1. Controller and scope
The controller is CARPAL KG LLC, 497 Chuy Avenue, apt. 33, Leninsky district, Bishkek, Kyrgyz Republic. Send data requests to privacy@carpal.kg. This Policy covers carpal.kg, the Carpal app, support, and connected services. It is a transparency notice, not blanket consent.
2. Data we process
We may process account and contact data; identity, birth date, licence, ID and selfie/KYC results; host and vehicle documents; location; bookings, prices, deposits and incidents; messages, reviews and support content; device identifiers, IP address, security logs, cookies, and analytics. Sources include you, booking participants, providers, partners, public registers, and your device.
3. Purposes and legal bases
We use data to operate accounts, verify identity and eligibility, publish listings, arrange and perform bookings, connect parties, prevent fraud, support users, resolve disputes, comply with law, keep records, and improve the service. Bases include contract, pre-contract steps, legal obligations, legitimate interests, and separate consent where required.
4. Identity checks and automated decisions
A specialist KYC provider may receive identity documents, facial images, and technical signals to detect fraud and confirm identity. Carpal does not make a solely automated decision with significant legal effects without a lawful basis and safeguards. You may request an explanation and human review.
5. Location and device permissions
Location is used after device permission for nearby search, handover points, trip display, and safety. Precise location is not continuously collected in the background unless a separate disclosure says so. Camera, photos, and notifications support documents, vehicle evidence, requests, and booking alerts.
6. Recipients
As necessary, data may be shared with the other booking party; KYC, SMS, email, push, hosting, storage, mapping, analytics, support, and payment providers used in the relevant flow; advisers; authorities responding to a lawful request; or a business successor. We do not sell personal data or share it for another party's independent advertising.
7. International transfers
Some providers may process data outside the Kyrgyz Republic. Carpal assesses the permitted transfer mechanism and uses statutory safeguards, contractual protections, or separate consent when required. Request recipient, country, and safeguard information at privacy@carpal.kg.
8. Retention
Account data is kept while the account is active and for the period needed to complete deletion and protect claims. Booking and payment records are generally kept up to 5 years, closed support or dispute files up to 3 years, security logs up to 12 months, and backups cycle out within 90 days. KYC material is kept only as necessary, subject to longer statutory or dispute holds.
9. Security
Carpal uses access controls, encryption in transit, logging, backups, provider reviews, and incident procedures. Access is limited to people who need it. No system is risk-free; when required, Carpal will notify the competent authority and affected users of an incident.
10. Your rights
Subject to law, you may request information and a copy, correction, deletion, restriction, objection, consent withdrawal, portability, and review of a decision. Send a request to privacy@carpal.kg; identity verification may be required. You may also complain to the Kyrgyz personal data authority.
11. Account deletion
Start deletion in Profile → Account settings → Delete account, or use the public Account deletion page. Active bookings, debts, or open disputes must be resolved first. Carpal deletes or irreversibly anonymizes data except minimum records retained for law, accounting, safety, and legal claims.
12. Children and policy changes
Carpal is not intended for people unable to enter the relevant transactions independently. Renting also requires legal and licensing eligibility. A new revision date is published for changes, and material changes are announced in the app, on the website, or through contact details.