Privacy Policy

AutoGo brings the services a vehicle owner in Mongolia needs into one app — buying insurance, paying traffic fines, vehicle tax and road fees, checking a car's market value, and getting help after an accident. Running those services requires personal data. This document explains exactly what we collect, why, who receives it, how long we keep it, and how you can have it deleted.

1. Who we are

AutoGo is owned and operated by Gerege Systems. "We" and "our" in this document mean Gerege Systems.

Гэрэгэ системс / Gerege Systems
State registration number: 6235972
Address: Ayud Tower, 12th floor, Olimp 5, 1st khoroo, Sukhbaatar District, Ulaanbaatar, Mongolia

2. What we collect

2.1. Data you enter yourself

Data	Where	Why
Phone number or email address	Sign-in screen	Your only sign-in identifier. Used to send a one-time code.
Vehicle plate number	Buying insurance, checking fines, requesting a valuation	Looking the vehicle up in the state registry and retrieving any amounts owed.
A family member's national registry number	Adding someone under "My people"	Insuring them. This is another person's personal data and you are responsible for having their permission.
Damage photographs and post-purchase vehicle photographs	Camera or photo library	Claims and the evidence required after a contract is signed.
Incident description, location text and date; whether anyone was hurt, whether a third party or the authorities were involved	Damage assessment form	Assessing the damage.
Chat messages	Assistant	Answering your questions. Please read section 6.
Email address (editable in your profile)	Profile	Contacting you. This address is not currently verified.

2.2. Data we obtain from state and partner systems

We do not ask you to type these; we retrieve them on your behalf.

DAN (the national e-ID gateway). When you choose to verify your identity you are taken to DAN's own page; you never enter those credentials in our app. DAN returns your national registry number, given name, family name, surname, civil identification number, gender, date of birth, province/district/subdistrict, address detail, and a photograph of you.
Gerege Core. Looks up civil registry details — name, gender, address — from a registry number.
XYP state vehicle registry. Returns a vehicle's make, model, year and VIN from a plate number, together with the registered owner's name and registry number. If you look up a plate that is not yours, that owner's details reach our systems.

2.3. Data generated automatically

A device identifier. A random value (UUID) created when you install the app. It is not Apple's advertising identifier (IDFA) and not a hardware serial number. It only distinguishes which device a session belongs to.
A push notification token, created only if you allow notifications.
A record of your consent to the terms — version, language, and your IP address and client user-agent string — as evidence of what you agreed to and when.
Request logs. Every request the app makes is recorded on our server: the path, the response status, the duration and the request content. Used for diagnosing faults, resolving disputes and preventing fraud.

3. Device permissions

The app requests the permissions below. None is asked for at launch — each is requested at the moment it is needed, and the rest of the app works if you decline.

Permission	What it is used for
Camera	Taking vehicle and damage photographs.
Photo library	Attaching a photograph you already took.
Location (while using the app)	Two things. Weather: your position is rounded to the nearest provincial centre before anything is sent to the external weather service — that service never receives your precise location. Accident screen: the coordinate is copied to your clipboard and is not transmitted anywhere unless you paste and send it yourself.

What differs on Android. Android asks separately for permission to send notifications (on iOS that is a prompt rather than a listed permission). Conversely, no photo library permission is needed on Android at all — the app uses the system photo picker, so only the single image you choose is handed over and the app has no access to the rest of your photos.

The app does not request the microphone, contacts, calendar or Face ID. It contains no advertising SDK and no third-party analytics or tracking SDK. We do not track you across other apps or websites, and we do not ask for permission to, because we do not do it.

What happens to photographs

Every photograph is re-encoded and downscaled on your phone before upload. A side effect is that EXIF metadata — including any GPS location tag — does not survive. Location data embedded in your photo files does not reach us.

Reading a plate number out of a photograph is done on your device. No image is uploaded for that check.

4. Your PIN

The PIN that unlocks the app never leaves your phone. It is hashed (SHA-256) and verified locally. The server stores only a flag recording that a PIN has been set. We do not know your PIN and cannot recover it for you.

5. Who receives your data

We do not sell your data and we do not share it for advertising. The organisations below receive data because the service cannot function otherwise. What reaches each one is named.

Who	For what	What reaches them
Gerege Accounts	Sign-in, one-time codes	Your phone number or email, and the code.
Gerege Core	Civil registry lookup	A registry number — yours, or that of a family member you added.
DAN	Identity verification	From us: only a service identifier and a return address. You authenticate on DAN's own page.
XYP state registry	Vehicle and person records	A plate number or a registry number.
Insurance companies (MIIS / AMI)	Issuing a policy	Name, registry number, phone, email, plate number, policy type. If you add named drivers: their registry number, phone and email.
QPay and the banks	Payment	Amount, invoice number, payment description. Card details never enter the app.
Gerege payment services	Fines, vehicle tax, road fees	To check: the plate number only. To pay: the plate number, your registry number and your email, because the VAT receipt is issued against them.
Google (Firebase Cloud Messaging)	Delivering notifications	The push token, plus the notification title and body (for example "your policy expires in 7 days").
SMS provider	Text messages	Your phone number and the message text.
AI provider (OpenRouter)	The chat assistant	See section 6.
Damage estimation service	Preliminary damage estimate	Vehicle make, model, year, VIN, plate, colour, your damage description, and links to the damage photographs.
Document service	Generating the policy PDF	The full contract record.
Weather service (Open-Meteo)	Showing the weather	Provincial-centre coordinates only, never your precise position.
Bank of Mongolia	Exchange rates	No personal data at all.

