Privacy Policy

1. Data controller

Controller: "OILA24" LLC (Tax ID / STIR: 313100184)

Address: 30 Fidokor street, Lolazor MFY, Mirabad district, Tashkent, Uzbekistan

Phone: +998 90 034 50 23. Email: info@oila360.uz.

2. Data we collect — parent account

• Phone number (for registration and verification via SMS/Telegram)
• Name and profile photo (optional)
• Subscription and payment status. Payments are processed by licensed payment providers (Atmos, Payme) — we never store your card number, only a tokenized identifier issued by the provider
• Device identifiers and push notification tokens (FCM)

3. Data we collect — child's device (Bolajon360)

The following data is collected only with the parent's explicit consent and after the relevant permissions are granted on the child's device:

• Precise geolocation (including in the background) — to show the child's location on the map, movement history and safe-zone (geofence) alerts
• List of installed apps and their usage time (screen time statistics)
• Device status: battery level, internet connectivity, sound mode
• Photos and videos from the gallery — shown directly to the parent and not stored on our servers
• Audio/video streams from the microphone and camera — only when the parent activates monitoring in a situation of concern. The stream is transmitted directly to the parent over an encrypted channel (WebRTC) — we do not store or record it on our servers
• In-app chat messages between parent and child
• SOS alerts

4. Bolajon360 app permissions and their purposes

To function, the Bolajon360 app requests the following Android permissions. Each permission is used solely for the purpose stated below. Before each permission is requested, its purpose is openly explained in the app's user interface (prominent disclosure), and it is granted only with the user's consent.

• ACCESS_FINE_LOCATION — obtaining the child device's precise GPS location and showing it on the map
• ACCESS_COARSE_LOCATION — approximate network-based location when GPS is unavailable
• ACCESS_BACKGROUND_LOCATION — updating the location even when the app is closed or in the background
• FOREGROUND_SERVICE_LOCATION — declaring the background location service type on Android 14+
• PACKAGE_USAGE_STATS — measuring how long each app is used (screen time statistics)
• QUERY_ALL_PACKAGES — obtaining the list of installed apps (to build the blocking catalog)
• BIND_ACCESSIBILITY_SERVICE — detecting when a restricted app is opened and blocking it. The accessibility service is used solely for this purpose — screen content is not collected or shared with third parties
• SYSTEM_ALERT_WINDOW — showing a lock screen (overlay) on top of a blocked app
• FOREGROUND_SERVICE — running location tracking as a persistent foreground service
• RECEIVE_BOOT_COMPLETED — restarting protection and tracking after the device reboots
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS — so the system does not stop the service to save battery
• INTERNET — exchanging data with the server
• ACCESS_NETWORK_STATE — checking internet availability (for the offline queue)
• POST_NOTIFICATIONS — showing foreground-service and push (FCM) notifications
• RECORD_AUDIO (in future versions) — allowing the parent to remotely hear the sound around the child in a situation of concern (via WebRTC, never recorded — see section 3)
• CAMERA (in future versions) — remotely capturing an image from the child device's camera (via WebRTC, never stored on our servers)

The RECORD_AUDIO and CAMERA permissions are not used in the current version and will be added in future updates; they operate only when the parent activates monitoring.

5. How we use the data

• Providing the parental control service: location tracking, safe zones, app restrictions, screen time, phone lock, chat, tasks and rewards, SOS
• Account creation, authentication and technical support
• Subscription management and payment processing
• Securing the Service and preventing abuse
• Complying with legal obligations

We do not use data for advertising, do not sell it, and do not share it with third parties for marketing. The apps contain no third-party advertising.

6. Children's privacy and parental consent

The Service processes a child's data only on the basis of verifiable consent from a parent or legal guardian. Only the parent installs Bolajon360 on the child's device and enters the pairing code — this constitutes the verification of consent.

The child is aware of the app: it is visible on the device, and the child uses the SOS, chat and location features themselves.

The parent may withdraw consent at any time by deleting the child profile or the account (see section 10).

7. Sharing with third parties

A child's personal data is visible only to their parent (the account owner). To operate the Service we rely on trusted providers in the following categories:

• Google Firebase Cloud Messaging — push notification delivery
• Payment providers (Atmos, Payme) — subscription payment processing
• SMS provider — delivery of verification codes
• Hosting providers — data storage and server infrastructure

These providers process data only on our instructions and under contract. Data may be disclosed to competent state authorities where required by law.

8. Retention and security

Data is retained only as long as necessary to provide the Service: location history and activity data are automatically deleted after a limited period; when an account is deleted, all personal data linked to it is deleted.

Data is protected in transit using TLS (HTTPS) and WebRTC encryption. Sensitive categories of data (such as payment tokens) are also encrypted at rest. Audio/video streams and gallery content are never stored on our servers. Access to data is restricted to authorized personnel.

9. Your rights

• Access your data and your child's data
• Request correction of inaccurate data
• Request deletion of data
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise your rights, contact us at info@oila360.uz. Requests are handled within 30 days.

10. Account and data deletion

You can delete your account at any time in the Oila360 app: Profile → Delete account. Deleting the account removes the parent profile and all connected child profiles, location history, recordings, chat and other personal data.

You may also send a deletion request to info@oila360.uz.

11. Legal basis

Personal data is processed in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547) and other applicable legislation. The legal basis for processing is the consent of the user (parent) and the performance of the service agreement.

12. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via the app or email. The new version takes effect upon publication on this page.

13. Contact

"OILA24" LLC (Tax ID / STIR: 313100184)

Address: 30 Fidokor street, Lolazor MFY, Mirabad district, Tashkent, Uzbekistan

Phone: +998 90 034 50 23

Email: info@oila360.uz