Personal data processing policy
Version 1.0 of October 19, 20261. Operator
The personal data operator is [not specified], taxpayer number (INN) [not specified], registration number (OGRN) [not specified], address: [not specified]. The Genka service is available at https://genka.io.
Questions about personal data are accepted at [not specified]. The person responsible for organizing processing is [not specified]. Number in the Roskomnadzor register of operators: [not specified].
2. Whose data is processed
- visitors of the website;
- users who registered on the website with an email or signed in via Telegram (on the website, in the bot or in the mini app).
3. What data is processed
- account credentials: email and password hash (the password itself is not stored);
- Telegram data when signing in via Telegram: identifier, username, name, interface language, profile photo;
- session data: IP address and browser information (User-Agent);
- IP address for screening sign-ups for abuse and for choosing available payment methods by country;
- request texts (prompts), uploaded photos and generation results;
- conversations with the assistant, conversation summaries, assistant memory and their machine representations for search (embeddings);
- public profile nickname, works published in the gallery, reactions and reports on publications;
- information about the coin balance, tasks and operations in the service.
If payments are enabled, card data is processed by the payment provider. The operator receives only the fact, amount and status of the payment.
Sign-up on the website is protected by a check that tells a person from a program. Third-party analytics and advertising cookies are not used.
4. Purposes and legal grounds
- sign-up, sign-in and account operation, image and video generation, the assistant, coin accounting: performance of the contract with the user (clause 5, part 1, article 6 of Federal Law No. 152-FZ);
- processing and cross-border transfer of data for generation and the assistant: user consent (clause 1, part 1, article 6; article 9);
- protection against abuse, including repeated receipt of welcome bonuses: legitimate interest of the operator (clause 7, part 1, article 6);
- answering user requests: performance of the contract and consent.
5. Processing operations
The operator collects, records, organizes, stores, updates, uses, transfers (in the cases set out in this policy), anonymizes, blocks, deletes and destroys personal data. Processing is automated, including with neural network models.
The public gallery feed is ordered by date or by reactions and is not personalized.
6. Retention periods
- generation results on the website are kept for 30 days, a notice is sent 7 days before deletion, then the files are deleted;
- uploaded photos are deleted after the task is completed, leftovers are deleted within 24 hours;
- images created by the assistant are kept for 30 days;
- server request logs are kept for up to 7 days;
- account data is kept until the account is deleted;
- assistant conversations and memory are kept with no automatic period, until deleted on request to [not specified];
- after an account is deleted, the identifier, email, Telegram ID, date and reason of deletion are kept indefinitely. This protects against repeated receipt of welcome bonuses.
7. Third-party computing resources
The models for generation, prompt improvement and the assistant are open-weight models that the operator runs on rented servers with graphics accelerators. Paid external neural network services and web search are not used. Where data is sent for the models to work is described in the section on cross-border transfer.
The database and user files are stored on servers in the Russian Federation with the cloud provider Timeweb Cloud. Recording, systematization, accumulation, storage and updating of personal data of Russian citizens are carried out in a database located in the Russian Federation.
8. Cross-border transfer
To perform generation and produce assistant replies, request texts, uploaded photos, generation results, assistant messages and memory are sent to rented servers.
As of this version, the rented servers are located in Belgium and France. Data is transferred over a protected channel through a traffic delivery network.
The ground for transfer is the user consent given in a separate section of the document "Consent to personal data processing". The list of countries is given as of the date of this version.
9. Telegram
When signing in via Telegram and chatting with the bot, messages pass through Telegram and are processed by it under its own rules. The operator receives from Telegram the data listed in this policy.
10. Security measures
The operator encrypts the data transfer channel, restricts access to data and systems and stores passwords only as a hash.
11. User rights
- receive information about the processing of their data;
- demand that data be updated, blocked or destroyed if it is incomplete, outdated or processed unlawfully;
- withdraw consent;
- appeal the operator's actions to Roskomnadzor or in court.
Requests are sent to [not specified]. The operator replies within 10 business days; the period may be extended by 5 more business days with notice of the reason.
After consent is withdrawn, processing stops and the data is destroyed within 30 days, except where the law allows it to be kept.
12. Account deletion
An account is deleted in the profile. For an account created via Telegram, deletion is confirmed in Telegram.
On deletion, tasks, payment history, sign-in tokens and account files are deleted; files are deleted in the background. A record that protects against repeated receipt of welcome bonuses, described in the retention section, is kept.
Assistant conversations and memory are deleted on a separate request to [not specified].
14. Changes to this policy
A new version of this policy is published on this page with its number and date. It applies from publication unless it states otherwise.