Privacy policy

This policy sets out how personal data is processed when you use the HEAD Academy site and learning platform.

Data is processed in accordance with the personal data legislation of the Republic of Uzbekistan. The requirement to store data on servers located in Uzbekistan needs separate legal review — this point must be settled before launch.

By using the site you confirm that you have read this policy.

Account data: name, phone number, email address, Telegram username, city and chosen interface language.

Learning data: which course you are enrolled on, which lessons you have completed, the projects you submit and the certificates issued to you.

Payment data: order amount, status, payment system and transaction identifier. We never see or store your bank card number — the card is handled only by the payment system.

Technical data: your IP address and browser information when a session is created, which is needed to keep your account secure.

Visit data: when you open the site we record your IP address, device and browser type, approximate country and city, the parameters of the link you arrived by (for example utm_*, fbclid, and the ad, ad set and campaign ids) and what you do on the page: which sections you looked at and for how long, how far you scrolled, which buttons you pressed and how far you watched the course video. What you type into a form is not part of this — only the fact that a field was selected is noted.

Visit recordings: if you came to the site from an ad, your visit may be recorded — what the page showed, scrolling, clicks and mouse movement. Everything typed into a form is masked with asterisks in the recording: your name and number are not visible.

Identifiers: a random visitor id in your browser's storage, and Meta's _fbp and _fbc cookies.

Messages sent through the contact forms: name, contact detail and the message itself.

Consent record: when you sent a form or first signed in, and which version of this policy was in force then.

To create your account and let you sign in — your phone number doubles as a sign-in method.

To open course access, save your progress and issue certificates.

To process payments and keep accounting records.

To tell you about cohort start dates, schedules and technical changes.

To answer your questions and provide support.

To measure our advertising: we tell Meta (Facebook, Instagram) which ad led to a visit, an application or a payment, so ads are shown to the people they are useful to and we stop paying for the ones that do not work.

To improve the pages: to see which parts of a page are read and where visitors stop.

We do not sell your data. Meta receives only what is described under Third-party services.

Payments: Payme and Click. They receive the order amount and identifier.

SMS: Eskiz.uz — your phone number is passed on so a confirmation code can be sent.

Telegram: used for internal notifications about new enquiries.

Hosting and database: the site and database run on cloud infrastructure.

1% CRM (crm.birfoizbilim.uz): processes visit data, visit recordings and applications on our behalf. Only our team can see them.

Meta Platforms (Facebook, Instagram): through the Meta pixel on the site and the Conversions API, Meta receives the page address, the event (page view, video view, application, payment started, payment), the amount for a payment, your IP address and browser details, the _fbp and _fbc cookies and the visitor id. For applications and payments it also receives your phone number and name, hashed — Meta never receives them in readable form.

Each service has its own privacy policy and receives only the data its task requires.

Account data is kept for as long as your account exists.

Payment and order records are kept for the period required by accounting legislation, even if the account is deleted.

Visit data is kept for 180 days and visit recordings for 30 days, then deleted.

Data is transmitted over an encrypted connection. Passwords are not stored in plain text. Access to the database is restricted.

No system is absolutely secure. If a security incident occurs, we will notify the users affected.

The right to request a copy of your data.

The right to correct inaccurate data — name, city and Telegram username you can edit yourself on the settings page in your dashboard.

The right to request deletion of your account and the data attached to it. Payment records required for accounting are retained until the statutory period expires.

The right to opt out of announcements. Messages required to deliver the service — a sign-in code, for example — are excepted.

Use the contact channels below to make a request. We reply within ten working days.

The site uses cookies to keep you signed in and to remember the language you chose. Without them the platform cannot be used.

For advertising, Meta's _fbp and _fbc cookies are used. Your browser's storage (localStorage and sessionStorage) holds a random visitor id and session id, so a returning visit can be recognised. They contain no name and no number.

You can clear cookies and site storage in your browser settings. The site keeps working without the advertising cookies; without the sign-in cookie you cannot sign in.

This policy may be updated. A new version is published on this page and the date at the top is updated.

We will give separate notice of significant changes, using the contact details on your account.