Privacy Policy

Last updated:

This policy explains what personal data the mimoram.uz website and its related services — app.mimoram.uz (the furniture sellers’ panel), door.mimoram.uz (the door sellers’ panel) and their server — collect, why, and how it is used.

Who is responsible

The MIMORAM AI team is responsible for processing your data. For questions and requests:

What we collect and why

  • Account. Your phone number, to recognise you and send the sign-in code. The code is stored in the database only as a hash and is valid for 5 minutes. Until the SMS channel is switched on, a code message that did not go through Telegram is written, with the number, to the server log. Each session records an IP address and browser details (user agent); each code request records the number, IP address and time, for security and for the limits on sending codes.
  • Telegram bot. If you share your number with the bot: the phone number and your Telegram chat and user IDs. Used only to send the sign-in code to Telegram.
  • Early-access survey. Your answers, the contact details you leave (name, company, Telegram, phone, email), your consent to receive news, and technical data: UTM tags, the page you came from and the browser type. We also record that the survey was opened, started and finished. The server scores your answers automatically, and the team uses the score to decide whom to contact first. The purpose is to grant early access, get in touch with you and improve the service. If you share your early-access card link, anyone who opens it sees the first word of your name, your seat number and the card type.
  • Studio projects. If you are signed in: the project name and the room scene (walls, items, materials), to save the project. The cover image stays in this browser. The plan image is not sent to the server: rooms are recognised in your browser.
  • AI planning. The text of your room description, to run the AI task; the description and the AI’s answer are kept on the server with the project (details below).
  • Early-access payment. The chosen tariff, your name, phone, Telegram or email, a promo code and the payment receipt (a photo or PDF), to check and confirm the payment. The site does not accept card details.
  • Sellers. The application and brand profile (name, description, logo, city, website, Instagram, Telegram, phone), product data and files, to add products to the catalogue and work with you. The brand name and products are shown to buyers in the catalogue.
  • Feedback. Your message and, if you choose, your name and phone, to reply and improve the service.
  • Actions MIMORAM staff take in the admin panel (who changed what, and when) are logged for security.

Who else processes data

We do not sell your data or pass it on for advertising. To run the service we use:

  • Vercel — hosting and delivering the mimoram.uz website.
  • A rented virtual server (VPS) — the API and database: accounts, surveys, projects, payments and seller data.
  • Cloudflare R2 — cloud file storage: receipts, seller files, product photos and 3D models.
  • Google (Gemini API) — AI planning.
  • Telegram — sending the sign-in code through the bot, if your number is linked to it.
  • An SMS gateway (Eskiz) — sending the code by SMS, when the SMS channel is switched on.
  • jsDelivr — your browser loads the text-recognition library used by plan import from this network. The plan image is not sent.
  • YouTube (youtube-nocookie.com) or Vimeo — only if you open the demo video.
  • raw.githack.com (GitHub) — your browser loads the lighting file for the homepage’s 3D room from this network.

Some of these providers are outside Uzbekistan, so data may be transferred abroad — only for the purposes listed in this section.

Cookies and browser storage

  • One necessary cookie, mimoram_refresh. Our API server sets it only once you sign in; it keeps your session and cannot be read by JavaScript (httpOnly). For an ordinary account it expires after 30 days without use and after 90 days at most; seller and staff accounts have shorter limits. Signing out deletes it.
  • Browser storage (localStorage, sessionStorage, IndexedDB) stays on your device: language and currency, the cart, projects, orders, plan images and covers, a copy of the catalogue, the survey draft and similar settings. You can remove it by clearing this site’s data in your browser settings; that also deletes the projects kept in this browser.
  • No advertising cookies or third-party analytics trackers are used.

AI processing

When you describe a room in the studio and ask the AI for a plan, only the description text goes through our server to the Google Gemini API. The answer is a list of items for the room, with their sizes and positions; the description and the answer are kept on the server with your project. Your phone number, contact details and plan image are not sent. Please do not put personal data in the description.

If you are not signed in, a simple planner in your browser makes the plan and nothing is sent. Recognising rooms in a plan image also runs in your browser and is not sent to an AI provider.

How long we keep data

Data is kept for as long as the service needs it and deleted on your request, unless the law requires us to keep it. A sign-in code is valid for 5 minutes; session limits are given above.

Your rights

Under Law No. ZRU-547 you have the right to:

  • know whether your data is processed, and access it;
  • have inaccurate or outdated data corrected;
  • ask for your data to be deleted (destroyed);
  • withdraw your consent;
  • complain to the authorised state body or a court if you believe your rights were violated.

To make a request, write to us on Telegram or by email and give the phone number linked to your account; we may ask for more details to confirm it is you. You can delete the data in your browser yourself, and signing out ends the session.

Security

The site and the API work over HTTPS only. Sign-in codes and session tokens are stored in the database as hashes, and the number of code requests is limited. Even so, no system on the internet can guarantee complete security.

Children

The service is meant for adults. If you are under 18, use it with the consent of a parent or guardian. If you learn that a child’s data reached us without consent, write to us and we will delete it.

Changes

We may update this policy. A new version is published on this page and the date at the top changes. We will point out significant changes separately on the site.

Contact

Questions and requests about personal data: