EventAI Personal Data Processing Policy

App: EventAI Document version: 1.0 Effective date: 28.06.2026 Operator: J-19 group LLP, Tax ID (BIN/IIN) 190540021304, address: РК, г. Алматы, Алатауский район, мкр. Акбулак, ул. Шарипова, д. 157, индекс 160600 PD processing contact: J19europe01@gmail.com

This Policy has been developed in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" and defines the procedure for processing and protecting personal data (hereinafter — "PD") in the EventAI service. The Policy supplements the Privacy Policy, elaborating on the legal aspects of PD processing.

1. Operator and data subjects

• PD Operator: J-19 group LLP.
• PD subjects: users of the App (personal and business accounts), as well as persons whose data users enter voluntarily (for example, guests in invitation lists).

2. Categories of PD processed

• Identification: phone, email, name/full name, nickname, date of birth, avatar.
• Account: ID, account type, password hash, Google ID, language, creation/login dates.
• Geodata: region/city/district (manual), foreground geolocation (with consent).
• Business data: legal name, Tax ID (BIN/IIN), legal address, verification documents.
• Content: listings, reviews, messages, invitations, scenarios, orders, favorites.
• Technical: FCM token, device data (when crash reporting is enabled), IP and device/session information (for security).

Third-party data. By entering other people's data (for example, a guest list in invitations — names/contacts), the user confirms that they have the right and/or consent of those persons to process it and bears responsibility for this (see the Terms of Service).

The Service does not intentionally collect special categories of PD.

3. Processing purposes

1. Registration and identification of the user.
2. Provision of marketplace features (listings, search, orders, chat, reviews, invitations).
3. Scenario generation and service selection (AI).
4. Business account verification.
5. Sending service notifications.
6. Ensuring security and preventing fraud.
7. Improving stability (crash reporting — with consent only).
8. Complying with legal requirements.

4. Legal grounds

• Consent of the PD subject — for geolocation, crash reporting, and processing of content entered voluntarily.
• Performance of the contract (Terms of Service) — for account and feature operation.
• Legal requirements — for business verification and responses to lawful requests.
• Operator's legitimate interest — for security and protection against abuse.

Consent is given at registration and/or upon first use of the relevant feature and may be withdrawn (see §8).

5. Collection and sources

PD is obtained: (a) directly from the subject at registration and use of the Service; (b) from authentication providers (Firebase, Google) when the corresponding sign-in method is chosen; (c) automatically (technical identifiers, session information).

6. Sharing with third parties (processors)

The list of processors and the categories of shared data are provided in the Privacy Policy, §3 (Firebase, Google, Yandex Cloud Storage, DeepSeek, Groq). Sharing is carried out on the basis of contracts and is limited to the minimum necessary. PD may be processed outside the RK (see §10).

Personal identifiers (name, phone, email) are not shared with AI providers — only event parameters. Groq (USA), under its API terms, does not use data for training and by default does not store it (ZDR enabled). DeepSeek (China (PRC)), under its terms, is entitled to use shared data to improve its services, including model training; therefore, no identifying data is shared with DeepSeek, and request content is minimized. For details, see the Privacy Policy, §3, and the AI Policy.

7. Storage and protection

• Retention: for the duration of the account; after account deletion, PD is anonymized immediately, and backup copies are removed within the technically determined period of their rotation. Certain data may be kept longer where required by law.
• Protection measures: transport encryption (HTTPS), passwords stored as hashes (bcrypt), local secure storage on the device (Keychain/Keystore), access restriction, logging, exclusion of sensitive data from backups. See the Privacy Policy, §5.

8. PD subject rights

The subject may:

• obtain information about the processing of their PD and its list;
• request the correction, blocking or destruction of PD (if it is incomplete, outdated, inaccurate, or processed in violation);
• withdraw consent to processing;
• delete the account and associated PD directly from the App (Settings → Delete account);
• appeal the Operator's actions to the authorized PD protection body.

Requests are sent to J19europe01@gmail.com. The Operator responds within the timeframes set by the legislation of the RK.

9. Anonymization and deletion

Upon account deletion, personal data is anonymized (phone, email, name, avatar, etc. are erased), the account is marked deleted, personal listings are hidden, sessions are revoked. Technical details — Account Deletion Policy.

10. Cross-border transfers

Processors process data outside the RK: Google/Firebase and Groq — in the USA; DeepSeek — in China (PRC). The legal ground for the cross-border transfer is the consent of the PD subject. The Operator transfers the minimum necessary amount of PD; no identifying data is shared with DeepSeek, and request content is minimized (see the Privacy Policy, §3).

11. Changes

This Policy may be updated; the current version is at https://eventai.kz/personal-data. Users are notified of material changes in the App.

12. Contacts

• Operator: J-19 group LLP, РК, г. Алматы, Алатауский район, мкр. Акбулак, ул. Шарипова, д. 157, индекс 160600
• PD inquiries: J19europe01@gmail.com