Privacy Policy

Who we are and what this policy covers

UzOffice (uzoffice.uz) is an online office service for the Uzbek language. The service is operated by MIMAX SOFTWARE GROUP, Tashkent, Republic of Uzbekistan (the “Operator”, “we”, “us”). The Operator decides why and how your personal data is processed.

This policy explains what personal data we collect, why, how long we keep it and what rights you have. It applies to:

• the uzoffice.uz website and your UzOffice account;
• the web text editor and spreadsheet editor;
• the free public converter at /solutions/transliteration;
• document templates and the Document Assistant;
• the UzOffice add-ins for Microsoft Word, Excel and PowerPoint (the “add-in”).

We process personal data in accordance with the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 2 July 2019. The rules for using the service are set out in the Terms of Service.

What data we collect

We collect only what the service needs to work. The table below lists every category.

Account events recorded in the activity log include: successful and failed sign-ins (including via Google and Telegram), sign-outs, registration, email confirmation and change, password change and reset, profile updates, API key and device events, and subscription events.

What we do not collect

• bank card details — they are entered only on the Payme or Click page;
• the text of documents, spreadsheets and presentations you edit in Word, Excel and PowerPoint with the add-in;
• words checked by the web editor’s spell checker (other than the ones you add to your dictionary);
• text entered in the free public converter.

How we use data and on what grounds

We use personal data only for these purposes:

• Providing the service: creating the account, signing you in, storing and editing your files, sharing, spell check and conversion, subscriptions and add-in licenses.
• Security: preventing unauthorized access, detecting abuse, applying request limits, investigating incidents.
• Service emails: email confirmation, password reset, email change confirmations and notices, and notices about new versions of the Office add-ins.
• Payments and accounting: activating paid plans and keeping records required by law.
• Improving the site: aggregated statistics from our own analytics.

Legal grounds for processing:

• your consent, given when you register and accept this policy (you can withdraw it — see Your rights);
• performance of the agreement between you and the Operator (the Terms of Service);
• obligations the Operator has under the law of the Republic of Uzbekistan (for example, accounting).

How your documents are processed

• Web editor. Documents and spreadsheets are processed on our server so they can be displayed and saved. For spell checking, words are sent to the server; they are not logged or stored (except words you add to your personal dictionary).
• Free converter. Text sent to /solutions/transliteration is converted and not stored. One request can contain up to 10,000 characters. The number of requests is limited; your IP address is used to apply this limit.
• Office add-ins (Word, Excel, PowerPoint). Conversion and spell check run locally on your computer; document text is never sent to us.
• Document Assistant. To understand your messages, their text is sent to an AI service located abroad; identification numbers are hidden beforehand. Details are in Document Assistant and artificial intelligence.

Emails

Emails are sent from MIMAX SOFTWARE GROUP’s own mail server. We do not send advertising newsletters. If you don’t want to receive notices about new add-in versions, write to support and we will stop them. Emails needed for account security (confirmation, password reset, email change) cannot be turned off.

Cookies

We use only the cookies the site needs to work, plus one cookie for our own analytics. We do not use advertising cookies.

The site does not currently show a cookie banner. You can block or delete cookies and localStorage in your browser settings (usually under “Privacy” or “Site data”). Note that without the essential cookies — the session, language and antiforgery cookies — you will not be able to sign in or submit forms. Blocking _uzv does not affect how the service works.

Site analytics

We use our own analytics system that runs on our servers. We do not use Google Analytics, Meta Pixel, Yandex Metrica or any other third-party analytics.

What is recorded:

• a random visitor ID _uzv (cookie and localStorage, 400 days);
• pages visited, referrer, UTM campaign tags;
• screen size, browser language, device type, browser and operating system;
• time actively spent on a page and visits to pages that don’t exist (404);
• on the server: IP address and, if you are signed in, your user ID.

Country, region and city are determined locally on our server from the IP address using the DB-IP “IP to City Lite” database. The IP address is not sent to any third party. Traffic from bots is excluded.

Raw page views are kept for 120 days and raw sessions (including the IP address) for 400 days. After that only daily aggregate statistics remain, which contain no personal data.

Office add-ins (Word, Excel, PowerPoint)

The UzOffice add-ins for Microsoft Word, Excel and PowerPoint are installed by one installer and share one license. All three handle data in the same way: they contact our server only to activate and check your license, to check for updates and to download dictionary updates.

For this it sends your license key, an anonymous identifier of the device (it does not reveal who you are or what is on your computer) and the minimum technical data needed for licensing and updates. The server records when a device was activated and last used, so that device limits work and you can see your devices.

You can see and manage your keys and their devices at /api-keys.

Document Assistant and artificial intelligence

The Document Assistant is an optional feature: you describe your situation in plain words, and the assistant finds a suitable document template and helps you fill it in. To understand your messages it uses an artificial intelligence service provider located outside the Republic of Uzbekistan (the “AI provider”). Apart from signing in with Google or Telegram, this is the only case in which your data leaves Uzbekistan, and it happens only when you use the assistant yourself.

What is sent to the AI provider

• the text of the messages you write to the assistant;
• the context needed to understand the request: earlier messages in the same conversation, the selected document type and the current question.

Your account details (name, email, phone number), your stored files and your other conversations are not sent to the AI provider.

