Privacy policy

Who we are

Heaven's Garden is a resort in Bostanlyk district, Tashkent region (hotel, villas, restaurant). This policy covers the heavens-garden.uz website and the "Heaven's Garden" mobile app (iOS and Android). Heaven's Garden is responsible for your data.

What we collect

• Bookings: name, phone number, email (optional), dates, number of guests, requests, arrival time. At check-in, reception may record the details of an identity document.
• Account: name, phone number, email (optional), password (only its hash is stored), language. If you sign in with Google or Apple — their user identifier and email (Apple may provide a private relay email).
• Restaurant orders: name, phone, table or room number, order items.
• Contact form: name, phone or email, message text.
• Online payment: amount, payer phone, the masked card number and receipt link returned by the payment provider. Full card details never reach us and are not stored.
• Technical data: IP address and an activity log (security and abuse prevention), sign-in session.

Cookies and on-device data

The website uses only the cookies needed to keep you signed in. No advertising, analytics or tracking cookies or SDKs are used.

The app stores session tokens in the device secure storage (iOS Keychain / Android Keystore). The app does not access the camera, microphone, location or contacts. In the staff panel only the images you pick are uploaded (through the system picker — no access to the whole library is requested).

Why we use it

• To receive, confirm and fulfil bookings, and for billing.
• To verify your phone with an SMS code, sign you in and reset your password.
• To contact you about bookings and orders, and to send notifications (SMS).
• For security, fraud prevention and legal compliance.

Who we share it with

We do not sell your data or share it for advertising. Only where needed to provide the service:

• SMS provider (Eskiz.uz) — phone number and SMS text (verification codes, booking messages).
• Telegram — notifications about new bookings and messages to the hotel staff's private group (name, phone, dates).
• Payment provider (Multicard / RAHMAT) — to process online payments.
• Google and Apple — if you choose to sign in with them.
• Server and hosting provider — data is stored on a secured server.
• Public authorities — only where required by law.

How long we keep it

• Account — until you delete it.
• Bookings, payments and restaurant bills — for as long as accounting and the law require (after account deletion, no longer linked to you).
• SMS verification codes — short-term (only a hash is stored); deleted together with the account.

Your rights

• View and correct your data — in "My account".
• Delete your account — in the app or on the website under "My account → Delete account", or by request (see the "Delete account" page).
• Questions or complaints about booking data — via the contacts below.

Security

All connections are encrypted with HTTPS, passwords are stored only as hashes, staff see only the data their role needs, and their actions are logged.

Children

The service is not intended for independent use by children under 16; bookings are made by adults.

Changes

If this policy changes, the new version is published on this page with its update date.

Contact

• info@heavens.uz
• +998 77 055 67 67
• +998 94 737 01 01
• Aktash, Bostanlyk district, Tashkent region