What we collect, why, who we may share it with, and what rights you have. Written in plain language and matching the real SOBIRA architecture.
Operator
Name: to be provided
BIN/IIN: to be provided
Address: to be provided
Country: Республика Казахстан
Legal contact: to be provided
Personal data contact: to be provided
Support: /support
Who the operator is
The operator of personal data is the entity shown below. The personal-data contact and the support link are in the same block.
What data SOBIRA may process
Account: name, phone, email, account ID, authorization data, social OAuth ID (if used).
Profile: avatar, age, gender (if provided), language, description, status, rating, public profile information.
Social features: friends, close friends, posts, likes, comments, favorites, reviews, blocks.
Plans: created plans, participation, applications, application statuses, meeting point, activity location, dates, time, change history.
Location: the city chosen by the user, points on the map, event coordinates. SOBIRA obtains the precise device location only after user permission and only when needed. SOBIRA does not keep a continuous history of coordinates.
Communication: direct messages, support messages, reports, correspondence with administration, notifications.
Status verification: if the user voluntarily applies to confirm a status — application details, supporting materials and the verification result. SOBIRA does not collect identity documents without a separate need and legal basis.
Financial data (after payments launch): transaction amount, transaction status, transaction or payment provider ID, commission, refund, dispute, technical transaction history. SOBIRA does not store full bank card data when it is processed by the payment provider.
Technical data: IP, user-agent, device, browser, language, session identifiers, security logs, date and time of actions, cookies required for the site to work.
What data is used for
Account creation and authorization; profile operation; plan creation; event matching and display; application processing; messages; notifications; reviews; reports; fraud prevention; security; moderation; support; payment operations after launch; legal compliance; improving SOBIRA based on aggregated and anonymized data.
SOBIRA does not use data “for any purpose” — only for the purposes listed above.
Public and non-public data
Only data you publish as public becomes public: an open profile (name or display name, avatar, description, rating, status), posts, public plans, reviews and comments.
Phone, email and service data do not become public automatically.
Sharing with third parties
SOBIRA may engage contractors to operate the platform. Data is shared only to the extent necessary for the relevant function.
- hosting and infrastructure;
- SMS and email;
- maps;
- push notifications;
- authentication providers;
- payment providers;
- antifraud and security;
- state authorities — on a lawful basis.
The concrete list of actually used processors is kept in the platform configuration registry so this document can be updated without searching the project. SOBIRA does not sell personal data.
Maps: Google and 2GIS
SOBIRA may use external map services, including Google Maps and 2GIS. When a map loads, data may be processed by the relevant service under its own rules.
Depending on the map provider enabled in a given deployment, map-service data (for example the IP address and coordinates) may be transmitted to the relevant provider.
Cross-border transfer
If any contractor receives data outside Kazakhstan, this is reflected in the personal-data processing consent. SOBIRA does not hide such transfer.
Data storage
The primary SOBIRA personal-data database must be located in the Republic of Kazakhstan. The primary personal-data database is not moved to a foreign server without a separate legal review.
Data is stored only as long as it is needed for the stated purpose, contract performance, dispute resolution, security, or mandatory legal requirements.
Account deletion
The user may request account deletion via /support.
After deletion, the public profile is deleted or anonymized according to business logic; optional personal data is deleted.
Data that SOBIRA must keep by law or for an unresolved dispute or operation may be kept for the necessary time, then deleted or anonymized.
User rights
The user may request: access to their data, correction, completion, deletion, restriction or termination of processing where applicable, withdrawal of consent, and information about processing.
Requests go through /support.
Withdrawal of consent
Withdrawal of consent does not automatically destroy information whose retention is required by law or necessary for an unfulfilled obligation.
Security
SOBIRA applies reasonable technical and organizational measures to protect data. No system can be “absolutely secure”, so we make no such promises.
Incident
In the event of a personal-data breach, SOBIRA notifies the user when required by applicable law.
Changes
Every version of the document has a date and a number. Material changes require re-acceptance.