Privacy Policy

1. Who we are and who controls your data

PayBills is operated by CentralPay Hub LLC, a limited liability company registered in Tashkent, Republic of Uzbekistan, taxpayer identification number (STIR) 313 056 856, state registration certificate dated 20 May 2026. Registered office: Tashkent, Yashnabad district, Mashinasozlar mahalla, Mavlono Riyoziy street, 1st lane, Uzbekistan. CentralPay Hub LLC is the data controller responsible for your personal data when you use PayBills. For any privacy question, contact us at support@paybills.uz.

2. What data we collect

We collect only what we need to provide the service:

• Account data - your first and last name, your email address, a hashed (not readable) password, your chosen language, your billing country, and your card charge currency. If you add and verify a phone number, we store that too.

• Contact data - anything you send us through support or chat.

• Payment metadata - the provider you paid, the account or card number you paid to, the amount and currency, timestamps, transaction and receipt IDs, and refund or chargeback status. The number you are paying to is kept only for as long as the payment needs it, and after that only its last 4 digits remain. The card you pay with is a separate thing: we never store its number - only non-sensitive details such as the card brand and the last 4 digits.

• Device and technical data - your IP address and the approximate location derived from it (country, region, city), your internet provider or network operator, device characteristics (model, operating system, screen size, time zone, language, browser and graphics details) that together form a device fingerprint, a random app-install identifier, the app version, and your sign-in history (when, and from which network and device). We use these for security and fraud prevention - for example to alert you when your account is accessed from a new device, to block stolen-card payments, and to detect accounts created for fraud. We cannot and do not read hardware network addresses (MAC), your contacts, or your precise GPS location.

• Usage data - the pages you view and the actions you take. On our website this is recorded with our own cookie (see section 10): which pages were opened and when, the site or campaign that referred you, and the approximate location, browser and device already described above. We use it to prevent fraud, to see which pages and campaigns bring people to PayBills, and to decide what to build next. It is never joined to your card details.

3. How card data is handled

When you pay, your card details are entered on and passed directly to the regulated card acquirer / payment gateway that charges your card. PayBills never stores your full card number, expiry date, or CVV. Card processing follows the security requirements of the Visa and Mastercard card networks (PCI DSS). The account or card number you are paying to is a different thing - you type it into the payment form yourself, we keep it only for as long as the payment needs it, and afterwards only its last 4 digits remain.

4. How we use your data

We use your data to: process and deliver your bill payments; issue receipts; provide customer support; prevent fraud, money laundering, and chargeback abuse; comply with our legal obligations; improve and secure the service; and send you service-related messages (such as payment confirmations and refund notices).

5. Legal basis for processing

We rely on the following bases, and each one covers a specific thing we do.

• Performance of a contract. Creating your account, taking your card payment, sending the payment instruction to the provider in Uzbekistan, issuing your receipt, and answering support questions about a payment. Without this data we cannot do the thing you asked us to do.

• Legal obligation. Keeping transaction, payment and identity records for as long as Uzbek financial, anti-money-laundering and tax law requires, and responding to lawful requests from authorities.

• Legitimate interests. Preventing fraud and card abuse, keeping accounts and payments secure, debugging and keeping the service running, and the first-party website analytics described in section 10. We have weighed these against your interests: that analytics counts visits to our own site, is never shared with advertising networks, and switches itself off for you if your browser sends a Global Privacy Control or Do Not Track signal.

• Marketing email. When you create an account we add your address to our marketing list, and the signup screen tells you so before you do it. We rely on your ongoing choice not to opt out rather than on a separate consent, so every message carries an unsubscribe link, the preference centre lets you switch each kind of message off, and switching them all off affects nothing about your account or your ability to pay bills. Marketing is the only thing we handle this way.

If you object to processing we base on legitimate interests, write to support@paybills.uz and we will stop unless we have a compelling reason we can explain to you.

6. Who we share data with

We share data only with the parties needed to run the service:

• Paynet - the Uzbek bill aggregator, which receives the payment instruction and the account number to be paid.

• The card acquirer / payment gateway - which receives your card data in order to charge the card.

