Gapex Mobile App — Privacy Policy
Effective date: 12 October 2026
Last updated: 12 October 2026
This Privacy Policy explains how Multibroker ("Gapex", "we", "us") collects, uses, shares and protects personal data when you use the Gapex mobile applications for iOS and Android (the "App"). It supplements the Gapex Personal Data Processing Policy (the "Main Policy"). If this document and the Main Policy differ on a matter specific to the App, this document applies.
We process personal data in accordance with the Law of the Republic of Uzbekistan "On Personal Data" and other applicable law.
1. Who we are Link to this section
| Data controller (operator) | Multibroker |
| Registered address | Tashkent, Republic of Uzbekistan |
| Privacy contact | sokhib@jett.uz |
| Support | sokhib@jett.uz · @jett |
| Person responsible for personal data processing | Head of Legal |
2. What the App does Link to this section
Gapex is a business tool that collects comments, direct messages and reviews from social media and app-store accounts you connect (for example Instagram, YouTube, Google Play and the App Store) into one inbox, generates suggested replies using artificial intelligence ("AI"), and lets you review, edit, send or publish them. The App is intended for businesses and professionals aged 18 or older.
3. Data we collect Link to this section
3.1 Data you give us Link to this section
- Account data: name, email address, phone number, password (stored only as a salted hash), language and time zone. If you sign in with Google or Apple, we receive your name and email address from that provider instead of a password.
- Organization data: organization/workspace name, your role, team members you invite (name, email).
- Brand and AI settings: brand descriptions, tone-of-voice instructions, reply templates, knowledge-base text and files you upload.
- Support communications: messages you send us and our replies.
3.2 Data from accounts you connect Link to this section
When you connect an external account, you authorize us through that platform's official login (OAuth) or API key. The App never asks for, receives or stores the password of your connected social media account. Depending on the platform and the permissions you grant, we receive:
- access and refresh tokens and account identifiers (page, channel or app IDs);
- public profile information of the connected account (name, username, profile picture);
- comments, replies, mentions, reviews and ratings on your content or apps, including the photos, videos and other media attached to them;
- direct messages sent to and from the connected account, including their attachments (only where the platform permits and you enable this);
- post and engagement statistics.
These items often contain personal data of other people (your followers, customers or reviewers), such as their usernames, profile pictures and message content. See Section 7.
3.3 Data generated when you use the App Link to this section
- AI-suggested replies, your edits, and the replies you send or publish;
- classifications the App assigns (for example topic, sentiment, priority).
3.4 Device and technical data Link to this section
- device model, operating system and version, app version, language, time zone;
- IP address (used for security and approximate country-level location only);
- push notification token (only if you allow notifications);
- crash reports and diagnostic data: when the App crashes or hits an error, it sends a crash log with the state of the App at that moment, the device model, operating system version, an installation identifier and the internal identifiers of the screen in use (for example an organization or conversation ID).
3.5 Purchase and subscription data Link to this section
When you buy, renew or restore a subscription through the App Store or Google Play, the payment is processed by Apple or Google, not by Gapex. Through our subscription-management provider (Section 6) we receive:
- the plan you bought, its price and currency;
- purchase, renewal and expiry dates and the subscription status (active, cancelled, expired, refunded);
- the country of your store account and a store transaction identifier.
This data is linked to your organization's ID, which we use as the customer identifier for subscriptions. Payments for Gapex plans are processed by payment processors, such as Apple and Google, not by Gapex: we never receive or store your full payment credentials.
3.6 Data stored on your device Link to this section
To work quickly and when the connection is poor, the App keeps some data on your device:
- your session tokens, in the iOS Keychain or Android Keystore;
- a limited cache of recent conversations, messages and comments, and of the media attached to them (images, videos, voice messages). Cached media expires after 30 days. The cache is cleared when a different user signs in on the device;
- your App settings, such as language, appearance and notification preferences.
All of this is removed when you uninstall the App.
The App itself does not use cookies, advertising identifiers or tracking technologies. When you play a YouTube video inside the App, the player is provided by Google and may place or read cookies or similar technologies on your device under Google's Privacy Policy (https://policies.google.com/privacy). Web pages you open from the App (for example this Policy) open in your device's browser view and are governed by that site's own policy.
3.7 Data we do not collect through the App Link to this section
- precise (GPS) location, contacts, calendar, microphone or health data;
- full payment credentials (these are handled by the payment processor, such as Apple or Google);
- biometric data;
- advertising identifiers (IDFA/GAID). We do not track you across other companies' apps or websites and we do not show third-party ads in the App.
