Legal
Privacy Policy - limko
Last updated: 15.09.2026. This page explains what data we collect, how we use it and how we protect your information.
General provisions
This Personal Data Processing Policy (the “Policy”) is prepared in accordance with Federal Law No. 152‑FZ of 27 July 2006 “On Personal Data” and describes how personal data is processed and protected by Anton Aleksandrovich Lukinov (self‑employed, TIN 615148170623), operating under the limko brand (the “Operator”).
The Policy applies to all information about Users that the Operator receives when they use https://limko.ru, its subdomains, the limko Telegram bot and related services (the “Service”). Using the Service means that you accept this Policy. If you do not agree with it, please do not use the Service.
The Policy is an integral part of the Terms of Service and explains the Consent to Personal Data Processing that Users give when registering.
For any questions about personal data, write to support@limko.ru.
Key terms
- Personal data means any information relating directly or indirectly to an identified or identifiable User.
- Processing means any operation performed on personal data, with or without automated means: collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion, destruction.
- Operator means the person who organises the processing of personal data and determines its purposes, the data involved and the operations performed on it.
- User means any person who visits the website and/or uses the Service, including without registration.
- Anonymisation means actions after which it is impossible, without additional information, to attribute data to a specific User.
- Destruction means actions after which personal data cannot be restored.
- Cookies are small text records that the website stores in the User’s browser and that the browser sends back with subsequent requests to the website.
- Local storage means data that the website stores in the browser on the User’s device (localStorage, sessionStorage) and that is not sent to the server automatically.
Rights and obligations of the Operator
The Operator has the right to:
- obtain accurate information and documents containing personal data from the User;
- continue processing personal data after consent is withdrawn where the law of the Russian Federation allows it;
- determine the measures necessary and sufficient to comply with personal data legislation.
The Operator undertakes to:
- provide the User, on request, with information about the processing of their personal data;
- organise the processing of personal data in accordance with the law of the Russian Federation;
- respond to requests of Users and their representatives within the statutory time limits;
- take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision or dissemination;
- stop processing and destroy personal data in the cases and in the manner provided by law.
Your rights and how to exercise them
You have the right to:
- learn which of your personal data is processed and for what purpose;
- request that your personal data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed for the stated purpose;
- withdraw your consent and demand that processing stop, unless the law provides otherwise;
- opt out of informational and promotional messages;
- appeal the Operator’s actions or inaction to Roskomnadzor or a court.
How to do it:
- change your name, avatar, language and theme — in “Profile”;
- delete individual generations and their files — in your history or gallery; files are removed from storage immediately;
- delete your account — “Profile” → “Delete account” (the consequences are described in section 10);
- unsubscribe from mailings — via the link in the email or by writing to support@limko.ru;
- withdraw consent, request a copy, correction or destruction of your data — by emailing support@limko.ru from the email address linked to your account.
The Operator replies within the statutory period (no more than 10 business days; this may be extended by up to 5 business days with notice to the User).
Processing principles
- processing is lawful and fair;
- processing is limited to specific, predefined and legitimate purposes;
- processing incompatible with the purposes of collection, and merging databases with incompatible purposes, is not allowed;
- only the data needed for the stated purposes is processed;
- the accuracy, sufficiency and relevance of data are ensured;
- data is kept no longer than the purposes require, unless a different period is set by law or contract;
- once the purposes are achieved, data is destroyed or anonymised.
What data we process, why, and on what basis
The Operator processes only the data needed to run the Service. Special categories of personal data (health, beliefs, etc.) and biometric data are not collected: uploaded images are used solely to perform the requested generation and are not used to identify anyone.
| Category | What exactly | Purpose | Legal basis |
|---|---|---|---|
| Account | email address, name (nickname), password (stored only as a hash), avatar, interface language and theme; when signing in with Yandex ID or VK ID — your identifier in that service plus the name, email and avatar it provides; when connecting the Telegram bot — Telegram ID, name and username | registration and sign‑in, account area, access recovery, service notifications (email verification, password reset, credit top‑ups) | contract (Terms of Service), consent |
| Age | date of birth and adult‑confirmation flag | access to 18+ sections; used only for this check | law, consent |
| Payments | payment ID, amount, status, selected credit package; your email address is passed to the payment service to send the receipt. Card details are entered on the YooKassa page — the Operator never receives or stores them | accepting payments, crediting your balance, issuing receipts (Federal Law 54‑FZ), accounting | contract, law |
| Content | text prompts and generation settings; uploaded images, audio and other files; generation results and history | performing generations, showing history and gallery, calculating cost, support | contract |
| Technical data | IP address, browser and device type (user agent), request time and URLs, session and cookie identifiers, error logs | security, abuse and bot protection, troubleshooting | legitimate interests of the Operator (clause 7, part 1, article 6 of 152‑FZ) |
| Analytics | anonymised statistics of visits and on‑page actions collected by Yandex Metrica (section 8) | improving the Service, measuring advertising | consent |
| Support requests | name, email address, message text, technical request data | responding to requests, support | consent, contract |
| Referral programme | referral code, the fact of following an invite link (cookie), the fact that the invited User registered | awarding programme bonuses | contract |
| Mailings | email address, Telegram ID, delivery and open data | news, updates and promotions of the Service; you can opt out at any time (section 4) | consent |
Data that the User enters is provided voluntarily. An account cannot be created without an email address or sign‑in via an external service.
