Privacy Policy
What data KazMaps collects about you, why it is needed, who it is shared with, and how to delete it.
In short
You can be found by phone number until you switch it off
Phone discoverability is on by default for every account. You can turn it off in privacy settings at any time.
Your address book is stored on the server
Only if you granted the app access to contacts. It is used to show which of your contacts are on the service.
Location is collected in the background too
Only after you grant access. Coordinates power your movement history, your position for friends, analytics and traffic data.
Lookups are logged together with the numbers
The log keeps who checked which number and when. Records live for three years.
Data is not for sale and does not go to ad networks
Advertising cards inside the app are served by us; KazMaps contains no ad networks and no advertising trackers.
You delete your account from the app
What exactly is erased, and what the law requires us to keep, is set out in a separate document.
Who processes your data§
The data controller is:
- Name: M9 Projects and Investments LLP
- BIN: 240640024909
- Registered address: 41/6 Al-Farabi Avenue, Block 15, premises 431, Bostandyk District, Almaty, 050040, Republic of Kazakhstan
- Phone: +7 708 909 0966
- Data enquiries: privacy@kazmaps.kz
Processing is carried out under the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" No. 94-V of 21 May 2013.
This policy covers the KazMaps mobile apps, the website and the business web console.
What we collect§
Our rule is simple: if a piece of data is not required for a feature to work, we do not ask for it and do not keep it. Below is the full list of what appears in our systems.
| Data | When it appears | Why |
|---|---|---|
| Phone number | On sign-up, or when added to a profile | Sign-in, account recovery, contact matching if you enabled it |
| On sign-up, or when added to a profile | Sign-in, account recovery, service notices | |
| Name, photo | You provide them yourself | Showing your card to other users |
| Date of birth | On sign-up | Age verification — see Age restrictions |
| Verification codes | On sign-in and contact confirmation | Proving a contact belongs to you. Stored irreversibly and deleted on expiry |
| Sessions | On every sign-in | So you can see active sessions and end any of them |
| Location | After you grant access; in the background under a separate permission | Movement history, position for friends, analytics, traffic — see Location |
| Address book: contact names and numbers | After you grant access to contacts | Showing which of your contacts use the service — see Finding people by phone number |
| Your material | When you post reviews, photos or place edits | Shown to other users under the Terms of Service |
| Technical data | While the app runs | Diagnosing errors and protecting the service — see Technical data |
Location§
Coordinates are what a maps service is made of. Until you grant location access, we do not collect it: the permission is requested by your device's operating system, and the app receives no coordinates before you answer.
Once access is granted, coordinates are processed in two modes:
- while you use the app — to show where you are, find what is nearby, and build a route "from here";
- in the background, if you separately allowed background access — these coordinates make up your movement history, your current position for friends, service analytics and traffic data.
For traffic calculation coordinates are anonymised: what enters the traffic layer is the speed of movement on a stretch of road, not who drove along it. That data cannot be traced back to a particular person.
Access and its precision are controlled by the operating system: background access can be limited or revoked entirely there. The map keeps working, but the features built on background coordinates — movement history, your position for friends — stop being updated.
Collected coordinates are kept in your account — see Search, route and movement history.
Search, route and movement history§
Your account keeps your search queries, built routes, and the movement history assembled from coordinates. Movement history can be viewed in the app; it also powers recent-place suggestions.
There is no separate history-clearing control in the app yet: history is kept for as long as the account exists and is erased together with it — see the data deletion instructions.
Friends and their position on the map§
Friends in KazMaps only come about by mutual agreement: one person sends a request, the other confirms it. Until a request is confirmed, your position is not visible to that person.
Confirmed friends see your current location — the same one collected in the background. You can remove someone from your friends at any time; after that your position is no longer shown to them.
If background location access is revoked or switched off in device settings, there is nothing to update the position with — friends stop seeing where you are.
Technical data and diagnostics§
To find and fix errors we receive technical details: device model, operating system and app versions, interface language, and — when the app crashes — a report of where it stopped.
Crash reports are for engineers, not marketing: they describe the state of the program, not you.
The apps contain no third-party analytics or crash-reporting SDKs: diagnostics are collected with our own tools and are not passed to third parties.
Cookies and local storage§
The website and the business web console use cookies and browser local storage for what they cannot work without: keeping you signed in, remembering your language and settings.
We measure site traffic with two tools:
- Cloudflare Web Analytics — works without cookies and builds no visitor profile;
- Google Analytics — uses cookies; anonymised visit data is processed by Google, including outside Kazakhstan.
Google Analytics is enabled only after you consent — the cookie notice asks on your first visit. Declining switches off nothing except the analytics itself.
There are no advertising networks or advertising trackers on the site. You can block cookies in your browser; the pages remain readable, but features that require signing in will stop working.
Finding people by phone number§
KazMaps shows which of your contacts already use the service, and lets people who know you find you by your phone number.
