1. General provisions
This Privacy Policy (the Policy) sets out how «TAX AI» MCHJ (the Operator) processes the personal data of users of the soliq.ai website and the Soliq AI service (the Service): how it is collected, stored, transferred and protected.
The Policy follows the Law of the Republic of Uzbekistan No. ZRU-547 of 2 July 2019 “On Personal Data” (official text — lex.uz; the Law) and the instruments adopted under it.
By signing up, signing in with Google or using the Service, you consent to the processing of your personal data for the purposes and in the manner set out in this Policy, including its transfer to the third parties and abroad listed in section 6. Your consent remains valid until your account is deleted or you withdraw it.
2. Operator
Owner and operator of the personal data database:
- Legal entity
- «TAX AI» MCHJ
- Taxpayer ID (STIR)
- 313 197 894
- Registered address
- Toshkent shahri, Chilonzor tumani, Xalqlar Do‘stligi MFY, 6-mavze, 11-uy, 33-xonadon
3. What data we collect
- Account data: first name, last name, email, interface language. Your password is never stored in plain text — only its hash.
- Phone number — if you confirm it with an SMS code in Settings.
- If you sign in with Google — the name and email from your Google account.
- If you connect Telegram — your Telegram chat ID (to send sign-in codes).
- Business profile (optional): user type, organisation name, taxpayer ID (STIR), tax regime.
- Content in the Service: your chat questions and the answers, the documents you upload and the text extracted from them, document audit results, calendar reminders, your community questions and answers.
- Payments: order number, amount, number of coins, payment system, status and time. Bank card data never reaches the Service — it is entered only on the payment system's own page.
- Technical data: IP address, browser and device type, sign-in time — for session management (“Active devices”) and security.
We do not ask for, and do not purposefully process, special personal data (racial or ethnic origin, political or religious views, health and the like), biometric or genetic data. Please do not include such information in your questions or documents.
4. Why we use the data
- Providing the Service: creating your account and signing you in, preparing AI answers to your questions, analysing your documents, calculators and other features.
- Security: confirming sign-ins, two-step protection, fighting suspicious sign-ins and fraud.
- Payments and accounting: selling coins, confirming payments, keeping the records the law requires.
- Service messages: confirmation codes, security and payment messages, notices of material changes to the Policy or terms.
- Improving the Service: finding and fixing errors, checking the quality of answers.
Legal grounds for processing: your consent, performance of the contract concluded with you under the public offer, and obligations set by law (for example, keeping payment records).
Your data is not sold, not used for advertising and not given to third parties for purposes not stated in this Policy.
5. Where the data is stored
The Service's database and uploaded files are stored in the Republic of Uzbekistan — on servers in Tashkent. Backups are made on the same server.
Providers abroad receive only the data needed for the features listed in section 6.
6. Who receives the data
Some features of the Service work through external providers. Each receives only the data that feature needs:
- OpenAI (USA) — AI answers in chat and in the document audit: your question, the conversation text, attached files and document excerpts.
- Anthropic (USA) — analyses in the document audit: the text of the documents you select.
- Google (USA) — indexing text for search across documents and questions, reading images and files attached to the chat; if you choose “Sign in with Google” — confirming the sign-in.
- ElevenLabs or OpenAI (USA) — voice features: if you choose to listen to an answer or dictate a question, the relevant text or audio recording.
- Telegram — if you connect Telegram: sign-in and confirmation codes.
- Eskiz (Uzbekistan) — SMS confirmation codes: your phone number and the code.
- Payme and Click (Uzbekistan) — accepting payments: order number and amount. You enter card details directly with the payment system.
- To find official sources, search queries built from your question may be sent to lex.uz and public search engines (Bing, DuckDuckGo); no account data is added to them.
AI providers do not receive the name, email, phone number or taxpayer ID from your account. To tailor the answer, the user type, organisation name and tax regime from your profile may be sent. Personal information you write yourself in a question or document is sent along with the text — we recommend not including anything unnecessary.
Cross-border transfer is based on your consent under Article 15 of the Law. Google and ElevenLabs participate in the EU-U.S. Data Privacy Framework; Cabinet of Ministers Resolution No. 415 of 29 July 2026 lists the USA, for such companies, among the countries that ensure equal protection of personal data.
Providers process the data under their own terms of service and only to perform the feature concerned.
Data is disclosed to state bodies only in the cases and in the manner established by law.
7. Retention
- While your account is active — account data, conversations, documents and settings.
- If you delete an uploaded document or case, the file and the text extracted from it are removed from the server immediately. A deleted conversation disappears from your list at once; its copy on the server is destroyed when the account is deleted or at your request.
- On a request to delete your account or to withdraw consent, your personal data is destroyed no later than the business day after the day the request is received. Backups are refreshed daily and kept for no more than 2 days, so the data disappears from them within the same period.
- Payment records — for the period required by accounting and tax legislation.
- Server logs — for as long as needed for security and troubleshooting.
Once the purpose of processing is achieved, the data is destroyed, unless the law requires it to be kept (Article 17 of the Law).
8. Cookies and browser storage
The site uses only the cookies it needs to work: the sign-in session, “remember me” and the trusted-device mark (for two-step protection), the Google sign-in state and the chosen language.
No advertising, tracking or analytics cookies are used.
Settings such as the theme, panel state and the draft of a question are kept in your browser's local storage and are not sent to the server. If you disable cookies, you will not be able to sign in.
9. Your rights
Under the Law (Articles 13, 22, 24 and 30) you have the right to:
- know whether the Operator holds data about you and what it contains, and receive information on how it is processed, to whom and to which countries it has been transferred;
- have incomplete, outdated or inaccurate data clarified and corrected;
- demand that processing be suspended or the data destroyed;
- withdraw your consent at any time;
- refuse to provide data — in that case the features that depend on it may not work;
- not be subject to decisions based solely on automated processing: the Service makes no such decisions with legal effects about you, and AI answers are for information only;
- if you believe your rights have been violated, complain to the authorised state body or to a court.
You can edit your name, profile and settings yourself and delete conversations and documents yourself. Send any other request — including withdrawal of consent and deletion of data — from the email linked to your account to support@soliq.ai.
A request to correct data is fulfilled within 3 days (Article 11 of the Law); a request to delete data or withdraw consent — no later than the business day after it is received. If we refuse a request, we will give the reason in writing within 10 days.
If you withdraw consent, the features that require data (for example, AI answers) will stop working.
The authorised state body for personal data is the Department of Migration and Personalisation under the Ministry of Internal Affairs of the Republic of Uzbekistan (pd.gov.uz).
10. Data security
- All connections are encrypted with HTTPS (TLS).
- Passwords are never stored in plain text — only a hash produced with the argon2 algorithm.
- Two-step protection (authenticator app, SMS or Telegram) and the “Active devices” list — you can sign out an unknown device with one tap.
- Every request checks that the data belongs to you: one user cannot see another user's data.
- The database accepts connections only from within the server; backups are made daily.
- If data security is breached, we will notify you; we will report an incident involving cross-border transfer to the authorised state body within 24 hours (Cabinet of Ministers Resolution No. 415).
11. Minors
The Service is intended for people aged 18 and over. Data of a person under 18 may be processed only with the written, including electronic, consent of a parent or other legal representative (Article 21 of the Law). If we find that such data was entered without that consent, we will destroy it.
12. Changes to the Policy
If the Policy changes, the new version is published on this page with its date. We will notify you of material changes by email in advance.
The Policy is published in several languages; if the texts differ, the Uzbek text prevails.