In addition, we may be required to disclose data in response to a lawful request from a competent authority, or where the law otherwise obliges us to.

6. The AI assistant

This is the most important section, so it is stated plainly. The in-app chat is not a program running on our own servers. What you type is sent to a third-party AI service (OpenRouter, which routes to an OpenAI model), processed there, and the answer is returned. That service is located outside Mongolia.

6.1. What is sent

Your message, in full. If you type a registry number, an address or health information into the chat, that goes too. We do not scrub the text you write.
The last 10 turns of that conversation, so the assistant has context.
The results of any lookup the assistant performs — your plate numbers, policy reference numbers, product names, policy status, who a policy covers, and assessment request ids, states and dates.

6.2. What is deliberately not sent

The following are withheld from the AI service by design and are rendered on your screen directly by our own server instead: premiums, claim amounts, policy dates, repair estimate totals, phone numbers, names, registry numbers, and the full text of help-centre answers.

6.3. What you should know

The assistant can be wrong. Its answers are not formal advice, not an insurance decision and not a legal interpretation. When it matters, contact your broker or insurer directly.
Please do not type confidential information into the chat — particularly passwords, card numbers or medical detail.
Reporting a bad answer. If an answer is wrong, offensive or harmful, press and hold that message and choose Report. It is sent to us and a person reviews it.

Your conversations are also stored on our servers so that you can read them again later.

7. Payments

Card numbers, CVV codes and banking passwords never enter the app. Payment happens in QPay or in your bank's own app. We receive only whether the payment succeeded, the invoice number and the amount. VAT receipts for fines, tax and road fees are issued against your registry number and email, which is why those are passed to the payment service.

8. Storage and security

All traffic between the app and our servers is encrypted (HTTPS, with an additional AES layer on top).
Session tokens and the PIN hash are held in the iOS Keychain, readable only on that device and only while it is unlocked. They are excluded from iCloud backups.
One customer is signed in on one device at a time. Signing in on a new device revokes earlier sessions.
Files and photographs are stored on our own servers; we do not use a third-party CDN.

9. How long we keep it

What	Period
Chat conversations	365 days after the last message, then deleted automatically.
Account deletion grace period	30 days (section 10).
Insurance contracts, claims, payment records	No single fixed period — it differs by insurance product. We keep these for as long as the contract is in force, plus the period during which a claim or dispute may still arise, plus any period required for that product by law or by the insurer's own rules. If you want the specific period for your own contract, contact us at the details below.
Identity verification records and profile records	Kept for as long as your account exists. Deleted when you delete your account — including the date of birth, address and photograph returned by DAN.
Request logs	1 year, then deleted automatically.

10. Your rights

10.1. Access and correction

Your profile screen shows the data we hold about you. You can edit your email address yourself. Name, registry number and other civil registry details come from state registries and cannot be edited in the app — if one is wrong, it must be corrected at the registry authority.

10.2. Deleting your account

You can delete your account from inside the app: Profile → Delete account. No phone call and no email is required. If you can no longer sign in, use the account deletion page to send us a request.

A 30-day grace period begins. If you change your mind you can cancel it with a button, or simply by signing in again.
After 30 days: every device is signed out, notifications stop, your message inbox is deleted, links to family members you manage are removed, and your account record is closed. Your phone number is released and can be used to register again.
Identity verification records and profile records are deleted.
What is not deleted: insurance contracts already issued, claim files and payment records. These are the evidence of an insurance relationship and are retained as the law requires. Request logs are removed within 1 year.
Chat conversations are deleted — every message you sent, every answer the assistant gave, and any reports attached to them, permanently removed.

10.3. Withdrawing permission

Location, camera, photo library and notification permissions can be revoked at any time in your phone's settings: Settings → AutoGo on iPhone, Settings → Apps → AutoGo → Permissions on Android. To stop all processing, deleting your account is the only complete route.

11. Children

AutoGo is intended for adults who own or insure a vehicle. We do not knowingly collect data about children under 18. If you believe such data has reached us, tell us and we will delete it.

12. Changes to this policy

Any change is published on this page with a new version and date. If the change materially affects what we collect or who receives it, we will notify you in the app and ask for your consent again.

13. Contact

Gerege Systems

Phone: +976 8881 0109
Email: icesotgoo@gmail.com

Address: Ayud Tower, 12th floor, Olimp 5, 1st khoroo, Sukhbaatar District, Ulaanbaatar, Mongolia

Privacy questions, complaints, and requests for access or deletion are received at the contacts above.