Privacy policy

This is a translation. If it differs from the Russian text, the Russian text prevails.

1. Who processes the data

LLC Vulpes Solutions Technology (OOO «Vulpes Solutions Technology»), taxpayer ID 307 460 626, develops the app and owns the website. Registered address: 47 Akhiilobad St., Tashkent. Postal address: office 9, 2B Yukori-Karakamysh St., Tashkent.

For requests sent from the website, we are the personal data operator. Data that a client organization processes in its Bitrix24 portal and in Didox belongs to that organization: it is the operator, and we process the data on its behalf and only to run the app (Article 31 of the Law of the Republic of Uzbekistan “On Personal Data”).

2. What data and why

• Bitrix24 portal: portal address and ID, the app’s access keys. Needed so the app can read and write CRM data when employees act. The keys are stored encrypted.
• Portal employees: Bitrix24 user ID, name, position, departments. Needed for roles and rights in the app. Roles store only IDs; the list of employees with names stays in server memory for no longer than 5 minutes.
• Didox companies: taxpayer ID or personal ID (PINFL), name, Didox sign-in password. Needed to create documents and get statuses on behalf of the company. The password is stored encrypted and never shown; the Didox session key stays in server memory for up to 6 hours.
• Documents and counterparties: party details (taxpayer ID or PINFL, name, address, bank details), full names and PINFL of directors, accountants, authorized and responsible persons, goods and amounts. Needed to build a document and send it to Didox. The document itself is stored in Didox; we keep its link to the CRM record, number, partner taxpayer ID, status and a checksum that prevents duplicates.
• Didox registry for BI reports — only if an administrator has turned BI reports on: for every incoming and outgoing document of the portal’s Didox companies — type, number, date, status and its changes, the counterparty’s taxpayer ID or PINFL and name, contract number, amount and VAT. Needed so the Bitrix24 BI Builder can build reports on documents; document contents and goods are not stored in the registry.
• Operation log: what the app did, when, and with what result. Passwords, keys and document contents are not logged; PINFL is masked.
• Website request: name, phone, company, portal address, chosen plan and comment. Needed to contact you about connecting. The IP address is not stored with the request.
• Website technical data: web server logs (IP address, time and requested address) to protect against attacks and investigate failures; session and form-protection cookies that live for 2 hours; your chosen color theme, kept in your browser. The website has no visitor counters or advertising cookies; fonts and videos load from our server.

E‑IMZO signing happens on the user’s computer: digital signature keys are never sent to or stored on the server. The app does not process biometric or genetic data.

3. Legal grounds

• the license agreement — to run the app on the client organization’s portal;
• your consent — for website requests: you give it by sending the form and may withdraw it at any time;
• legitimate interest — for logs and protecting the service from attacks and failures.

4. Where the data is stored

The app server, the database and backups are located in Tashkent, Republic of Uzbekistan. The Vulpes CRM that receives website requests is located there too.

5. Who receives the data

Only the services needed for what the user does, and only as much as they need:

• Didox (Uzbekistan) — documents, party details and statuses;
• your organization’s Bitrix24 portal — CRM record data; the portal is hosted in the region your organization chose;
• the IKPU classifier tasnif.soliq.uz (Uzbekistan) — the search text when picking a product or service code;
• open data orginfo.uz — the counterparty’s taxpayer ID when checking its reliability; the service’s servers are in Finland;
• the Vulpes sales team mailbox (Yandex 360) — a website request, if email notifications are enabled.

Outside Uzbekistan we transfer data only to countries that ensure adequate protection of personal data under the list approved by the Cabinet of Ministers (Resolution No. 415 of 29 July 2026); Finland and Russia are on that list. Bitrix24 portal data outside Uzbekistan is stored there by the choice of the organization that hosts the portal. Data is not sold and is not used for advertising.

6. Retention

• portal, Didox company and role data and document links — while the app is installed; they are deleted right after the app is removed from the portal;
• Didox registry for BI reports — while BI reports are on with the Professional plan: “Turn off BI reports” and removing the app erase it right away, a plan change or license expiry — within 10 minutes;
• operation log — 30 days, Didox exchange log — 7 days, technical logs — up to 14 days;
• website requests — 12 months, or earlier at your request;
• database backups — up to 30 days.

7. Your rights

You may find out which of your data we process, why, where it came from and who receives it; ask us to correct inaccurate data — we correct it within 3 days; withdraw consent and ask us to delete request data; ask us to suspend processing. If we refuse a request, we explain why in writing within 10 days.

We accept requests by email at support@vulpes.pro and at the postal address in section 1. If you are an employee or a counterparty of a client organization, please contact that organization about data in its Bitrix24 portal and in Didox: it is the operator, and we will help it fulfil your request.

You may file a complaint with the authorized state body for personal data protection (as of this version, the Department of Migration and Personalization under the Ministry of Internal Affairs of the Republic of Uzbekistan, pd.gov.uz) or with a court.

8. How we protect data

Connections use HTTPS only. Passwords, keys and tokens are stored encrypted. Employees of a client organization see documents according to their roles in the app; service administrators sign in with keys and two-factor verification. Passwords, keys and document contents never reach the logs. Backups are kept on a separate server with restricted access.

9. Changes

A new version is published at this address with its date. The current version is dated 24 October 2026.

Phone for questions: +998 55 518 86 66.