Политика конфиденциальности / Privacy Policy
Effective date: [To be set at launch]
Last updated: [To be set]
1. Who We Are
Sapar (the "Platform") is a mobile marketplace for local tours in Kazakhstan operated by [Legal Entity Name, BIN] ("we," "us," "our"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our mobile application and website.
2. Data We Collect
| Data Category | Data Points | Purpose | Legal Basis |
|---|---|---|---|
| Account data | Phone number, first and last name, city you usually travel from, language preference | Account creation, authentication, personalization | Consent (account creation) |
| Profile demographics (all optional) | Gender, date of birth, country of residence | To understand who travels with us and which markets to serve — aggregate analysis and product decisions. Country of residence is offered pre-filled at checkout from your device's region setting; you can change it or leave it blank. We do not use these to set prices, and we do not share them with tour operators. | Consent (you choose whether to provide them; you can clear any of them at any time in Settings → Personal details) |
| Contact email | Email address you enter at checkout (or that comes from your Apple/Google sign-in) | To send you your booking confirmation and any cancellation or refund receipts — transactional messages only, never marketing | Contract performance |
| Booking data | Tour booked, date, number of guests, price paid, booking status | Booking processing, order history, customer support | Contract performance |
| Payment data | Transaction ID, payment status, amount (via TipTopPay) | Payment processing | Contract performance |
| Operator business data | Company or guide name, contact phone number, license number, tour listings, availability, payout info | Operator account, tour listing, payouts | Contract performance |
| Usage data | App opens, screens viewed, search queries, features used | Product improvement, analytics | Legitimate interest |
| Device data | Device type, OS version, app version, language setting | Technical support, compatibility | Legitimate interest |
| Reviews | Rating, review text, associated booking | Community trust, quality assurance | Consent (voluntary submission) |
Data we do NOT collect:
- Credit/debit card numbers (payments handled by TipTopPay)
- Biometric data
- Precise geolocation (city-level only)
- Contacts or address book
- Health data
- Nationality or citizenship. We ask only where you live, which is what tells us which markets to serve. Citizenship is a more sensitive category and we have no use for it.
- Racial or ethnic origin, political opinions, religious beliefs, or sexual orientation
About the optional demographic fields. Gender, date of birth and country of residence are entirely voluntary. Leaving them blank does not restrict your account or your ability to book, and there is no age restriction attached to your date of birth — we do not use it to allow or refuse a booking. You can view, change or clear all three at any time in Settings → Personal details.
We collect your email only to send transactional booking messages (confirmations, cancellation and refund receipts). We do not use it for newsletters, promotions, or any marketing, and we do not share it with tour operators.
3. How We Use Your Data
| Purpose | Data Used | Retention |
|---|---|---|
| Account management | Phone number, name, city | Duration of account + 30 days |
| Understanding who travels with us | Gender, date of birth, country of residence (optional) | Duration of account; cleared immediately if you blank the field in Settings |
| Booking confirmations & receipts | Contact email, booking data | Email on file: duration of account; the copy of the address a receipt was sent to: 3 years with that booking |
| Booking processing | Booking data, payment data | 3 years (tax/accounting requirement) |
| Operator payouts | Operator business data, booking amounts | 3 years |
| Product analytics | Usage data, device data (anonymized) | 12 months (raw), indefinite (aggregated) |
| Customer support | Account data, booking data | Duration of account |
| Legal compliance | As required by KZ law | As required |
4. Data Sharing
| Recipient | Data Shared | Purpose |
|---|---|---|
| Tour operators | Traveler name, phone number, booking details (traveler email is NOT shared) | Tour fulfillment |
| Travelers, and any other visitor to our app or public API | The operator's or guide's public profile: business or guide name, account type (tour company or individual guide), "about" description, logo and profile photo, average rating and number of ratings, city, KTA-registry indicator, and default cancellation policy — together with their tour listings and availability. The operator's contact phone number is not part of this and cannot be retrieved here. | Booking transparency |
| A traveler who has a booking with that operator | That operator's or guide's contact phone number, alongside their name | So you can contact the operator about the booking you hold with them |
| Resend (email delivery) | Your email address + the booking details shown in the message | To deliver your booking confirmation / cancellation / refund emails. Processed on servers outside Kazakhstan (US) under a data-processing agreement and standard contractual clauses [being put in place before launch]. |
| TipTopPay | Transaction amount, user identifier | Payment processing |
| Supabase (infrastructure) | All data (encrypted), stored in the EU (Frankfurt) [target region, pending verification — see ADR-0007] | Cloud hosting |
| Law enforcement | As required by KZ law | Legal compliance |
What "public profile" means, and where the operator's contact phone sits. For every operator whose verification we have approved, the profile listed above is published: it can be retrieved by anyone, including visitors who are not signed in and have not made a booking, and through our public API, not only inside our app. The contact phone number the operator gave us is no longer part of it — for an individual guide that number is often a personal mobile, and it is no longer published.
