1. An account is not intended for independent use by persons under 18. If a minor’s data was provided without proper grounds, a legal representative may contact the support service to have it checked and deleted.

11. Changes and Contacts

11.1. The current version is posted on the website. We give notice of material changes at least 30 days in advance, except where an immediate change is required by law or safety.

11.2. Questions and requests: support@vostoktaxi.uz; short number 1425; phone +998 55 204 14 25; mailing address: 72 Ipak Yuli Street, Mingtepa Community, Marhamat District, Andijan Region.