Starter draft. This document covers the baseline requirements for a SaaS service operated from Uzbekistan, but you should have it reviewed by a lawyer before public launch — especially regarding the Republic of Uzbekistan Personal Data Law of 02.07.2019 No. ZRU-547, payment data handling and subprocessor agreements (SMS, hosting, analytics).

1. Who we are

CWash (“we”, “us”, “our”) is a SaaS platform for carpet cleaning business automation. The service is operated by CWash LLC, Tashkent, Republic of Uzbekistan.

If you have any questions about how we handle personal data, contact us: info@cwash.uz or via Telegram @cwashuz.

2. What data we collect

From carpet cleaning administrators and staff (our B2B customers):

  • Name, email, phone number at registration
  • Carpet cleaning business name, branch addresses
  • Employee credentials (login, roles)
  • Technical data: IP address, browser type, access timestamps
  • Activity within the product: orders, shifts, reports — required to run the service

From end customers of carpet cleaning businesses (B2C, via our customer):

  • Name, phone, address — required for order logistics
  • Order history within a specific carpet cleaning business

We do not collect data directly from end customers, and we are not responsible for how a carpet cleaning business collects consent from them. That obligation belongs to our customer.

3. Why we use the data

PurposeLegal basis
Providing the serviceContract
Support and communicationsContract and legitimate interest
BillingContract and law
Security and abuse preventionLegitimate interest
Product improvement analyticsConsent
Marketing messagesConsent, revocable at any time

4. Who we share data with

We work with the following categories of subprocessors (full list on request):

  • Hosting and infrastructure — to run the service
  • SMS gateway — to deliver order status notifications
  • Payment providers — to process tier payments
  • Analytics — Google Analytics 4, Yandex.Metrica (only when you’ve given consent for cookies)

All subprocessors are bound by agreements requiring them to process data only on our instructions and within the law.

We do not sell your personal data.

5. Where data is stored

Data is hosted on infrastructure located in Uzbekistan and/or the EU. If data is transferred outside Uzbekistan, we ensure protection at a level no lower than required by ZRU-547.

6. How long we keep the data

  • Account data — while you use the service, plus 12 months after closure for accounting and dispute purposes.
  • Backups — up to 90 days after deletion.
  • Logs — up to 12 months.
  • Marketing consents — until you withdraw them.

7. Your rights

Under ZRU-547 you have the right to:

  • Access your personal data
  • Correct inaccurate or incomplete data
  • Erase data (“right to be forgotten”) where no counter-obligation applies
  • Restrict processing
  • Withdraw marketing or analytics consent
  • Lodge a complaint with the State Personification Agency of the Republic of Uzbekistan

To exercise your rights, write to info@cwash.uz. We respond within 30 days.

8. Cookies and analytics

We use cookies for:

  • Service functioning (login) — cannot be disabled
  • Analytics (Google Analytics 4, Yandex.Metrica) — only with your consent
  • Marketing (Telegram pixels, retargeting) — only with your consent

You can give or withdraw consent at any time via the cookie banner on the website.

9. Security

We apply technical and organisational measures to protect data: encryption in transit (TLS), password hashing, role-based access control, regular backups. Nevertheless, no online service can guarantee 100% security.

10. Children

The service is not intended for individuals under 18. If you are a parent and believe we received a child’s data without consent, contact us and we will delete it.

11. Changes to this policy

If we change this policy, we will update the date at the top and notify you by email (if you have an account) or via a banner on the website 30 days before changes take effect.

12. Contact

Last updated: 30 May 2026.