HUSNLY MASTER — PRIVACY POLICY
1. INTRODUCTION
This Privacy Policy explains how we collect, use, store and protect personal
data through the HusnLy Master mobile application (the "App").
By using the App you accept the terms of this Policy. If you do not agree,
please do not use the App.
The App is intended for professional use: barbers, salon masters and salon
owners use it to manage appointments, keep a client database and accept
online bookings.
2. WHAT DATA WE COLLECT
2.1. Account data (about you)
- Phone number — collected at sign-up / sign-in. Used to identify your
account and to deliver a one-time code (OTP) by SMS or Telegram.
- Name — collected when you fill in your profile. Shown inside the App.
- Salon name, username, bio, avatar image — collected when you fill in your
profile. Shown on your online booking page and in messages sent to your
clients.
- Service list, prices, working schedule, branch addresses — entered by you.
Used to calculate appointments and to run online booking.
No password is used — sign-in happens only through your phone number and a
one-time code.
2.2. Data about your clients
The App lets you store the following about your own clients: name, phone
number, status (VIP / standard / blacklist / subscription), notes, interests,
visit history, service prices, cashback balance, and photos you upload.
IMPORTANT: you enter this data into the App and you are the data controller
for it. We process it only on your behalf, as a service provider. Having a
lawful basis (consent or a contract) to store your clients' data and to send
them messages is your responsibility. See section 9.
2.3. Photos
- Client photos — images you take with the camera or pick from your gallery.
They are compressed, uploaded to our server and attached to the client
record.
- Try-on photos — images used for the virtual hairstyle try-on, and the
resulting images. They are stored on the server so the feature can work.
The App does not copy your gallery — only the files you explicitly select are
uploaded.
2.4. Device permissions
Camera — client photos, virtual try-on. Optional.
Photo library (read) — attach an existing photo. Optional.
Photo library (write) — save a try-on result. Optional.
Contacts — fill the name and phone of ONE contact you pick into the
booking form. Optional.
Microphone — requested on iOS together with the camera session. No audio
is recorded or stored. Optional.
Notifications — alerts about new online requests and reminders. Optional.
About contacts specifically: the App does not read your full address book,
does not send it to our servers and does not store it. The system contact
picker opens, you select a single contact, and only that contact's name and
phone number are placed into the form fields.
You may decline any permission — the rest of the App keeps working, only the
related feature becomes unavailable. You can revoke permissions at any time
in your device settings.
2.5. Technical data
- Device model and operating system version, App version
- IP address and request time (in server logs)
- Push notification token (FCM) and platform ("ios" / "android")
- In-app settings (language, theme) — stored ONLY on your device
- Access token — stored in your device's secure storage (iOS Keychain /
Android Keystore)
2.6. Payment data
When you purchase SMS or try-on credits, the payment is completed on the
payment provider's own page. The App never sees, collects or stores payment
credentials such as card number, expiry date or CVV. We keep only transaction
metadata: amount, date, provider name, payment status and identifier.
2.7. What we do NOT collect
- No third-party advertising or analytics SDKs are used (no Google
Analytics, Facebook SDK, AppsFlyer or similar are present in the App)
- No advertising identifiers (IDFA / GAID) are collected
- No location (GPS) data is collected
- Your data is never sold to anyone
3. HOW WE USE THE DATA
We use the data only for the following purposes:
1. Providing the service — signing in, appointments, client database,
statistics, online booking and try-on features.
2. Communication — sending appointment reminders and confirmations to your
clients by SMS or Telegram, according to the rules you configure.
3. Notifications — push messages to you about new online requests, payment
status and similar events.
4. Payment processing — purchasing credit packages and updating balances.
5. Security and abuse prevention — protection against fake sign-ups, spam
and unauthorised access, and rate limiting.
6. Service improvement — detecting errors and fixing technical faults, in
anonymised or minimal form.
7. Legal compliance — accounting, tax and other statutory requirements.
Your data is not used for automated decision-making or profiling.
Legal bases for processing:
- Performance of a contract — your account and the core App features
- Consent — camera, gallery, contacts and notifications (revocable at any
time)
- Legal obligation — retention of financial transaction records
- Legitimate interest — service security and abuse prevention
4. WHO WE SHARE DATA WITH
We do not sell your data and do not share it with third parties for
advertising. We share the minimum necessary data with the following partners
so that the service can work:
SMS provider(s)
Shared: recipient phone number and message text
Purpose: delivering OTP codes and client reminders
Telegram (Telegram Messenger Inc.)
Shared: client's Telegram identifier and message text
Purpose: free message delivery channel, online booking
Push services — Google (Firebase Cloud Messaging), Apple (APNs)
Shared: device push token and notification text
Purpose: delivering notifications
Payment providers
Shared: payment amount and transaction identifier
Purpose: processing the payment
Hosting and cloud storage provider
Shared: server data and files
Purpose: hosting the service
In addition, data may be disclosed to authorised state bodies where required
by law.
All partners are bound by confidentiality and data security obligations.
5. WHERE DATA IS STORED
Data is stored in [HOSTING LOCATION — e.g. data centres located in the
Republic of Uzbekistan]. Personal data of citizens of the Republic of
Uzbekistan is processed in accordance with the Law "On Personal Data".
