Privacy Policy

1. General provisions

This Privacy Policy (hereinafter — the "Policy") describes how Sheber ("we", "our", "the Company") collects, uses, stores, and discloses personal data of users of the Sheber mobile application (hereinafter — the "Application") and related websites.

By using the Application or registering on the platform, you agree to the terms of this Policy. If you do not agree with any of its provisions — please stop using the Application.

2. Data we collect

We collect the following categories of data:

• Account data: first name, last name, phone number, email address, profile photo.
• Masters' data: description of services, photos of work, documents (ID card, certificates) — for verification.
• Order data: task description, work execution address, date and time, chat history.
• Payment data: we do not store bank card data; payments are processed through TiptopPay. We only receive the payment status and transaction identifier.
• Device data: device type, OS, Application version, FCM token for push notifications, IP address.
• Geolocation: approximate location (city) for matching masters in your area. Precise geolocation is used only with your explicit permission.
• Usage data: actions within the Application, session duration, errors — in anonymized form for service improvement.

3. How we use your data

The collected data is used for:

• User registration and identification.
• Processing orders and communication between clients and masters.
• Verifying masters and ensuring platform security.
• Sending notifications about order status, new messages, and promotions (with your consent).
• Improving service quality and the master-matching algorithm.
• Detecting and preventing fraudulent activities.
• Compliance with the legislation of the Republic of Kazakhstan.

4. Sharing data with third parties

We do not sell or transfer your personal data to third parties for commercial purposes. Data may be shared only in the following cases:

• To other platform users: the client sees the master's name, rating, and photo; the master sees the order description.
• Service providers: Firebase (Google) — push notifications; Cloudflare — CDN and file storage; TiptopPay — payment processing; Meta (WhatsApp) — WhatsApp notifications with your consent.
• Upon legal request: in response to official requests from government authorities of the Republic of Kazakhstan.
• In case of restructuring: upon merger, acquisition, or sale of assets — with notification to users.

5. Data storage and security

Data is stored on servers in a secured infrastructure. We apply the following security measures:

• Data encryption in transit (HTTPS / TLS 1.3).
• Password storage as hashes (bcrypt).
• Restricted access to data for authorized personnel only.
• Regular security audits and backups.
• Private URLs for personal documents (presigned URLs with limited lifetime).

Data is stored for the entire duration of your account. After account deletion, data is anonymized or deleted within 30 days, unless otherwise required by law.

6. Push notifications and WhatsApp

The Application sends push notifications via Firebase Cloud Messaging (Google). You can disable notifications at any time in your device or Application settings.

WhatsApp notifications are sent only if you have explicitly given consent (the "Receive WhatsApp notifications" option) and only using templates approved by Meta. You can withdraw your consent in your profile settings.

7. Cookies

The mobile Application does not use cookies. Our website uses only technically necessary cookies to ensure session functionality and security. Analytics cookies are used only in anonymized form.

8. User rights

In accordance with the legislation of the Republic of Kazakhstan, you have the right to:

• Access: request a copy of your personal data that we process.
• Rectification: update or correct inaccurate data through profile settings.
• Erasure: request deletion of your account and associated data. Please note that some data may be retained in accordance with legal requirements.
• Withdrawal of consent: withdraw consent for data processing (e.g., receiving WhatsApp notifications) at any time.
• Complaint: file a complaint with the authorized body for personal data protection of the Republic of Kazakhstan.

To exercise your rights, contact us at: privacy@sheber.kz

9. Minors' data

The Sheber Application is intended for persons aged 18 and above. We do not knowingly collect personal data of minors. If we become aware of a registration by a person under 18, we will immediately delete such account.

10. Changes to the policy

We may periodically update this Policy. We will notify you of significant changes via push notification or email 7 days before the changes take effect. The last updated date is always indicated at the top of the document.

Continued use of the Application after the changes take effect means your agreement with the updated Policy.

11. Contacts

For questions related to personal data, please contact:

• Email: privacy@sheber.kz
• Support: support@sheber.kz
• Website: sheber.kz

We will respond to your request within 10 business days.