• Infrastructure and hosting providers, including Cloudflare - for hosting, content delivery, and security.

• Resend - sends our service and marketing email, and so receives your email address and name.

• Customer.io - our lifecycle messaging tool, which receives your email address and a record of your payments so the right message reaches you at the right time.

• Twilio - delivers SMS verification codes, and so receives your phone number.

• Telegram - only if you choose to sign in with Telegram or use our Telegram Mini App.

Each of these acts on our instructions and may use your data only to provide that service to us.

We do not sell your personal data. We share only what is necessary for each party to do its job, and we disclose data to government authorities only where we are legally required to.

7. International data transfers

Many of our users live in the USA, the UK and the EU, while CentralPay Hub LLC is established in Uzbekistan and our service providers operate globally. Your personal data is therefore transferred to and processed in Uzbekistan and in other countries. Uzbekistan is not covered by a European Commission or UK adequacy decision, so rather than say we act in line with applicable law, here is what each transfer actually relies on.

• The payment itself. To pay a bill in Uzbekistan, the account number and the payment details have to reach Paynet and the provider in Uzbekistan. That transfer is necessary to perform the contract you entered into when you asked us to pay that bill, and that necessity is the basis we rely on for it (GDPR Article 49(1)(b) and its UK equivalent). There is no way to pay an Uzbek bill without sending the data to Uzbekistan, so if you do not want that transfer to happen, do not submit the payment.

• Our service providers. For the processors named in section 6 we rely on the standard contractual clauses approved by the European Commission, which form part of the data processing terms we are on with each of them, together with the technical measures described in section 9.

Uzbek data protection law may give you less protection than the law where you live, and the rights in section 11 can be harder to enforce against a recipient outside your country. If you want to know what applies to a specific transfer, email support@paybills.uz and we will tell you.

8. How long we keep data

We keep your account data while your account is active, and it does not disappear the moment you close the account: the remaining details stay with the closed account so a complete record exists if a payment is disputed later. You can ask us to erase everything the law does not require us to keep, and we do that within 30 days of your request. We keep transaction and payment metadata for the period required by Uzbek financial, anti-money-laundering, and tax law. Support data is kept for a shorter period. After the applicable period ends, data is deleted or anonymized.

9. Your privacy rights

Depending on where you live, you have rights over your personal data, including the right to access it, correct it, delete it, restrict or object to its processing, receive it in a portable form, and withdraw any consent you gave. Residents of the EU and UK may also complain to their data-protection supervisory authority. Residents of US states have the rights granted by their state privacy law. To exercise any right, email us at support@paybills.uz - we may first verify your identity to protect your account.

10. Cookies and local storage

PayBills uses first-party cookies only - set by us, read only by us, and never handed to an advertising network or a third-party analytics service.

• Essential storage - your language preference, your sign-in session, and the service-worker cache that makes the app load quickly.

• Website analytics - two cookies on paybills.uz: "pb_vid", kept for up to 400 days, and "pb_sid", which lasts 30 minutes and is extended while you keep reading. Each one holds a random identifier and nothing else - no name, no email address, no payment data. It is not anonymous forever, though: when you sign in we link that visitor identifier to your account, so we can tell which page or campaign led to a signup. They let us count how many people visit, tell a returning visitor from a first-time one, and see which pages and which campaigns bring people here. They are not set on the staff admin area, and we do not record the query string of a page address, so anything you type into a form stays out of these records.

We do not use advertising cookies and we run no third-party tracking scripts. You can refuse or delete these cookies at any time in your browser settings, or by clearing your browser or app data - PayBills works normally without them.

11. Children

PayBills is not directed to children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@paybills.uz so we can remove it.

12. Security

We protect your data with HTTPS encryption in transit, hashed passwords, no storage of the card you pay with, AES-256 encryption at rest for the payment details you enter, strict limits on how long we keep them, internal access controls, and ongoing fraud monitoring. Honestly, though, no method of transmission or storage is 100% secure, so we cannot guarantee absolute security - please keep your password and one-time codes confidential.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and through an in-app notice. The effective date shown at the top tells you when the current version took effect.