Privacy policy

1. Who processes the data

The personal data controller is Rasuljon Muminov, Dushanbe. Questions and data requests: Telegram @sanatplace, email xzrasul13@gmail.com.

This policy follows the Law of the Republic of Tajikistan “On Personal Data Protection” and describes how the sanatplace website handles its users' data.

2. What data we collect

Everyone who signed in with Telegram:

• Telegram ID (the account's numeric identifier);
• first and last name as given in Telegram;
• Telegram username, if there is one;
• registration date and role on the site (buyer or seller);
• the language of the site you signed in from (so the bot writes to you in it);
• works you have marked with a heart (wishlist), and when;
• conversations on the site: your messages, their time and read marks;
• technical sign-in records: the time of the request and of the confirmation. The one-time sign-in code itself is not stored, only its hash.

Sellers (artists), in addition:

• artist or studio name, “About you” text, Telegram contact (not published);
• profile photo, if you uploaded one (or the Telegram photo, if it was received earlier);
• information about works: photo, title, description, size, technique, year, price, status;
• moderation decisions: review dates and reasons for rejection.

Technical data: with every request to the site, the hosting provider records the IP address, the page address, browser information and the time. When someone tries to sign in to the administration area, the IP address is kept in the server's memory for a while to protect against password guessing.

Visit statistics: Vercel Web Analytics counts page views: the page address, where you came from, country, device type, operating system and browser. It uses no cookies and does not store IP addresses: visitors are not identified, and we only see the data in aggregated, anonymous form.

We do not collect phone numbers, email, addresses, passport or payment data. No payments are made on the site.

3. Why we process the data

• to create the account and allow signing in with Telegram;
• to show the artist's profile and works in the catalog;
• so that buyers and artists can message each other on the site, and our Telegram bot tells them about new messages;
• to review applications and works before publication;
• to keep the wishlist and show the number of likes on works;
• to show the site's texts in other languages;
• to protect the site from abuse and investigate technical failures;
• to understand from anonymous statistics which pages are useful, and to improve the site.

The legal basis is your consent, given when you sign in with Telegram (and, for sellers, also when submitting the application), and the performance of the Terms of use.

4. What others can see

• Buyers' data is not published. Artists and other users do not see who liked a work, only the total number of likes. An artist sees your Telegram name and photo only if you write to them on the site yourself.
• A seller's profile is public once the application is approved: name or studio name, “About you”, photo, the date they joined, works and number of likes. These pages are open to all visitors, indexed by search engines and shown in link previews in messengers and social networks. The seller gives separate consent to this in the application.
• Conversations are visible only to their participants. The Operator does not read them, except when a participant has complained about messages, or when the law requires it.

5. Who the data is shared with

We do not sell data and do not share it for advertising. The site relies on these services:

These services' servers are outside the Republic of Tajikistan, so using the site involves a cross-border transfer of data. By giving consent, you also agree to it. Data may also be disclosed on a lawful request of state authorities.

6. How we protect the data

• connections to the site and to the database are encrypted;
• sign-in is confirmed in Telegram; user passwords are neither used nor stored;
• the session is kept in a protected cookie that the page's scripts cannot read;
• metadata, including the GPS coordinates phones add, is removed from uploaded photos automatically;
• only representatives of the Operator have access to the administration area.

7. How long the data is kept

• one-time sign-in requests: up to 10 minutes, then deleted within a day;
• the session on a device: up to 30 days or until you sign out;
• account, profile and works data, conversations: as long as the account exists;
• technical logs: within the hosting provider's retention periods.

8. Your rights

You can:

• find out which of your data we keep and get a copy;
• correct your data. Your name and username are updated from Telegram at every sign-in; sellers change their profile in the cabinet;
• withdraw your consent and delete your account; your profile, works, photos and wishlist are deleted with it;
• appeal the Operator's actions to the competent authority or in court.

Write to us on Telegram @sanatplace or to xzrasul13@gmail.com from the Telegram account in question, or give its username. We reply within 30 days.

9. Cookies

The site uses only technically necessary cookies. Visit statistics (section 2) are collected without cookies, and there is no advertising or ad tracking, so no separate cookie consent is asked for.

10. Changes to this policy

We may update this policy. A new version is published on this page with the date of the change. If the changes significantly extend how data is processed, we will ask for consent again.