Personal data policy

Effective from 30 October 2026 · version 2026-10

1. Who processes the data

The operator of personal data of SDUNIO ID is SDUNIO, Republic of Uzbekistan. For any question about your data, write to support@sdunio.com.

This policy follows the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 02.07.2019. The data are stored in the European Union, so we also respect the rights given by the EU General Data Protection Regulation (GDPR).

2. What SDUNIO ID is

SDUNIO ID is one account for the SDUNIO projects: sign-up, sign-in and the account page. This policy covers the data of the account itself. What a particular project keeps (for example, your posts there) is described in its own policy.

3. What data we process

Account: name, email, password. The password is kept only as a hash; nobody sees it in plain text.
Profile, if you filled it in: phone, date of birth, avatar (the photo and its original), language.
Linked accounts: Telegram (id and username) and Google (id and email), if you sign in with them or link them.
Consents: what you agreed to, the version, the time and the IP address.
Service data: which projects you signed in to, your groups and roles in projects, sign-in sessions, the journal of sign-ins and account changes (time, IP address, browser).
Codes from letters: kept only as a hash, for 15 minutes.

4. Why

to create the account and let you into the SDUNIO projects with one sign-in;
to give the project you sign in to your profile: name, email, phone, date of birth, avatar, linked Telegram;
to send confirmation and sign-in codes (email, Telegram);
to protect the account: limit sign-in attempts, keep a journal, end sessions;
to answer your requests.

We do not sell data, show ads or send you mailings you did not ask for.

5. Legal basis

Your consent: you give it at sign-up by ticking “I agree to the processing of my personal data”. The time and version of the consent are shown on your account page (/account, “Consents”). For users in the EU the bases are also the performance of a contract (the account cannot work without these data) and the legitimate interest in protecting accounts from takeover.

6. Where the data are stored and cross-border transfer

The servers of SDUNIO ID are in France (EU), at the hosting provider OVHcloud. This means the data are transferred outside the Republic of Uzbekistan. They go to a country where the GDPR applies, which ensures adequate protection of the rights of data subjects (Article 15 of the Law). By giving your consent, you also agree to this transfer.

7. Who receives the data

Our own systems on these servers: the Keycloak authorization system (accounts, passwords, sessions), the MongoDB database (profile, consents, journal), the MinIO storage (avatars), the InnerBroadcast notification service and the SDUNIO mail server (letters with codes), the SDUNIO bot in Telegram (sign-in and linking Telegram).
SDUNIO projects you sign in to — the profile data from section 4.
Google (Google LLC, USA) — only if you sign in with Google: that sign-in happens on Google's side under its rules.
Telegram — only if you sign in with Telegram or link it: the bot writes to you in Telegram.
OVHcloud — hosting: the servers the systems above run on.
Public authorities — only when the law requires it.

The avatar opens by a direct link: projects show it to other people.

8. How long we keep it

account and profile data — while the account exists; if you deleted the account with the button on the account page — until you ask for full deletion, so that the account can be restored;
an unfinished sign-up — one day;
codes from letters — 15 minutes;
the journal of sign-ins and changes — 7 days;
“Stay signed in” — 30 days since it was last used.

9. Cookies

We use only necessary cookies, with no analytics, ads or third-party trackers:

INNERAUTH_SESSION — the sign-in session, up to 12 hours without activity;
INNERAUTH_REMEMBER — “Stay signed in”, 30 days;
INNERAUTH_LANG — the chosen language, 1 year.

If you sign in with Google, Google sets its own cookies on its own site under its own rules.

10. Your rights

to know what data we have about you and get a copy;
to correct them: name, phone, date of birth, avatar, language and password can be changed on your account page (/account), where you can also unlink Telegram and sign out everywhere;
to delete the account: the "Delete account" button on the account page (/account) closes sign-in to SDUNIO ID and every SDUNIO project at once; the data is kept so that the account can be restored at your written request;
to have the data fully deleted and to withdraw consent: write to us from your account's email. The account cannot work without consent, so withdrawing it means deleting the account and its data;
for users in the EU — also to restrict processing, to object to it and to receive the data in a machine-readable form.

Write to support@sdunio.com; we answer within the time set by law. You may also complain to the authorized state body for personal data protection of the Republic of Uzbekistan or to an EU supervisory authority (in France — the CNIL).

11. Changes to this policy

We publish a new version on this page with a new date. The version of the consent is stored with it; after significant changes we may ask you to confirm your consent again.