The restriction is enforced in our database, not merely hidden in the app: the number is not returned by our public API to anonymous callers or to signed-in users generally, so there is no request that will produce it for them. It is disclosed to a signed-in traveler who has a booking with that operator, and only so that traveler can contact the operator about that booking. Two points of precision, because we would rather state them than let the sentence above be read more narrowly than it is true: the test is that a booking exists between you and that operator, not that it is currently active — a booking you later cancelled still lets you see the number; and the number stays available through your booking even if we have since suspended or removed that operator's account, because you may still need to reach them about a trip you paid for.
One related item is still outstanding, and we would rather name it than let this read as fully settled: operators and guides are not yet given a specific notice, purpose statement and recorded consent covering the publication of their profile at the point we collect it, and there is no self-service way for them to withdraw it.
We do not sell personal data to third parties. We do not share data with advertisers.
5. Data Storage and Security
- Storage location: Supabase cloud infrastructure, with a target region of the EU (Frankfurt) — a cross-border transfer from Kazakhstan. The region and its cross-border safeguards are still being finalized before launch (see
artifacts/code/adr/0007-data-residency-eu.md); this transfer is disclosed to you here and is necessary to provide the booking service you use. Your booking emails are delivered by our email processor Resend, which processes your email address on servers in the US under a data-processing agreement and standard contractual clauses [being put in place before launch]. - Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Access control: Row-level security (RLS) ensures users can only access their own data
- Authentication: Phone OTP via Supabase Auth
6. Your Rights
Under the Law on Personal Data and Their Protection, you have the right to:
| Right | How to Exercise |
|---|---|
| Access your personal data | Settings → "My Data" (to be implemented) |
| Correct inaccurate data | Edit your profile in Settings |
| Delete your account and all data | Settings → "Delete Account" |
| Withdraw consent | Delete account or contact us |
| Object to data processing | Contact us at [privacy email] |
| Receive a copy of your data | Contact us at [privacy email] |
Account deletion removes all personal data within 30 days, including the email on your profile. Anonymized analytics data is retained. One exception: the copy of the email address a specific booking receipt was sent to stays attached to that booking record for up to 3 years, because we are required to keep transaction records for tax and accounting purposes. It is removed when that booking record is purged.
7. Data Retention
| Data | Retention Period | After Retention |
|---|---|---|
| Active account data | Duration of account | Deleted within 30 days of account deletion |
| Contact email (on your profile) | Duration of account | Deleted with your account |
| Profile demographics (gender, date of birth, country) | Duration of account | Deleted with your account, or immediately when you clear the field yourself |
| Email address on a booking receipt | 3 years from transaction date | Retained with the booking record (tax/accounting), then removed with it |
| Booking/payment records | 3 years from transaction date | Anonymized |
| Usage analytics (raw) | 12 months | Deleted |
| Usage analytics (aggregated) | Indefinite | No PII |
| Operator business data | Duration of account + 3 years | Anonymized |
8. Children
Sapar is not directed to children under 18. We do not knowingly collect data from minors. If you believe a child has created an account, contact us for immediate deletion.
9. Changes to This Policy
We may update this policy. Material changes will be notified in-app. Continued use after notification constitutes acceptance.
10. Contact
For privacy inquiries: [privacy email — to be set]
Data protection officer: [to be appointed if required by KZ law]