Some technical services (for example push notifications) inherently rely on
international infrastructure; in those cases the transferred data is minimal
(device token and notification text).
6. RETENTION PERIODS
Account and salon data
— for as long as the account is active
Client database and photos
— until you delete them, or until the account is deleted
Appointment history
— while the account is active; after account deletion, kept only as
anonymised statistics
Payment and credit transaction records
— for the period required by accounting and tax law
Server logs
— [30–90] days
One-time codes (OTP)
— a few minutes
7. ACCOUNT AND DATA DELETION
You can permanently delete your account at any time.
In the App: Profile -> Delete account -> confirm
Without the App: https://husnly.uz/account/delete (phone number and
confirmation code)
Deletion permanently removes:
- the user account and all access tokens
- the salon, branches, services and working schedule
- the client database (notes, interests) and client photos
- the salon avatar, try-on photos and results
- device (push) records and Telegram links
NOTE: any unused SMS and try-on credits are cancelled on deletion and are not
refunded.
Retained because the law requires it: payment transaction records and the
minimum logs needed for legal disputes — for the prescribed period, with
personal linkage minimised.
You can also delete individual items (a client, a photo, a service) from
inside the App without deleting your account.
8. SECURITY
- All network traffic is encrypted with HTTPS/TLS
- The access token is kept in the device's secure storage (Keychain /
Keystore)
- No passwords are used — sign-in relies on one-time codes, which reduces
the risk of credential theft
- Server-side access to data is restricted on a role basis
- Rate limiting is applied to OTP requests
Even so, no one can guarantee 100% security of transmission over the
internet. Protecting your device and the codes sent to your phone number
remains your responsibility.
If a data breach is detected, we will notify affected users and the competent
authority within the period prescribed by law.
9. YOUR RESPONSIBILITY FOR YOUR CLIENTS' DATA
When you enter third-party data (your clients') into the App, you act as the
data controller for that data. You warrant that:
1. You have a lawful basis — the client's consent or a contract with them —
to store their data and to send them messages by SMS or Telegram
2. You explain to your clients how their data is used
3. You delete or correct a client's data on their request
4. You use the data only for the purpose of providing your services
We do not use client data for our own independent purposes without your
instruction.
10. YOUR RIGHTS
Under the Law of the Republic of Uzbekistan "On Personal Data" you have the
right to:
- be informed about the processing of your data
- request correction of inaccurate data
- request deletion of your data (see section 7)
- withdraw your consent (by revoking permissions in device settings)
- obtain a copy of your data
- object to processing and lodge a complaint with the competent authority
To exercise these rights, contact [privacy@husnly.uz]. We will respond within
[30] days.
11. CHILDREN
The App is intended for professional use by persons aged 18 and over. We do
not knowingly collect data from children. If we learn that a child's data has
been collected, we will delete it immediately — please notify us if you become
aware of such a case.
12. THIRD-PARTY LINKS
The App may contain links to external services (Telegram, Instagram, Facebook,
payment provider pages). Their privacy practices are outside our control —
please review those services' own policies.
13. CHANGES TO THIS POLICY
This Policy may be updated from time to time. We will notify you of material
changes inside the App or via your phone number. The updated Policy takes
effect when it is published on this page. Please check the "Last updated" date
at the top.
14. CONTACT
For privacy questions, requests and complaints:
Email: [privacy@husnly.uz]
Phone: [+998 XX XXX XX XX]
Telegram: [@husnly]
Address: [REGISTERED ADDRESS]
================================================================================
APPENDIX A — SUMMARY FOR THE GOOGLE PLAY "DATA SAFETY" FORM
================================================================================
Use the following when filling in the Data safety section in Play Console
(verified against the app source code).
COLLECTED AND TRANSMITTED TO A SERVER
Personal info / Phone number
Required: yes
Purpose: account management, communication
Shared with: SMS and Telegram providers
Personal info / Name
Required: no
Purpose: app functionality
Shared: no
Personal info / Other personal info (client database)
Required: no
Purpose: app functionality
Shared: no
Photos and videos / Photos
Required: no
Purpose: app functionality
Shared: no
Contacts / Contacts
Required: no
Purpose: app functionality (only the single contact the user picks;
NOT sent to our servers)
Shared: no
Financial info / Purchase history
Required: no
Purpose: app functionality
Shared with: payment provider
App info and performance / Crash and diagnostic logs
Required: yes
Purpose: app functionality
Shared: no
Device or other IDs / Push token (FCM)
Required: no
Purpose: notifications
Shared with: Google (FCM)
NOT COLLECTED
Location, calendar, health data, SMS or call history, advertising ID,
audio recordings.
SECURITY PRACTICES
Data encrypted in transit: yes (HTTPS/TLS)
Users can request data deletion: yes (in-app and
https://husnly.uz/account/delete)
Data sold: no
Data shared for advertising: no
FOR THE APP STORE "APP PRIVACY" SECTION
The list above maps to "Data Linked to You".
"Data Used to Track You": none — no tracking or advertising SDKs are used.
================================================================================
NOTE: this text is a draft based on features that actually exist in the app's
source code. Before submitting to the stores, fill in the [bracketed]
placeholders and have it reviewed by a lawyer — I am not one.