Discoverability is on until you switch it off§
Every account carries a phone-discoverability flag. It is on by default: any user who has your number can find you, and will see the name and photo from your profile.
You can turn discoverability off in privacy settings at any time and unconditionally — lookup stops finding you; turning it back on is just as simple, one action.
What happens to the numbers you check§
The app does not take address book access on its own: your device's operating system asks for it, and until you grant permission, no contacts are collected.
If permission is granted, the book is sent to the server and stored — both the numbers and the names you saved the contacts under. Numbers are normalised to a single format and matched against accounts that are discoverable by number. Matches are shown in the app; the stored book exists to show you contacts who join the service later, and is refreshed on the next sync.
You can revoke access to contacts in device settings — new syncs stop. The stored book is deleted together with the account.
The lookup log§
Checking a number is a question about another person, so every such request is recorded: who checked, which number, when, and through which feature. Both matches and misses are recorded — a log of matches only would describe everything except the abuse worth investigating, which consists almost entirely of misses.
The log makes it possible to investigate a complaint of "I was found by a number I never shared": it shows who looked up a given number and when.
The log is kept for three years from the moment of the request; older records are deleted.
Legal bases§
We process data on the basis of your consent, for the performance of our agreement with you, and to comply with legal obligations — in the cases where Law No. 94-V permits processing without separate consent.
You give your consent to processing by accepting this policy at sign-up. Location and contacts access is requested separately — by your device's system dialog — and that data is not collected before you agree.
Phone discoverability is on by default; you can switch it off at any time, which disables the feature, not the service as a whole.
Who we share data with§
We do not sell personal data. Data is shared only where a feature cannot work otherwise:
- telecom and messaging providers — your phone number, to deliver a verification code;
- email providers — your email address, for the same purpose;
- infrastructure providers — to the extent required to operate the service;
- Google — anonymised website visit data via web analytics, see Cookies and local storage;
- public authorities — in the cases and under the procedure established by law.
Each recipient sees only what its part of the work is impossible without. Transfers of data outside Kazakhstan are described under Where data is stored.
Where data is stored§
The law of the Republic of Kazakhstan requires personal data of Kazakhstan citizens to be stored in databases located within the country. The service's primary database — the one that holds accounts and personal data — is located in Kazakhstan.
Auxiliary infrastructure may be located abroad: map tile delivery, attack protection, web analytics. No account personal data is stored in it.
Cross-border transfer — moving data to the territory of another state — is allowed only in the cases provided by Article 16 of Law No. 94-V: to countries that ensure the protection of personal data, and to others — with your consent or in other cases expressly established by law.
Retention§
There is one rule: data does not outlive the purpose it was collected for — or the period the law itself prescribes.
| Data | Period |
|---|---|
| Account data | For as long as the account exists |
| Verification codes | Until their short lifetime expires |
| Sessions | Until the session ends or the account is deleted |
| Search, route and movement history | For as long as the account exists |
| Address book | For as long as the account exists; refreshed on sync |
| Phone lookup log | 3 years from the moment of the request |
| Technical logs and crash reports | 3 years |
| Backup copies | Up to 30 days after data deletion |
| Financial transaction records | The period set by accounting legislation |
Your rights§
The Law of the Republic of Kazakhstan "On Personal Data and Its Protection" gives you the right to:
- know which of your data we process, and obtain information about it;
- require correction of data that is inaccurate;
- require blocking and destruction of data processed unlawfully;
- withdraw your consent to processing — for features that run on consent, this is the same as switching them off;
- challenge our actions or inaction.
Requests are accepted at privacy@kazmaps.kz. We answer on the merits and within the timeframes set by law.
If you believe your rights have been violated, you may apply to the authorised body for the protection of personal data subjects' rights — the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan — or to a court.
Age restrictions§
KazMaps is a general-audience service; it is not directed at children and has no features designed for them. You may register an account on your own from the age of 16; younger users need the consent of a legal representative. We ask for your date of birth at sign-up precisely for this check.
For edits to places on the map the threshold is higher — 18 years, as required by the Contributor Agreement.
If you believe a child has provided us data without the consent of a legal representative, write to privacy@kazmaps.kz — we will delete it.
Notifications and advertising§
Service notices — sign-in codes, a warning about a new session, confirmation of account deletion — are part of how the service works. They cannot be opted out of while the account exists, because they protect it.
We run no advertising campaigns over SMS or email. Advertising may be shown as a card inside the app interface and may also arrive as a push notification. We serve it ourselves: KazMaps contains no ad networks and no advertising trackers, and your data is not passed to advertisers.
Advertising push notifications can be switched off separately from service ones, in the app settings; you can also turn the app's notifications off entirely in device settings.
Deleting your account§
You can delete your account yourself from the app. The procedure, the timelines, and the list of what is erased versus what the law requires us to keep are described in a separate document.
Changes to this policy§
When this document changes we publish the new edition at the same address and state its effective date at the top of the page. Previous editions remain available.