Privacy Policy

1stepoutside is a tour operator registered in Samarkand, Uzbekistan (License №UZ-2024-00115). In this policy "we", "us" and "our" refer to 1stepoutside; "you" refers to anyone who visits our website, contacts us, or books a trip.

This page is maintained by 1stepoutside to explain, in plain language, how we handle personal information. It is not a legal certification. For privacy questions write to 1step@asia.com.

We collect only what we need to plan a trip and stay in touch:

• Contact details you give us via forms, WhatsApp, Telegram or email — name, phone, email, country of residence.
• Booking details required to confirm a departure — passport name, date of birth, dietary needs, emergency contact, relevant medical information.
• Payment metadata — transaction ID, amount, and the last four digits of the card. Full card numbers and CVV never touch our servers; payments are processed by Stripe and Click.
• Account data if you choose to sign up — email and an encrypted password hash, plus any profile fields you add.
• Basic site analytics — page views, device type, referring page. Aggregated and used only to improve the site.

• To answer your enquiries and confirm bookings.
• To send trip logistics — departure briefings, packing lists, meeting points.
• To process payments and issue receipts.
• To send field notes via newsletter — only if you opted in. One click in any email unsubscribes you.
• To meet tax, accounting and tour-operator obligations in Uzbekistan.
• To investigate misuse, prevent fraud and keep our service secure.

We rely on three grounds: (a) contract, when processing is needed to deliver a trip you booked; (b) consent, for newsletters and optional cookies, which you can withdraw at any time; and (c) legitimate interest, for security, fraud prevention, and improving our website — always balanced against your privacy.

Only the partners that make your trip happen, and only the minimum they need:

• Guesthouses, drivers, guides, and activity providers on your itinerary.
• Insurers, when a policy is arranged through us.
• Payment processors — Stripe and Click — who handle card data under their own policies.
• Infrastructure providers — Supabase (database and authentication, hosted in the EU) and Cloudflare (CDN and edge runtime).
• Messaging — Telegram and WhatsApp (Meta) when you message us on those channels, subject to their own terms.
• Government authorities, where the law requires us to disclose information.

We never sell your data and we never share it with advertisers or data brokers.

Some of our processors store data outside Uzbekistan (typically in the EU or US). When this happens we rely on the processor's standard contractual clauses and take reasonable steps to ensure your data receives a level of protection consistent with this policy.

• Enquiries that don't lead to a booking — up to 12 months, then deleted.
• Booking and accounting records — 5 years, as required by Uzbek tax law.
• Account data — kept while your account is active. You can request deletion at any time.
• Newsletter subscribers — until you unsubscribe.

You can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong or out of date.
• Delete your data, where we are not legally required to keep it.
• Export your data in a portable format.
• Stop sending you newsletters (one click in any email).

Email 1step@asia.com and we will respond within 30 days.

We use HTTPS across the site, hashed passwords, row-level access controls on our database, and least-privilege access for our team. No system is ever 100% secure — if you suspect a security issue, write to 1step@asia.com and we will investigate promptly.

We use first-party cookies needed to keep you signed in, remember your currency and language, and measure aggregate site usage. No third-party advertising trackers. You can block cookies in your browser; some features (such as logged-in account pages) will then stop working.

Our website is not aimed at children under 16. We do not knowingly collect their data. Minors travel only when booked by a parent or legal guardian.

If we make material changes we will post the new version on this page with an updated "last updated" date, and — for active customers — notify you by email at least 14 days before the change takes effect.