4. Why we use your data (purposes and legal bases) Link to this section
| Purpose | Legal basis |
|---|---|
| Create and secure your account; sign you in | Performance of our agreement with you |
| Connect your external accounts and read/send comments, messages and reviews on your instruction | Performance of agreement; your consent given when you connect the account |
| Generate AI reply suggestions and classifications | Performance of agreement; your consent (Section 5) |
| Process subscriptions, activate your plan and its AI-reply limits, restore purchases | Performance of agreement |
| Keep accounting and tax records of payments | Legal obligation |
| Send push notifications about new messages | Your consent (you can turn them off in device settings) |
| Provide support and respond to requests | Performance of agreement |
| Diagnose crashes and fix errors; check whether an App update is required | Our legitimate interest in keeping the App working |
| Keep the App secure, detect fraud and abuse | Our legitimate interests; legal obligations |
| Improve our features using de-identified or aggregated data (Section 5.3) | Your consent; you may opt out |
| Comply with the law and lawful requests of authorities | Legal obligation |
We do not use your data for automated decisions that produce legal or similarly significant effects on you.
5. Artificial intelligence Link to this section
5.1 Third-party AI providers Link to this section
To generate reply suggestions, the App sends the relevant text (for example the incoming comment or message, a limited conversation context and your brand/tone settings) to a third-party AI model provider acting as our processor: Google (Gemini). Before this happens for the first time, the App asks for your explicit permission. You can withdraw permission by emailing sokhib@jett.uz; AI features will then stop working.
Our agreements with these providers prohibit them from using data we send to train their own models, and limit their retention to what is needed to provide and secure the service.
5.2 Accuracy Link to this section
AI output can be inaccurate or inappropriate. You are responsible for reviewing replies before sending, and for any auto-reply you turn on. You can report an objectionable AI-generated reply by emailing sokhib@jett.uz.
5.3 Improving our models Link to this section
We do not use content received from connected platforms (Instagram, YouTube, Google Play, App Store and others) to train general-purpose AI models. We may use de-identified or aggregated data — data that no longer identifies you or any other person — to evaluate and improve reply quality for Gapex. You can opt out at any time by emailing sokhib@jett.uz.
6. Who we share data with Link to this section
We do not sell personal data and do not share it for advertising.
We share data only with:
- Service providers (processors) that host and operate Gapex, each only for the purpose stated:
- cloud hosting and storage — data centres located in the Republic of Uzbekistan;
- AI reply generation — Google (Gemini), see Section 5.1;
- push notifications — Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google LLC);
- crash reporting — Firebase Crashlytics (Google LLC);
- app configuration and update checks — Firebase Remote Config (Google LLC);
- subscription management — RevenueCat, Inc. (USA), which receives purchase and subscription data from the app stores, your organization's ID and basic device data (app version, operating system, IP address);
- customer support tools.
- Payment processors, such as Apple (App Store) and Google (Google Play), which process payments for Gapex plans as independent controllers under their own terms and privacy policies.
- Platforms you connect (for example Meta, Google/YouTube), to the extent needed to read and send content on your instruction.
- Members of your organization, according to the roles and access settings your organization configures in Gapex.
- Authorities, courts or advisers, where required by law or needed to protect rights and safety.
- A successor entity in a merger, acquisition or sale of assets, which must keep protecting your data under this Policy.
Equal protection. Service providers may process data only on our instructions and under confidentiality and security obligations. Every service provider and other third party with whom we share personal data is required, by a written agreement or by its binding terms, to provide the same or equal protection of that data as stated in this Policy and required by applicable law, and to use it only for the purposes for which we share it.
7. Personal data of your customers and followers Link to this section
When you connect an account, messages and comments from third parties flow into Gapex. For this data, we act on behalf of, and on the instructions of, you or your organization. You are responsible for having a lawful basis to process it and for complying with the rules of the relevant platform. If one of those people contacts us about their data, we will forward the request to you or, where required, handle it ourselves.
8. Platform-specific disclosures Link to this section
8.1 YouTube and Google Link to this section
Gapex uses YouTube API Services. By connecting a YouTube channel, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's Privacy Policy is available at https://policies.google.com/privacy. You can revoke Gapex's access to your Google account at any time at https://security.google.com/settings/security/permissions. Gapex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Section 3.6 explains what the App stores on your device, including cookies the YouTube player may set. When you disconnect, or revoke access, we delete stored YouTube API data within 30 days, except where the law requires us to keep it.
