Privacy policy

Your data is processed by Төгс форматив бридж ХХК (the “Operator”). The Operator's address and contacts are shown at the top of the page; requests about personal data go to the e-mail given there.

Data is collected only as far as a specific purpose needs:

• Account: name (a legal entity's name and registration number), phone number and whether it is verified, e-mail (if you signed up with one), chosen language. Your password is kept only encrypted; we can't see it.
• Profile: photo, cover, description, address, website, education, work experience — if you add them.
• Services: description, price, photos, contact phone, place (aimag, district, khoroo, address), a point on the map.
• Requests: message, phone number, address, a point on the map, the wanted date, photos.
• Reviews, comments, posts (photos, video), saved listings, likes, complaints.
• Payments: amount, date, the QPay transaction number. We don't receive your card or bank details — QPay and your bank process them.
• Records of TsogtsCoin and places for listings and posts.
• Consent records: which version of which document you accepted, and when.
• Technical data: sign-in log (IP address, time), a hash of your network address (against too many attempts, to count views), browser cookies (section 11).

If you don't give a required detail, the feature that needs it (signing up, verification, payment, for example) can't be used; the form says why.

• to create accounts, recognise users and provide the platform's services: listings, requests, reviews, posts;
• to connect providers and clients;
• to keep records of TsogtsCoin and places, take payments and issue eBarimt receipts;
• to protect against fraud, spam and attacks, and handle requests and complaints;
• to show providers their listings' statistics (views, calls);
• to meet our duties under the law.

We don't sell your data or share it for advertising or third parties' marketing.

Everyone: name, profile photo, description, your listings (the phone and place in them), reviews, posts. The place where a service is given is shown approximately to people who aren't signed in. Keep this in mind when choosing what to make public.

Only the other side of a request: the phone, address, map point, message and photos in it.

As far as the service can't be given without it, these companies process data on our behalf:

• Supabase Inc. — database, sign-in, file storage (servers in Singapore);
• DigitalOcean LLC — web server (in Singapore);
• QPay (Mongolia) — payments, eBarimt;
• Verify.MN (Mongolia) — phone number verification;
• OpenStreetMap Nominatim (Europe) — finding the address of a point marked on the map;
• OpenFreeMap (Europe) — map tiles; your browser connects to it directly.

If verification through DAN is added, we will list it here and ask for your consent first. To state authorities only on the grounds and in the way the law sets.

The platform's database and server are in Singapore, so your data is kept outside Mongolia. You give separate consent to this when you sign up (personal data protection law, Art. 14.1). If the servers move, the protection duties in this policy remain.

All connections are encrypted (HTTPS), and the providers follow international information security standards. We don't collect sensitive data such as health or biometrics.

• Account, profile, listings, posts — while the account exists. When you delete your account, your name, phone, photos, descriptions and places are deleted at once.
• Your requests and reviews with other people stay in their history without your name (phone, address and messages are deleted).
• Payments — for the period set by the tax and accounting laws.
• Consent and security records — as long as needed to prove consent and settle disputes.
• Phone verifications — 7 days; address hashes against too many attempts and for counting views — up to 2 days.
• Backups — up to 7 days; the server's technical logs — up to 30 days.

If data can't be deleted on request because the law requires keeping it, we explain why. Data with no further reason to be kept is deleted or anonymised.

Under Art. 16 of the personal data protection law you may:

• get a free electronic copy of your data — “My account” → “My data”;
• correct wrong data — when editing your profile;
• have your data deleted and withdraw consent — by deleting your account under “My data”. Without consent the platform can't be used, so the account is deleted. Withdrawing consent doesn't make processing done lawfully before it unlawful;
• ask how your data is processed and complain — through the contacts in section 12, or to the National Human Rights Commission or a court.

We answer within 15 working days.

Passwords are kept encrypted, all connections use HTTPS, only the server reaches the database, access to data is limited to what each role needs, admin rights are checked on every request, and backups and technical logs are kept.

If data leaks, we limit the risk, find the cause, tell the people affected at once and report to the bodies the law names. Keeping your password, phone number and verification means safe is your duty.

Only people aged 18 or older may use the platform. If we find that someone under 18 has signed up, the account is deleted.

• sign-in cookies — to keep you signed in;
• your chosen place and language — to show search for your place;
• your approximate (rounded) location, if you allowed “Nearest first” — to work out distances.

We don't use advertising or third-party tracking cookies.

Send requests and complaints about personal data to the e-mail at the top of the page.

If the policy changes, we publish the new version before it takes effect and ask every signed-in user to accept it again. The date it takes effect is at the top of the page.