Privacy Policy of the «Zakup Ai» Application
Effective date: 2 September 2026.
Operator: Sole Proprietor «ТҰРАРБЕКҰЛЫ» (Тұрарбекұлы Уәлихан), IIN 930515300132, Republic of Kazakhstan, Astana.
Contact: goszakup.consult@gmail.com.
This Policy describes what data the mobile application «Zakup Ai» (hereinafter — the "Application") processes, for what purpose, to whom it is disclosed and how it is protected. By using the Application, you confirm that you have read this Policy.
Important. The Application is an independent tool and is not affiliated with the public procurement portal goszakup.gov.kz, the Ministry of Finance of the Republic of Kazakhstan, or any other government body.
1. Key principle: your EDS key never leaves your device
- Your electronic digital signature (EDS) key (the
.p12file) and its password are stored only locally on your device, in the protected Apple Keychain storage, secured by Face ID / Touch ID / passcode. - The Operator does not receive and does not store your EDS key on its servers.
- The key is used to generate the signature on the device itself: the signing is performed locally, the decrypted key is processed to create the signature and is not retained after the operation is completed.
- When the Application is minimized, the decrypted key is erased from RAM; to resume work, Face ID is requested again.
2. What data is processed
2.1. EDS key and password. Stored locally (see Section 1). The signature is generated on the device; the EDS key is not transmitted to the Operator and is not retained.
2.2. Public procurement portal data. The Application provides access to the goszakup.gov.kz portal within an embedded browser. Your authorization session, cookies and the data you enter on the portal are transmitted directly between your device and the portal; the Operator is not an intermediary and does not store this data (except for transit processing at the moments of price offer encryption and uploading of signed files, when this is technically required).
2.3. Artificial intelligence (AI) feature data. When using AI features (technical specification analysis, AI chat), the text you send (for example, the text of a lot's technical assignment or your question) is transmitted to the Operator's server and further to a third-party AI service provider to generate a response. The data is processed in transit to generate the response and is not used to identify the user. Do not submit to the AI features any information you do not wish to disclose to third parties.
2.4. Document files. When you attach a document, the file you select is signed with the EDS on the device and uploaded to the public procurement portal. The file is processed in transit for the purposes of signing and uploading and is not stored by the Operator.
2.5. Subscription and payment data (if applicable). If the Application uses paid features, payment is made through Apple In-App Purchase. Payment details are processed by Apple; the Operator does not receive your card data. The Operator receives from Apple only the subscription status (active/inactive).
2.6. Subscription analytics. To provide and manage the paid subscription and for purchase analytics, the Operator uses the Adapty service (see Section 5). Adapty receives subscription status, a device identifier and anonymized usage and diagnostics data. This data is not linked to your identity and is used solely to operate the subscription and its analytics.
2.7. How we tell whether our advertising works. We tell people about the Application on social networks. So that we can see which advertising actually brings people in, and not spend money in vain, the Application reports to Meta (Facebook, Instagram) the fact of an installation and a few steps: whether the introduction to the App was completed, whether an EDS was issued, whether portal sign-in took place, whether an analysis was ordered, whether the subscription screen was shown, and whether a search was performed. If you buy credits, the amount and currency of the purchase are transmitted.
Only the name of the step is transmitted. What exactly you searched for and which procurements you opened stays between you and the Application.
We will ask separately about the device advertising identifier: iOS will show a system prompt. Granting it is entirely up to you — if you decline, we will simply learn from Apple that an installation happened, without any information about you.
The following is never transmitted to Meta: the EDS key and password, your full name, IIN and BIN, price offer amounts, and the text of your AI queries.
If you do not want this, it is switched off with a single toggle: Profile → "Analytics and app improvement". The exchange with Meta then never begins. For the operation of server-side functions, transit processing of minimal technical information (the fact and time of a request, error codes) is possible solely for the provision of the service and security; such information is not linked to your identity and is not retained longer than necessary.
3. Purposes of processing
- providing access to the public procurement portal from a mobile device (EDS login, signing, submission of an application, uploading of documents);
- performing electronic signing operations and price offer encryption;
- providing supplementary AI features (technical assignment analysis, chat);
- providing paid functionality and managing the subscription (if applicable);
- ensuring security, preventing abuse, technical support.
4. Legal grounds
Processing is carried out in accordance with the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 "On Personal Data and Its Protection" on the basis of your consent, as well as to the extent necessary for the performance of a contract (provision of the Application's services). For users from the EU/EEA, the corresponding grounds of the GDPR apply (consent, performance of a contract, legitimate interest).
5. Disclosure to third parties (processing subcontractors)
The Operator engages the following service providers solely to ensure the operation of the Application:
| Recipient | Purpose | Data |
|---|---|---|
| Apple Inc. | Distribution, In-App Purchase, payments | Payment data (processed by Apple), subscription status |
| Adapty (Adapty Tech Inc.) | Subscription management and purchase analytics | Subscription status, device identifier, anonymized usage and diagnostics data |
| Third-party AI service provider | Generating responses of AI features | Text you send to the AI features |
| Hosting provider for the Operator's servers | Hosting server-side functions (AI backend) | Transit data of operations |
| goszakup.gov.kz portal | Your actions on the government portal | Data you yourself enter/sign on the portal |
| Meta Platforms Ireland Ltd. | Measuring the effectiveness of the Application's advertising | Fact of installation and launch, names of usage steps, purchase amount; advertising identifier — only with your permission |
The Operator does not sell personal data and does not disclose it to third parties for purposes not provided for by this Policy, except where required by law.
The third-party AI service provider processes the transmitted text solely to generate a response; under its terms, data transmitted via the application programming interface (API) is not used to train models, and its retention period is limited by the provider's policy.
6. Retention periods
- EDS key and password — stored on the device until you delete them in the Application; not stored by the Operator.
- Transit data of operations (signing, encryption, uploading) — not retained after the operation is completed.
- Text of AI requests — in accordance with the policy of the third-party AI provider (limited period, without use for training).
- Technical/service records — for the period necessary for security and support, after which they are deleted or anonymized.
7. Your rights
You have the right to:
- obtain information about the processing of your personal data;
- request the clarification, blocking or deletion of data;
- delete the EDS key from the device at any time using the Application's tools (the "Profile" section);
- withdraw consent to processing (this may make it impossible to provide some features);
- lodge a complaint with the authorized personal data protection body of the Republic of Kazakhstan.
To exercise your rights, send a request to goszakup.consult@gmail.com.
8. Security
- the EDS key is stored in Apple Keychain with biometric protection and does not leave the device;
- signing is performed locally on the device;
- data is transmitted over a secure connection (HTTPS/TLS);
- access to the login/signing area is additionally protected by Face ID;
- the Operator takes reasonable organizational and technical protection measures, however no method of transmission/storage is absolutely secure.
9. Children
The Application is not intended for persons under 18 years of age and is not addressed to children.
10. Cross-border transfer
Certain service providers (for example, Apple, the third-party AI service provider, hosting) may process data outside the Republic of Kazakhstan. The Operator takes measures to ensure that such transfer is accompanied by an appropriate level of protection.
11. Changes to the Policy
The Operator has the right to update this Policy. The current version is published at https://goszakup-consult.kz/privacy with an indication of the effective date. Material changes are communicated to users through the Application's tools.
12. Operator's details
Sole Proprietor «ТҰРАРБЕКҰЛЫ» (Тұрарбекұлы Уәлихан)
IIN: 930515300132
Address: Republic of Kazakhstan, Astana
Email: goszakup.consult@gmail.com