Privacy Policy
How Edly collects, uses, shares, stores and protects personal data
Version 1.1 · Effective 28 October 2026 · Audience: All users, parents, mentors (public)
Privacy Policy
This policy explains how Individual Entrepreneur Rahimov Feruz Furqat o'g'li, TIN 30212931010013, address Mevazor 4/11, Kogon district, Bukhara region, Republic of Uzbekistan ("Edly", the "operator" of personal data under the Law "On Personal Data") processes personal data on edly.uz, our apps and the Edly Telegram bot. Contact for privacy questions and requests: Feruz Rakhimov (founder, responsible for personal data), info@edly.uz.
Plain-language summary. We collect what we need to run your account, deliver courses, take payment, keep the Platform safe and (with your permission) send you study reminders and offers. We never see your card number. We do not sell your data. Children's data gets extra protection. You can ask to see, fix or delete your data, and withdraw consent, at any time.
1. What data we collect
| Category | Examples | Source | Why |
| Account | e-mail, Google account identifier, name, phone number, profile photo, language preference, role (learner, mentor, admin) | You / Google sign-in | Create and secure your account |
| Age and consent | date of birth, age-verification status, consent records (version, time, IP address) | You / Parent | Apply rules for minors; prove consent |
| Learning | enrolments, progress, quiz and diagnostic answers and scores, assignments, comments, ratings, certificates | Platform | Deliver courses, certificates and feedback |
| Diagnostic and lead data | contact name, phone, Telegram handle, whether you are a student or parent, consent to be contacted, UTM tags | You | Show your result and, only if you agree, contact you |
| Payments | transaction ID, amount, course, payment method, status, receipt data; refund records | Payment Provider / Platform | Process payments, issue receipts, tax and accounting, refunds |
| Parent link | parent and child identifiers, invitation status, consent version, time and IP address | Parent / Child | Consent and billing for minors |
| AI interactions | questions you type to the AI assistant, answers, related lesson, usage counters | You / AI provider | Provide AI help, safety, abuse prevention, quality |
| Technical and security | IP address, device, browser, operating system, session and token data, video-playback logs, abuse flags, error logs | Automatically | Security, fraud and piracy prevention, support |
| Marketing attribution | referral code, UTM source/campaign, landing page, referring site | Automatically / You | Measure channels, pay ambassadors, run referrals |
| Notifications | Telegram chat ID and handle, notification preferences, last reminder time | You / Telegram | Study reminders and service messages |
| Mentor data | biography, expertise, links, signature image, licence acceptance, earnings and payout records; tax information needed to pay you | Mentor | Evaluate and pay mentors, certificates, tax compliance |
| Communications | support messages, complaints | You | Respond and keep records |
We do not knowingly collect special categories (health, religion, politics, biometrics, etc.). Please do not put them in comments, AI chats or assignments.
2. Why we use data and on what basis
| Purpose | Basis |
| Create and run your account, deliver Courses, certificates | Performance of the contract; your consent where the law requires it |
| Take payments, issue receipts, keep tax and accounting records, handle refunds | Contract; legal obligation |
| Security, fraud, piracy and abuse prevention | Legitimate interest of Edly and users, and legal obligation, to the extent the law allows; otherwise consent given at registration |
| Teaching support: progress reports, reminders, parent reports | Contract; consent (Telegram reminders can be switched off) |
| AI assistant and AI-generated hints | Contract; consent shown before first use |
| Marketing messages and offers | Separate, optional consent (not a condition of purchase) |
| Publishing your film, portfolio or testimonial | Separate written consent (parent's for minors) |
| Improving the Platform using aggregated or anonymised data | Legitimate interest; anonymisation |
| Complying with law and authority requests | Legal obligation |
Uzbek law relies heavily on consent. Where the law requires consent, we ask for it in a clear, separate step, record the version, time and IP address, and let you withdraw it.
3. Children and young people
3.1We do not allow accounts for children under 14. For users aged 14 to 17 we require a Parent to link and consent, and the Parent pays. A Parent can view progress and certificates, withdraw consent and request deletion.
3.2We do not use a minor's data for targeted advertising, do not publish a minor's work or image without a Parent's written consent, and do not allow Mentors or other users to contact a minor outside the Platform's channels.
3.3AI assistance for minors is limited to the lesson context, with safety filters and escalation of flagged exchanges to a person.