Cookies and local storage
The Service uses cookies and browser local storage. Some are required for the website to work (sign‑in, form protection), others serve Yandex Metrica analytics. Public pages (home, tool descriptions, legal pages) do not create session cookies — they appear when you sign in to your account.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
app_session | limko | sign‑in session | 2 hours after the last action |
XSRF-TOKEN | limko | protection of forms against request forgery (CSRF) | 2 hours |
creator_ai_ref | limko | invite‑link code so the inviter’s bonus is credited after registration | 30 days |
cookie_notice | limko | marks that the cookie notice has been shown | 1 year |
_ym_uid | Yandex Metrica | identifier to distinguish visitors | 1 year |
_ym_d | Yandex Metrica | date of the first visit | 1 year |
_ym_isad | Yandex Metrica | detects ad blockers | 20 hours |
_ym_visorc | Yandex Metrica | Webvisor operation | 30 minutes |
yandexuid, i and other yandex.ru cookies | Yandex | visitor identification across Yandex services; full list in the Yandex Metrica cookie reference | up to 1 year |
In browser local storage the Service keeps: the selected theme, flags for dismissed hints and the app‑install prompt, editor drafts and settings, technical marks used to record a purchase in analytics (payment ID), and Yandex Metrica service records (keys prefixed _ym_). This data stays on the User’s device and is removed when site data is cleared in the browser.
Cookies can be deleted or blocked in browser settings; without the required cookies you cannot sign in. Yandex Metrica collection can be disabled with the Yandex Metrica blocker extension or with tracker‑blocking features of your browser.
On the first visit the Service shows a notice about the use of cookies and Yandex Metrica. Continuing to use the Service after that means you accept this section.
Analytics and external resources
Every page of the Service includes Yandex Metrica counter No. 108266831 (Yandex LLC). Metrica collects: visited page URLs and referrer, device, browser and OS type, screen resolution, approximate location by IP address, on‑page actions (clicks, scrolling) and anonymised purchase data for credit packages (payment ID, amount, package name — no card data and no User name).
On devices with a mouse, Webvisor, click map and link map are enabled: Metrica records cursor movements, clicks, scrolling and page content. Recordings are used only to improve the interface. Webvisor does not record passwords; card details are entered on the payment provider’s page and never reach the Service. On touch devices Webvisor and the click map are disabled.
Yandex processes Metrica data on behalf of the Operator under the Yandex Metrica Terms of Use and the Yandex Privacy Policy. The counter script is loaded from mc.yandex.ru and mc.yandex.com.
Fonts on public pages are loaded from external font CDN servers. When loading a font the browser sends these servers your IP address and standard request headers; they receive no other data about you.
There are no other analytics systems, advertising pixels or social‑network widgets in the Service.
Sharing with third parties
The Operator does not sell personal data. Data is shared only with parties involved in providing the Service, to the extent needed for the task, or upon a lawful request from public authorities.
| Recipient | What is shared | Purpose |
|---|---|---|
| Hosting provider | all Service data: servers, database, storage of generation files, email delivery | hosting, storage, email delivery |
| YooKassa (NCO YooMoney LLC) | amount and purpose of the payment, payment ID, email address for the receipt | payments, receipts |
| Yandex LLC | visit statistics (Yandex Metrica); prompt text — for automatic translation into English; profile data when signing in with Yandex ID | analytics, prompt translation, sign‑in |
| VK LLC | when signing in with VK ID — identifier, email, name, avatar | sign‑in |
| Telegram | when connecting the bot — Telegram ID, name, username, messages sent to the bot (policy) | notifications and bot features |
| AI model providers (primary and fallback) | prompt text, generation settings, uploaded images, audio and files; results are produced on the provider’s infrastructure. If the primary provider is unavailable, the request goes to the fallback provider, which passes it to the provider of the selected model | running AI models |
| Font CDN providers | IP address when loading fonts on public pages | fonts |
AI model providers. To perform generations, prompt text and uploaded materials are transferred to AI model providers. Your account data (email address, name, identifiers) is not shared with model providers: requests are sent on behalf of the Operator. Providers process the data under their own policies; the Operator does not use Users’ prompts and materials to train models. You consent to such transfers by accepting the Consent to Personal Data Processing; without it generations cannot be performed. The names of the specific providers are available from the Operator on request.
Personal data is disclosed to public authorities only upon a request based on law.
Retention and deletion
- account data — for as long as the account exists;
- generations, their history and results — until you delete them yourself or delete your account; when a generation is deleted, its files are removed from storage immediately;
- source files uploaded for generation — up to 24 hours after upload, unless they became part of a generation result;
- technical logs (IP address, user agent, request URLs) — 1 month;
- support requests — up to 3 years after the reply;
- payment records — for the document‑retention periods set by tax legislation (at least 5 years);
- Yandex Metrica data — according to Yandex’s policy;
- database backups — 7 days.
Account deletion. You can delete your account in “Profile” (“Delete account”). After confirmation your name, avatar and password are erased immediately, the account is blocked and marked as deleted, and the remaining credits are voided. Generation history and related files are deleted by the Operator within 30 days. The email address is kept together with payment records for the period required by law and is not used for mailings.
Anonymised statistics (for example, the number of generations per tool) may be kept indefinitely.
Data protection
- all connections to the Service are protected with TLS (HTTPS);
- passwords are stored only as hashes and cannot be recovered from the database;
- servers, the database and file storage are located in Russia; only the Operator has access to them, via access keys;
- request rates are limited and abusive IP addresses are blocked;
- backups are made regularly; access logs are kept for a limited time;
- the Operator never asks for passwords or confirmation codes by email or in messengers.
The Operator and anyone who gains access to personal data must not disclose or distribute it without the User’s consent, unless federal law provides otherwise.
Final provisions and contacts
Send questions about personal data to support@limko.ru or use the contacts page.
The Operator may update this Policy. The new version is published on this page with its date; material changes are announced in the Service interface or by email. A version remains in force until replaced by a new one.
Revision date: 15.09.2026.