Hamkosa Privacy Policy
In short
- Hamkosa is a service that helps office colleagues order lunch together. The operator is Muxamedjanov Ruslan Olegovich, email [email protected].
- We process only what is needed to put an order together and split the bill: your Telegram profile, the dishes you choose, amounts and payment marks.
- We do not sell data, show ads, or share names, Telegram IDs or card numbers with food delivery services.
- Data is stored with our hosting provider Railway in the USA and in Telegram in the Netherlands.
- To find out what we store about you or to have your data deleted, write to [email protected]. We reply within 10 days.
1. Who we are
The operator and owner of the personal data database, responsible for processing personal data, is Muxamedjanov Ruslan Olegovich, an individual, Republic of Uzbekistan. Email: [email protected]. We will provide a postal address on request.
This policy covers the whole Hamkosa service: the Telegram bot, the mini app, the browser extension and the website. It describes how the service works now. Personal data is processed under the Law of the Republic of Uzbekistan "On Personal Data".
2. What data we process
- Telegram profile — Telegram ID, name and username. Telegram provides them when you use the bot.
- Orders and payments — the dishes chosen, their quantity and prices, amounts due, marks of payment and of receiving the order. The organizer's bank card number, if the organizer entered it.
- Opinions and feedback — votes for a restaurant, lunch ratings, ideas and bug reports; for bug reports — the screen, app version and device.
- Company data — the name of the work group, the office address and its location on the map, who is the admin and who is the organizer.
- Technical data — a log of actions in the service, a log of the bot's private messages (to whom and when, without the text), mini app sessions and connected extension devices.
Apart from the Telegram profile, all data is entered by you or your colleagues, or appears as you use the service. We do not process special categories of data such as biometrics. We do not receive passwords to food delivery accounts or payment data, other than the organizer's card number.
Data is processed automatically: collected, recorded, stored, used and deleted.
3. Why and on what basis
| Purpose | Basis |
|---|---|
| Put a shared order together, split the bill, remind about transfers, choose a restaurant | performance of the user agreement |
| Show the organizer's card number to participants | the organizer's consent; the setting can be turned off and the card deleted |
| Send you private messages | your consent; withdrawn by stopping the bot |
| Review ideas and bug reports, understand where to order next time | the operator's legitimate interest |
| Find failures and protect the service | the operator's legitimate interest |
We will ask for separate consent for any new purpose.
4. Who sees your data
- Participants of the same order — your choice and your share. Only overall totals are posted in the group, without amounts or ratings by name.
- The organizer — amounts, payment marks and ratings for their own orders.
- The organizer's card number — participants of their orders, and only if the organizer has turned this on.
- Company admins — their own company's data.
- Food delivery services Uzum Tezkor and Yandex Eats — the cart contents and the office delivery location. Names, Telegram IDs and card numbers are not shared with them. The organizer places the order with their own account under the service's rules.
- Our providers: Railway — server and database hosting (USA); Telegram — bot messages and an encrypted database backup (the Netherlands); Cloudflare — the website only.
- Public authorities — only when required by law.
We do not sell personal data or use it for advertising.
5. Where and how long we store data
Data is stored in the USA and the Netherlands. These countries are on the list of countries ensuring adequate protection of personal data subjects' rights (Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 415 of 29.07.2026); the USA is listed for companies participating in the EU-U.S. Data Privacy Framework, which includes Railway.
- Data is kept while the company uses Hamkosa.
- At the request of a person or a company admin, we delete data from the database within 10 days and from backups within 30 days.
- Server logs are kept for no longer than 30 days.
6. Browser extension
The extension is needed only by the organizer.
- It works only on uzumtezkor.uz and eats.yandex.com and exchanges data only with the Hamkosa server. It does not see browsing history or other websites.
- It puts the collected order into the website's cart and reports to the server what ended up in the cart: dishes, quantities, total.
- To check the transfer and investigate failures, it sends a snapshot of the cart and the cart page after a transfer and when the button is pressed. The snapshot is kept in server logs for no longer than 30 days.
- It checks only whether you are signed in to the food delivery account. It does not store or transmit sign-in data.
- It does not place or pay for orders and does not see payment data.
- It stores its device key and its own settings in the browser.
7. Your rights
You can:
- find out which of your data we process, why and with whom we share it;
- have inaccurate data corrected — we correct it within 3 days;
- request deletion of your data or that we stop processing it;
- withdraw your consent;
- appeal our actions to the authorized state body or to a court.
Write to [email protected] and include your Telegram username. We reply within 10 days. To stop the bot from messaging you privately, simply stop or block it in Telegram.
8. Security
Connections to the server use HTTPS only. Sign-in to the mini app is verified by Telegram's signature, and access keys are stored only as hashes. The backup is encrypted. Only the operator has access to the database. In case of a data breach, we will notify the authorized state body within the time limits set by law and inform affected people through the bot.
9. Website
The website does not use cookies, visitor counters or third-party services.
10. Age
Hamkosa is intended for office employees aged 18 and over.
11. Changes and language
The current version is always available at the address of this page; previous versions are available at addresses with the version number. The bot will announce significant changes in the groups where it works.
This policy is drawn up in Russian; the Uzbek and English texts are translations, and in case of any discrepancy the Russian text prevails.