Privacy Policy

Mehmonim is a software platform operated from Uzbekistan. In this Policy, “Mehmonim,” “Operator,” “we,” and “us” refer to the operator of the platform. Privacy, access, correction, deletion, and complaint requests may be sent to msf.mee@gmail.com or through the contact page.

This Policy applies to mehmonim.uz, localized pages, host and admin accounts, public and private invitations, RSVP forms, seating and arrival-number tools, event photo spaces, payment-proof workflows, and the Mehmonim Telegram bot.

For account administration, billing verification, service security, support, analytics, and legal compliance, the Operator determines why and how information is processed.

For guest lists, invitations, seating plans, RSVP fields, event photographs, donation details, and other event content selected by a host, the host determines what is collected and shared. Mehmonim processes that information to provide the host’s requested service and may separately process limited records necessary for security, fraud prevention, disputes, and legal compliance.

Account and host information may include name, email, authentication and session records, role, event/package selections, support communications, account activity, acceptance records, and payment-verification information.

Event and guest information may include event names and dates, venue and map data, couple or organizer names, guest names, phone numbers, Telegram usernames, invitation tokens, RSVP status, party size, comments, arrival numbers, table and seat assignments, guest-list imports and exports, and host-created messages.

Content and media may include invitation copy, photographs, guest-album uploads, audio, video, payment-proof images, file metadata, moderation status, and storage records. Hosts should not upload full payment-card credentials, identity documents, medical information, biometric data, or other sensitive data unless a feature expressly requires it and a lawful basis exists.

Telegram information may include chat and user identifiers, username, display name, bot commands, delivery status, subscription choice, payment notes, and uploaded payment proof. Technical information may include IP-derived request data, device/browser type, timestamps, routes, cookie identifiers, security events, response status, and aggregate usage analytics.

We receive information directly from account holders and guests, from hosts who import or enter guest data, from a user’s device and browser, from Telegram when a user contacts the bot, from service providers operating the platform, and from payment or fraud investigations where legally permitted.

A host who provides information about another person confirms that the host has authority or another lawful basis to do so and has delivered any notice or obtained any consent required by law.

We process information to create and administer accounts; build, publish, and deliver invitations; collect and display RSVPs; manage guest lists, seating, arrival lookup, event albums, and Telegram delivery; verify package payments; provide support; send essential service notices; and complete actions requested by users.

We also process limited information to secure the platform, prevent spam, fraud, duplicate submissions, unlawful access, and chargeback abuse; enforce the Terms; diagnose failures; preserve evidence; comply with law; and improve platform reliability and usability using aggregate or appropriately minimized analytics.

Depending on the context and applicable law, processing is based on consent, steps requested before a contract, performance of a contract, compliance with legal duties, protection of rights and lawful interests, or another basis permitted by law. Consent may be withdrawn, but withdrawal does not invalidate earlier lawful processing and may prevent a requested feature from working.

Content placed on a public event page may be viewed, copied, reshared, cached, screenshotted, or indexed by third parties. A private invitation, album, seating-map, or QR link is access-controlled by possession of the link or token, not by a promise that the recipient will keep it secret.

Arrival numbers and seating lookup are designed to reduce exposure of guest names, but hosts remain responsible for physical signs, printed maps, helper copies, screenshots, downloads, and anyone to whom they disclose those materials. Users must not publish private invitation tokens, payment proofs, admin links, or service credentials.

We may use hosting, database, authentication, storage, content-delivery, analytics, email, Telegram, monitoring, and security providers. They may process information only as needed to provide their services, subject to their terms and applicable safeguards.

We may preserve or disclose information where reasonably necessary to comply with law or a valid request; protect users, guests, the public, or the platform; investigate fraud, abuse, security incidents, intellectual-property complaints, or payment disputes; obtain professional advice; complete a merger, financing, asset transfer, or business reorganization; or enforce agreements. A successor must continue to protect personal information under applicable law.

We do not sell personal information or guest lists. Host exports and host-directed Telegram or invitation delivery are disclosures made at the host’s direction and responsibility.

Some infrastructure or service providers may operate outside Uzbekistan. Cross-border storage or processing is used only where permitted by applicable law and where required contractual, organizational, technical, or recognized safeguards are in place.

Data that applicable Uzbekistan law requires to remain in Uzbekistan will be handled in accordance with those localization requirements. The Operator may change providers or processing locations when lawful safeguards remain available.

Essential cookies and similar storage support authentication, session security, RSVP continuity, language or theme preferences, invitation-entry state, and unsaved builder drafts. Blocking them may prevent parts of the service from working.

When enabled, analytics tools such as Google Analytics may receive device, page, referral, interaction, and approximate location information under the provider’s terms. Optional analytics loads only after the user selects “Allow analytics”; the choice can be changed through Cookie settings. Browser controls may also restrict cookies or storage.

Telegram users who start or use the bot may receive transactional messages related to requested invitations, payment workflows, or account administration. Connected admins may receive payment-review alerts.

Promotional bot messages are sent only to users recorded as subscribed. A user may send /stop to disable promotional bot messages and /start to subscribe again. Opting out of promotions does not disable essential security, payment, or service messages. Telegram independently processes data under its own terms and privacy practices.

Information is retained while an account, event, invitation, album, payment review, or support matter is active and afterward for a reasonable period needed for legal obligations, accounting, security, fraud prevention, dispute resolution, enforcement, and business records.

Deletion may be delayed or limited where information is contained in backups, required by law, needed to establish or defend claims, connected to another person’s record, already made public or exported by a host, or technically necessary to preserve system integrity. Backup copies are isolated from ordinary use and removed or overwritten through normal retention cycles.

We use proportionate technical and organizational safeguards, including HTTPS, authentication, access restrictions, database authorization rules, private storage, tokenized links, logging, and restricted administrative workflows. No internet service, link, account, or storage system can be guaranteed absolutely secure.

Users must protect credentials and private links, use trusted devices, and notify us promptly of suspected compromise. We may reset sessions, revoke links, restrict access, preserve logs, or take other protective action without advance notice. Legally required incident notifications will be made to affected persons or authorities as applicable.

Subject to applicable law, a person may request information about processing and seek access, correction, suspension, deletion, withdrawal of consent, or protection of their lawful interests. The person may also contact the competent personal-data authority or a court.

We may verify identity, authority, invitation ownership, or account control before acting; request sufficient detail; deny or limit a request where law permits; and retain a record of the request. Guest-data requests may be referred to or coordinated with the relevant host because the host controls the event context.

The host must obtain legally valid consent from a parent, guardian, or other authorized representative before uploading or collecting personal information about a minor where required. Children must not independently create paid host accounts unless legally capable of entering the agreement.

Do not use Mehmonim to collect sensitive or special-category information unless strictly necessary, clearly disclosed, lawfully authorized, and supported by appropriate safeguards. We may remove or restrict such information at any time.

We may update this Policy when features, providers, ownership, security practices, or law change. The current version and effective date will be posted here. Material changes may also be communicated through the account, website, or another reasonable channel, and fresh consent will be requested where required by law.

The Uzbek version controls to the extent permitted by law if a translated version conflicts with it. Nothing in this Policy removes rights that cannot legally be waived.