8.2 Meta (Instagram, Facebook) Link to this section
Data received from Meta platforms is used only to provide the Gapex features you enable and is handled in accordance with the Meta Platform Terms. You can remove Gapex's access in your Instagram or Facebook settings (Settings → Apps and websites). To request deletion of data we received from Meta, follow Section 11.
8.3 Google Play and App Store reviews Link to this section
If you connect your developer accounts, we access your apps' public reviews and ratings through the official Google Play Developer API and App Store Connect API, using the credentials you provide, only to display, analyze and reply to reviews.
9. Where data is stored and international transfers Link to this section
Personal data of citizens of the Republic of Uzbekistan is stored in databases located in Uzbekistan where required by law. Some processing is performed by providers located outside Uzbekistan (for example in the USA or the EU): AI reply generation, push notifications, crash reporting, app configuration and subscription management (Section 6). When we transfer data abroad, we do so on the basis of your consent and contractual safeguards requiring an adequate level of protection.
10. How long we keep data Link to this section
| Data | Retention |
|---|---|
| Account and organization data | While your account is active; deleted within 30 days after account deletion |
| Connected-account tokens | Until you disconnect the account; deleted immediately after disconnection |
| Comments, messages and reviews imported from platforms | While the account is connected; deleted immediately after disconnection, unless you delete them earlier |
| AI suggestions and sent replies | Same as the related content |
| Purchase and subscription records | For the period required by tax and accounting law, also after account deletion |
| Crash reports | Up to 90 days |
| Security logs | Up to 12 months |
| Data stored on your device | See Section 3.6; removed when you uninstall the App |
| Records we must keep by law (e.g. contracts) | For the period required by Uzbek law |
De-identified and aggregated data may be kept longer because it no longer identifies anyone.
11. Deleting your account and data Link to this section
In the App: open More → Delete account and confirm. This permanently deletes your Gapex account and personal data from our active systems and our backups within 30 days.
Without the App: send an email from the address linked to your account to sokhib@jett.uz with the subject "Delete my Gapex account". We will verify the request and confirm deletion within 30 days.
What is deleted: your profile, connected-account tokens, imported comments/messages/reviews, AI settings, templates and suggestions.
What we may keep: records we are legally required to retain (including purchase and subscription records held by us and our subscription-management provider), and data needed to resolve an ongoing dispute or prevent fraud — only for as long as necessary.
Subscriptions: deleting your account does not cancel a subscription bought through the App Store or Google Play. Cancel it first in your Apple ID or Google Play account settings.
If you are a member of an organization, deleting your account removes your personal data but does not delete the organization's shared workspace, which is controlled by the organization's owner. Uninstalling the App does not delete your account.
Deleting your Gapex account does not delete your accounts on Instagram, YouTube or other platforms, or content already published there.
Withdrawing consent: you can turn off push notifications in your device settings, disconnect any connected account in the App or in the platform's settings, and withdraw your AI permission or opt out of model improvement by emailing sokhib@jett.uz.
12. Security Link to this section
We protect data with encryption in transit (TLS) and at rest, encrypted storage of access tokens, role-based access control, access logging and regular security updates. On your device, session tokens are stored in the iOS Keychain or Android Keystore. No system is completely secure; please use a strong password and notify us at sokhib@jett.uz if you suspect unauthorized access. If a data breach is likely to significantly affect you, we will notify you and the competent authority as required by law.
13. Your rights Link to this section
Subject to applicable law, you have the right to:
- know whether and how we process your data, and obtain a copy of it;
- correct inaccurate or incomplete data (most data can be edited in the App);
- request deletion or blocking of your data;
- withdraw consent at any time (this does not affect processing before withdrawal);
- object to processing for marketing and to AI model improvement (Section 5.3);
- lodge a complaint with the authorized state body for personal data protection of the Republic of Uzbekistan, or seek protection in court.
Send requests to sokhib@jett.uz. We respond within 15 business days and may ask you to verify your identity.
14. App permissions Link to this section
| Permission | Why | Required? |
|---|---|---|
| Notifications | Alert you to new comments, messages and reviews | No |
| Photos / files | Only when you choose to attach an image or upload a knowledge-base file | No |
You can change permissions at any time in your device settings.
15. Children Link to this section
The App is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with data, contact sokhib@jett.uz and we will delete it.
16. Changes to this Policy Link to this section
We may update this Policy. We will post the new version at https://gapex.ai/privacy_mobile with a new "Last updated" date, and notify you in the App or by email before material changes take effect.
17. Contact Link to this section
Multibroker, Tashkent, Republic of Uzbekistan
Email: sokhib@jett.uz
This Policy is also available in Uzbek and Russian at the same address.