Privacy Policy

1. Who is responsible

The service operator is iman, operating under the laws of Republic of Tajikistan. For privacy requests email privacy@iman.tj. Business and partnership inquiries: partners@iman.tj.

If a registered legal entity name or address is published later via site configuration, that identity is the controller for this Policy.

2. Scope

This Policy covers personal data processed to provide accounts, modules, payments, support and security. It does not cover third-party websites or services you open through links outside iman.

3. Data we collect

Depending on how you use iman, we may process:

• Account and auth: phone number, password hash, username, optional email, session tokens (httpOnly cookies), device/security signals needed to prevent abuse.
• Profile: display name fields, city/country where provided, avatar and public profile content you choose to share.
• KYC / identity: passport or ID images, extracted document fields, selfie images, face-match scores and review outcomes — only when you start verification.
• Marketplace: listings, orders, delivery addresses, seller business details (including legal name where required), checkout and payment status.
• Payments: payment method tokens and transaction metadata processed by payment service providers (for example Stripe); we do not store full card numbers on our servers.
• Messenger: account membership, delivery/read metadata, device/crypto keys you register; message plaintext for end-to-end encrypted chats is designed to stay on devices (see Messaging).
• Social: posts, stories, comments, media, follows/blocks and content you publish.
• Location preferences: approximate location (GPS or city coordinates) you choose to provide for location-based features.
• AI assistant: prompts and responses stored to operate the conversation feature.
• Support and safety: reports, moderation logs and communications with support.
• Technical and product analytics: IP address, approximate region, app/browser metadata, crash/performance signals, and first-party product events (including local attribution/referral keys). Optional cookieless analytics (for example Plausible) may be enabled.
• Website and app analytics (only with your consent): page views with time, page, referring site and UTM campaign tags, IP address, browser/OS/device type, language, screen size, time zone, a random first-party visitor ID and, if you are signed in, your user ID. An approximate location (rounded to about 1 km) is stored only if you press the location button and allow it in your browser.
• Contact details you send us voluntarily (contact form, closed-beta or waitlist signup, partnership requests): name, e-mail, company and message. If you accepted analytics, such a request is linked to the visit session it came from. We do not read your device's contact book.

4. How we use data

We use personal data to:

• Create and secure accounts, authenticate sessions and prevent fraud/spam.
• Operate SuperApp modules you use and personalize non-manipulative product experiences.
• Process marketplace orders, seller onboarding and payments.
• Run identity verification and face matching when you request KYC.
• Provide customer support, enforce community rules and meet legal obligations.
• Improve reliability, security and feature quality using aggregated or minimized signals where possible.
• Understand where visitors come from and which pages work, and follow up on requests you send us (consent-based analytics).

5. Legal bases (where applicable)

Where Republic of Tajikistan law or other applicable law requires a legal basis, we rely on: performance of a contract (providing the service you request); consent (for example KYC biometrics, optional location, marketing where used); legitimate interests in securing and improving the platform that do not override your rights; and legal obligation where we must retain or disclose data. Visit analytics and the optional location rely on your consent, which you can withdraw at any time in Privacy choices.

6. Processors and sharing

We share data with service providers who process it on our instructions (hosting, SMS OTP, object storage/CDN, payment processors, email, analytics). We do not sell personal data. We may disclose data to authorities when legally required, or to protect users, rights and safety.

7. Messenger and encryption

iman Messenger supports end-to-end encryption for eligible chats. Encrypted message content is not designed for operator reading. We still process account, device, delivery and safety metadata. Sealed-sender and related privacy features reduce peer visibility; they are not a guarantee of anonymity from the operator or from compromised devices. Do not treat the product as audited Signal-grade privacy until an independent security audit is published.

8. Retention

We keep data only as long as needed for the purposes above: account data while the account is active; KYC documents for verification, fraud prevention and legal retention; order/payment records per commercial and tax rules; AI conversation history while the feature requires it or until deleted; logs for security for a limited period. When you request deletion we erase or anonymize unless law requires longer retention. Visit analytics records (including IP address) and optional location points are deleted automatically after 180 days; you can delete the data tied to your browser sooner in Privacy choices. Contact requests are kept while being handled and then deleted (spam after 30 days, resolved requests after 365 days).

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction or a copy of your personal data, and withdraw consent where processing is consent-based (without affecting prior lawful processing). Email privacy@iman.tj from the phone/email linked to your account. We may need to verify identity before fulfilling DSAR requests. You can also manage in-product privacy settings (for example last seen, phone visibility) after sign-in. To delete analytics data tied to your browser use Privacy choices (Cookie Notice page) or email privacy@iman.tj.

10. Children

iman is not directed to children under 16. If you believe a minor created an account, contact privacy@iman.tj and we will take appropriate steps.

11. Security

We use technical and organizational measures including TLS in transit, hashed passwords, httpOnly session cookies, access controls and monitoring. No method of transmission or storage is 100% secure.

12. International transfers

Infrastructure or processors may be located outside Republic of Tajikistan. Where transfers occur we use appropriate safeguards available under applicable law and contractual protections with processors.

13. Changes

We may update this Policy. Material changes will be reflected by a new version date/version on this page. Continued use after the effective date constitutes acknowledgment of the updated Policy where permitted by law. Registration and certain flows store the accepted version.

14. Contact

Privacy: privacy@iman.tj. General: partners@iman.tj. Governing law context: Republic of Tajikistan.