Data protection and legal compliance

The “Sonar” personal-data collection is entered in the state register of personal-data collections of the Republic of Uzbekistan (pd.gov.uz): certificate AA 0002212 of 29.07.2026. Registration is a mandatory requirement of ZRU-547 for a personal-data operator; the number can be verified in the register, and a copy of the certificate is provided on request together with the DPA.

All responses, contact details (phone), audio recordings and geotags from field interviews are stored on a server in Uzbekistan (Tashkent). Data is not transferred outside the country.

From 26 March 2026 (ZRU-1125), mandatory localization in Uzbekistan remains for biometric, genetic and certain telecom data; for other personal data the law permits cross-border processing under conditions. Interview audio is biometric data and is always stored in Uzbekistan. Beyond that, Sonar voluntarily keeps all research data in Uzbekistan, not only the data for which it is mandatory.

Every survey begins with a consent screen for the processing of personal data. Results are processed de-identified; the phone number is used only to prevent duplicates and to issue rewards, and is not published in reports.

Interview recordings and GPS are collected only with consent of the respondent (separately) and stored on a server in Uzbekistan solely for quality control (interview spot checks, dispute resolution). Retention period — 12 months: after it expires, recording files are deleted from disk automatically (only a service note about the completed quality check remains, without the recording itself).

Under art. 25-1 of ZRU-547 a panel member can delete their data at any time themselves from the account area (no email or waiting): the profile, phone/email, payout card and invitations are deleted. Answers already given stay in studies de-identified — the link to the person is severed permanently while clients' aggregated results stay intact. Financial records are kept de-identified (a tax accounting requirement). Requests are also accepted at contact@xplorence.com.

Core results (figures, averages, NPS, crosstabs, themes) are computed on our server without external AI. Phrasing the text findings via AI is a separate action, “Show findings (AI)”: the AI receives only de-identified aggregates, with no phone numbers, audio or geotags. The AI provider processes the data outside Uzbekistan. For sensitive projects a “Local mode” is available — external AI is turned off, findings are generated locally, and no data leaves Uzbekistan.

The research data belongs to the client. We do not resell it and do not use it to train models.

On request we provide a data processing agreement (DPA), a methodology note and a localization confirmation — to pass procurement at a bank, government agency or donor.

We use Yandex Metrica and Google Analytics for anonymized visit statistics of the marketing site — with no session recording (Webvisor is off). Analytics is not enabled for logged-in users and does not run on the survey or field-app pages, so form inputs and respondent answers are never sent to it.