What is hidden before sending

Before a message is sent, the following data in it is automatically replaced with placeholders: passport series and number, PINFL, bank card and account numbers, phone numbers, email addresses, taxpayer number (STIR) and bank code (MFO). Their real values are not sent to the AI provider — they are only written into the document being prepared on our server. Details about the parties to a document that you enter through the dedicated form are not sent to the AI provider at all.

How the AI provider processes data

The AI provider processes data only on our instructions, to prepare a response to the request. Under the terms currently in place with the provider, data sent to it is not used to train its models and is kept on the provider’s side only for the limited period needed to provide the service and prevent abuse. The primary copy of your conversations is stored on our servers in Uzbekistan.

Legal basis and withdrawing consent

By starting to use the assistant you give your explicit consent to the processing of your messages as described in this section, including processing outside the Republic of Uzbekistan (article 15 of the Law “On Personal Data”). To withdraw consent, simply stop using the assistant: the rest of the service — the editors, the converter, spell check and the Office add-ins — does not use the AI provider. You may ask us to delete the conversations stored on our servers — see Your rights.

Storing conversations

Conversations, the values the assistant has recognised and the corrections you later make to the document are stored on our servers so that you can resume a conversation, open the draft and download the document again. Removing a conversation from the list only hides it from your list; you can ask support to delete it permanently. Authorised staff of the Operator may view conversations, with the data listed above hidden, to check the assistant’s quality and fix errors.

Use for improving the service

Each conversation’s menu has the option “Allow this conversation to be used to improve the service”. It is off by default and only takes effect if you turn it on yourself; once you turn it on, your choice carries over to new conversations. If it is turned on, we may use the conversation to analyse how the assistant performs and to train language models that we develop ourselves and run on our own servers. In such use the data listed above remains hidden, and the data is not sold or given to third parties. You can turn the option off at any time — after that the conversation is not used for these purposes. Data that has already been used for training cannot be extracted from a trained model.

Where data is stored and how it is protected

Our servers and all personal data of users are located in the Republic of Uzbekistan, in accordance with the requirement to store personal data of citizens of Uzbekistan on its territory (article 27¹ of the Law “On Personal Data”). We do not transfer personal data abroad, with two exceptions: the data you yourself send to Google or Telegram when you choose to sign in with them, and the messages sent to the AI provider for analysis when you use the Document Assistant (see Document Assistant and artificial intelligence).

Security measures we apply:

• HTTPS on all pages, with HSTS enabled;
• passwords stored only as salted hashes;
• sign-in is temporarily locked after repeated failed attempts;
• limits on the number of requests;
• access rights checked on every request to a document or spreadsheet;
• modern browser security headers.

No system is perfectly secure. Use a strong, unique password and don’t share it. If you notice suspicious activity in /Profile/Logs, change your password and contact support.

Who we share data with

We do not sell personal data and do not give it to advertisers. Data is received only by:

• Payme and Click — the payment amount and transaction details, when you pay for a subscription. Your card data is entered directly on their pages.
• Google and Telegram — only if you choose to sign in with them. Their handling of your data is governed by their own privacy policies.
• The AI provider — only when you use the Document Assistant: the text of your messages, with passport, PINFL, card and phone numbers and similar data hidden, to understand your request.
• Other users — only the files you choose to share with them, with the access level you set.
• State bodies — only when disclosure is required by the law of the Republic of Uzbekistan.

Staff access to your files

Authorized administrators of the Operator can open a user’s documents in read-only mode. They do this only:

• for technical support, at your request;
• to investigate a security incident;
• when required by law.

Administrators do not change your files and do not view them for any other purpose.

How long we keep data

When you delete your account

Account deletion is currently done through a request to support. When the account is deleted, we delete your documents, spreadsheets, shares, API keys and devices, subscriptions, activity log, dictionary words, Document Assistant conversations and document drafts. Payment records are kept as required by accounting law. Analytics sessions expire within their 400-day period.

Your rights

Under the Law “On Personal Data”, you have the right to:

• know and access — get information about what data we process and receive a copy of your account data;
• correct — update your name and phone number in the profile or change your email (a confirmation is sent to the new address and a notice to the old one);
• delete — ask us to delete your account and data;
• withdraw consent — this means deleting the account, because the service cannot work without the basic data;
• complain — to the authorized state body in the field of personal data or to a court, if you believe your rights have been violated.

You can download your files at any time: documents in DOCX, RTF, TXT or HTML format, spreadsheets in XLSX. On request we will provide a copy of your account data.

To exercise your rights, write to info@uzoffice.uz from the email address linked to your account, or use the other channels on the Contacts page. We may ask you to confirm that the account belongs to you.

Children

The service is intended for people aged 16 and over. Persons under 16 may use it only with the consent of a parent or guardian. If you learn that a child under 16 has registered without such consent, contact us and we will delete the account.

Changes to this policy

We may update this policy when the service or the law changes. Where reasonable, we will announce material changes in advance by email and/or on the site. The date of the latest update is shown at the top of this page.

Contacts

Operator

MIMAX SOFTWARE GROUP, Tashkent, Republic of Uzbekistan

Support and privacy requests

info@uzoffice.uz

Telegram channel

@UzOfficeOfficial

Telegram

@uzoffice_supportbot

All contact options are also listed on the Contacts page.