4. Who we share data with
We share data only as needed, with these categories of recipients. A current list is kept in this section and updated when vendors change.
| Recipient | Purpose | Location |
| Cloud hosting and storage provider (currently Amazon Web Services; region eu-north-1, Stockholm, Sweden) | Servers, database, files, backups | Sweden (EU) |
| "Sign in with Google" | Outside Uzbekistan | |
| Payment Providers (Click, Payme and other providers shown at checkout) | Process payments; they act as independent operators of card data | Uzbekistan |
| AI provider (currently OpenAI) | Generate AI answers, quizzes and hints from the text you or the lesson supply | United States |
| Speech, avatar and rendering providers used for Course production (for example Azure Speech, HeyGen, Aisha) | Produce lesson audio and video for Mentors | Not used at present |
| Telegram | Deliver notifications and bot messages | Outside Uzbekistan |
| Content delivery and security providers (for example Cloudflare) | Fast and safe delivery of pages and video | Global |
| Mentors | See your name, progress and assignments of Learners in their Courses; not your contact details or payment data | Uzbekistan |
| Employer or school (only for Users enrolled through a Corporate and Institutional Licence Agreement) | Progress report (logins, lessons completed, quiz results, completion, certificates) for its own Users only — never AI-chat content, private messages or other Users' data | Wherever the organisation is located |
| Professional advisers, auditors, insurers | Legal, tax, audit, insurance | Uzbekistan |
| Authorities | Where the law requires | Uzbekistan |
| Successor entity | If the business is transferred to a company, on the terms of the Public Offer, clause 17 | Uzbekistan |
We do not sell personal data and do not share it with advertisers for their own use.
5. Cross-border transfers
5.1Some of our providers are outside Uzbekistan. Since the March 2026 amendments to the Law "On Personal Data", most categories of personal data may be stored and processed abroad if the receiving country ensures adequate protection (the authorised body publishes a list of approved countries) or if we apply the safeguards the law requires. Certain categories (for example biometric and genetic data, and data of telecommunications services) must be kept in Uzbekistan; we do not process these.
5.2Before any transfer we check the destination, put a data-processing agreement in place with the provider, send only the data needed, and keep a transfer register. If a cross-border breach occurs we notify the competent authority within the legal time limits (24 hours for the initial notice and 72 hours for the follow-up report).
5.3Edly's primary database and file storage are hosted by Amazon Web Services in the European Union (Stockholm, Sweden, region eu-north-1). Personal data is transferred there only on a basis permitted by the Law "On Personal Data" and with the safeguards in this section. If the law requires certain data of Uzbek citizens to be stored in Uzbekistan, Edly keeps that data on servers in Uzbekistan.
5.4Edly is registering its personal data databases in the State Register of Personal Data Databases as the law requires. The registration number will be published here once issued. Pending registration, Edly processes personal data only on the legal bases, for the purposes and with the safeguards set out in this Policy.
6. How long we keep data
Our retention schedule is summarised below; the full schedule is in our internal governance manual.
| Data | Retention |
| Account and learning records | While the account is active; deleted or anonymised within 90 days after account deletion, except as below |
| Payment, receipt and accounting records | At least the period required by tax and accounting law (5 years from the end of the tax period) |
| Consent records and parent links | For as long as processing continues plus 3 years to prove consent |
| AI chat content | 12 months, then deleted or anonymised |
| Security and access logs | 12 months |
| Diagnostic lead data without consent to contact | 30 days |
| Marketing data | Until you withdraw consent, or 24 months of inactivity |
| Certificates (credential ID, name, course, date) | While the credential can be verified; revoked ones are kept with the revocation note |
| Mentor payout and tax records | At least the period required by tax and accounting law |
7. Your rights
You may at any time: (a) ask whether we process your data and obtain a copy; (b) ask us to correct inaccurate data; (c) ask us to delete or stop processing data where there is no legal reason to keep it; (d) withdraw consent (withdrawal does not affect earlier lawful processing); (e) object to marketing; (f) ask us to restrict processing while a dispute is checked; (g) complain to us and to the competent state authority for personal-data protection (the authorised state body for personal data — the State Personalization Centre under the Cabinet of Ministers) or to a court.
We reply within 10 working days (or the shorter period set by law). We verify your identity before releasing data. A Parent may exercise a Minor's rights. To make a request, write to info@edly.uz.
8. Security
We use measures proportionate to the risk, including encrypted connections (HTTPS) for all traffic, hashed passwords and tokens, short-lived access tokens, session revocation, role-based access, audit logs of admin actions, encrypted video streaming and key rotation, rate limiting, backups, and staff confidentiality obligations. No system is perfectly secure. If a breach affects your data we will inform you and the authority as the law requires (see our Incident Response Plan).
9. Cookies and similar technologies
See the Cookie Policy.
10. Automated decisions
We use automated checks for fraud and piracy (for example playback blocks) and an AI assistant. We do not make decisions with legal effect on you solely by automated means; you may ask a person to review any block or flag.
11. Links and third parties
Third-party sites and tools have their own policies. Telegram, Google and the Payment Providers are independent operators for the data they collect directly from you.
12. Changes
We will post changes here with a new version and date, and ask for fresh consent where the law requires it.
13. Contact
info@edly.uz · +998 77 767 43 28 · Mevazor 4/11, Kogon district, Bukhara region, Republic of Uzbekistan