qoima
Sign inStart for free

Privacy Policy

Version 1.0 · effective from 15 September 2026

This Policy explains how the qoima platform (the "Platform", "we") collects, uses, stores and protects personal data, and what rights the people whose data is processed have. It is drawn up in accordance with the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Its Protection" (the "Law").

1. Operator and contacts

The Platform is operated by IE Techstep (ИП Techstep), Republic of Kazakhstan (the "Operator"). For any question about personal data — including requests for access, correction, deletion or withdrawal of consent — write to [email protected]. We respond within the period set by the Law.

2. Whose data is processed, and by whom

qoima is a business-to-business service. Three parties are involved, with different roles:

  • The client company — a business that registered an account in qoima. In respect of its own employees' and customers' data, the client company is the owner and/or operator of that data and decides the purposes of processing itself.
  • The Platform Operator (we) — we process the client company's data and its users' data to provide the service, and the client company's customers' data on its instructions and in its interests, as a third party within the meaning of the Law.
  • The client company's customers — people whose contacts and orders the client company enters into the Platform, or who message it on WhatsApp. If you are a customer and have a question about your data, contact the company you dealt with; we assist it in fulfilling your request.

3. What data we process

  • User account data: name, email address, phone number, role in the company, password hash (passwords are never stored in plain text), two-factor authentication settings (the secret is stored encrypted), and the log of actions in the system.
  • Client company data: name, requisites (BIN/IIN, address, bank details for invoicing), product catalog, stock levels, orders, supplies, financial figures, and documents the company uploads.
  • Customer data entered by the client company: name, phone, email, address, requisites, order and settlement history, and the record of consent to receive WhatsApp messages.
  • WhatsApp channel data: if the client company connects its WhatsApp Business number, we process its Meta account identifiers, inbound and outbound messages (text, attachments, delivery statuses), the phone numbers of the people it talks to, and the service events Meta delivers by webhook. The WhatsApp Business API access token is stored encrypted and is never displayed again.
  • Payment data: when a subscription is paid by bank card, the card details are processed by the payment provider. The full card number is not stored on the Platform; we keep only the provider's token, the masked number and the payment history.
  • Technical data: IP address, browser and device type, request times, session identifiers, error records. These are needed for security, diagnostics and abuse prevention.

4. Purposes and legal bases

  • Providing the service under the contract with the client company: inventory, sales, orders, reporting.
  • Sending messages and notifications to customers via WhatsApp, email and SMS — only on the client company's instructions and, for WhatsApp, with the customer's consent (see section 5).
  • Invoicing and collecting subscription payments.
  • Security, fraud prevention and incident investigation.
  • Improving the service on the basis of anonymised usage statistics.
  • Compliance with the legislation of the Republic of Kazakhstan.

The legal bases are the contract with the client company, the data subject's consent (in particular for WhatsApp messaging), and the Operator's legitimate interests in the security and operation of the service.

5. WhatsApp and artificial intelligence

  • WhatsApp messages travel through Meta's WhatsApp Business Platform. Meta processes them under its own terms (WhatsApp Business Terms); qoima acts as a technology provider, and the WhatsApp Business account belongs to the client company.
  • A client company may initiate a conversation with a customer only with that customer's consent. Consent is recorded in the Platform together with how and when it was obtained and the version of the text the customer saw. A customer may withdraw consent by messaging the company on WhatsApp or contacting it in any other way.
  • The Platform may use artificial-intelligence models to translate product descriptions, to power semantic search over the catalog and — in future — to answer customers automatically in WhatsApp. For this, fragments of text (product descriptions, message text) are sent to the AI model providers listed in section 6. We do not send them payment data and we do not use client companies' data to train models. A customer is told that an AI assistant is in use at the start of the dialog.

6. Who we share data with

We do not sell personal data. Data is shared only with providers without whom the service cannot operate, to the extent their function requires:

  • DigitalOcean, LLC — server and storage hosting (data centre in Frankfurt, Germany).
  • Cloudflare, Inc. — network traffic protection and acceleration.
  • Meta Platforms, Inc. — WhatsApp Business Platform (messages, delivery statuses).
  • Resend, Inc. — email delivery (invitations, notifications).
  • SMS provider (when a company enables SMS notifications) — SMS delivery.
  • AI model providers (DeepSeek; for search — DeepInfra; for the assistant — Anthropic) — text processing for the purposes in section 5.
  • Payment provider (Freedom Pay or equivalent) — subscription payment collection.
  • Functional Software, Inc. (Sentry) — application error reporting.

Data may also be disclosed on a lawful request from the authorised state bodies of the Republic of Kazakhstan.

7. Where data is stored, and cross-border transfer

The Platform's servers and database are hosted in DigitalOcean's data centre in Frankfurt, Germany. The providers in section 6 process data in their own jurisdictions, including the United States and European Union countries. Processing therefore involves the cross-border transfer of personal data outside the Republic of Kazakhstan under Article 16 of the Law. The transfer is made on the basis of the data subject's consent and/or to perform the contract with the client company, to countries that ensure the protection of personal data. By registering in qoima, the client company confirms that it has obtained the necessary consents from its users and customers for such transfer.

8. Retention periods

  • Account and company data — for the duration of the contract and 3 years after it ends, unless the law sets a different period (for example, for accounting documents).
  • WhatsApp campaign history (campaigns and per-recipient delivery statuses) — 90 days, after which it is deleted automatically.
  • Inbound WhatsApp messages — for the duration of the contract; the client company may request earlier deletion.
  • Technical logs and error records — no more than 90 days.
  • Database backups are taken daily and kept for a limited period; deleted data disappears from them at the end of the rotation cycle.

9. How we protect data

  • All traffic is transmitted over HTTPS (TLS 1.2 and above).
  • Each company's data is isolated at the database level: access is restricted by company identifier, and row-level security policies prevent one company from seeing another's data.
  • Passwords are stored only as a cryptographic hash; two-factor secrets and WhatsApp tokens are stored encrypted.
  • The Operator's staff access data only on a need-to-know basis, and every access is logged — including any sign-in on behalf of a client company for support.
  • Access rights inside a client company are set by its owner; by default, employees are granted nothing.

10. Your rights

Under the Law you have the right to:

  • know which of your data is processed, and obtain access to it;
  • demand the correction of inaccurate data;
  • demand the deletion of data, or that its processing be blocked, where there is no basis for it;
  • withdraw consent to processing, including consent to receive WhatsApp messages;
  • appeal the Operator's actions to the authorised body for personal data protection.

Users of a client company send requests to [email protected]. Customers contact the company they dealt with; where needed, we carry out its instructions regarding your data.

11. Cookies and local storage

The Platform uses only strictly necessary cookies and browser local storage: to maintain the user's session, to protect against request forgery, and to remember interface preferences (language, table layouts). No advertising or tracking cookies are used.

12. Children

The Platform is intended for businesses and is not designed for persons under 18. We do not knowingly collect data of minors; if you become aware of such a case, please tell us.

13. Changes to this Policy

We may update this Policy when the service or the legislation changes. The current version is always published on this page with its version number and date. We notify client companies of material changes by email or in the Platform interface. This Policy is published in Russian, Kazakh and English; in the event of any discrepancy, the Russian version prevails.

14. Contacts

Operator: IE Techstep (ИП Techstep), Republic of Kazakhstan.
Email for personal-data matters: [email protected].