Privacy Policy
Last updated: 19 August 2026
Who We Are
Purpose Labs Oy (Y-tunnus 3575936-7), Messitytönkatu 9 C 50, 00180, Helsinki, Finland (“we”, “us”, “our”) operates the Limino platform, including the Studio dashboard (studio.limino.app), the Client Portal (my.limino.app), and the Telegram bot. For data protection inquiries, contact us at hello@purposelabs.eu.
What Data We Collect
Account information. When you sign in with Google, we receive your email address, name, and profile picture. Telegram users are identified by their Telegram ID and display name. We also store your language preference and timezone if provided.
Program activity. We track your enrollment, lesson progress, poll answers, free-text task responses, and bot conversation transcripts (including AI-generated scores and feedback). We log key events such as registration, login, program enrollment, and lesson completion with timestamps.
Payment information. When you purchase an AI credit pack, payment is processed through Stripe-hosted Checkout. We send Stripe your Limino account email, an internal account identifier, the selected pack, price, and currency. Stripe processes your card details. Limino records the resulting credit grant and Stripe references needed to apply credits and handle refunds; we do not store your full card number or card verification code.
Uploaded content. Practitioners may upload images, videos, and audio as program content. These are stored in Cloudflare R2.
Generated reports. PDF session reports summarising a client's program activity may be generated and stored in Cloudflare R2.
Onboarding bookings. If you choose the free onboarding route, the booking flow is provided by Calendly. Your browser connects to Calendly when you interact with the booking control or follow the scheduling link. Supported campaign parameters from the landing-page address are added to that link, and Calendly processes the scheduling details you choose to submit.
Error monitoring and landing-page analytics. We use Sentry for error monitoring, which collects IP addresses, browser information, error details, and may include your email and name in error reports. On the public Limino landing site, Google Analytics 4 and Vercel Speed Insights load only after you choose “Accept analytics”. Google Analytics measures visits and interactions, including which Limino entry route and call-to-action location a visitor chooses, together with session statistics, approximate location, and browser and device information. Vercel Speed Insights measures site performance using data such as the route, URL, browser, device type, country, network speed, and Core Web Vitals. These analytics services remain unloaded if you choose “Necessary only” or have not made a choice.
Why We Process Your Data
| Purpose | Legal basis (GDPR Art. 6(1)) | Data categories |
|---|---|---|
| Provide the Service (authentication, program delivery, progress tracking, payments, reports) | (b) Contractual necessity | Account information, program activity, payment information, uploaded content, generated reports |
| AI-powered bot conversations and evaluations | (b) Contractual necessity | Program activity (conversation transcripts, task responses) |
| Error monitoring and service reliability | (f) Legitimate interest: ensuring platform stability, diagnosing errors, and preventing service disruptions | Technical data (IP address, browser information, error details, and in some cases email and name) |
| Measure use and performance of the public Limino landing site, including outreach entry-route choices | (a) Consent — opt-in only | Landing-page usage, interaction events, session statistics, approximate location, browser and device information, and site-performance data |
| Email marketing (product launch notifications) | (a) Consent — opt-in only | Email address |
Providing your data. Account data is required to use the Service; if you do not provide it, you will not be able to sign in or access programs. Payment data is required only when you purchase additional AI credits; without it, that purchase cannot be completed. Marketing and landing-page analytics consent are optional and do not affect your access to the Service.
Who We Share Data With
We share data with the following service providers as necessary to operate the platform. For each processor, we indicate which categories of personal data may be shared.
- Google — authentication (OAuth). Receives: email address, name, profile picture (as part of the sign-in flow). Privacy Policy
- Google Analytics — public landing-site measurement after analytics consent. Receives: page and session data, interaction events, approximate location, and browser and device information. Privacy Policy
- Vercel Speed Insights — public landing-site performance measurement after analytics consent. Receives: route and URL, browser and device information, country, network speed, and Core Web Vitals. Privacy Policy
- Calendly — optional onboarding scheduling. Receives: browser connection data when the booking flow loads and the scheduling details you submit. Privacy Policy
- Stripe — hosted checkout for one-time AI credit packs. Receives: account email, internal account identifier, selected pack, price, currency, and payment details entered during checkout. Privacy Policy
- Telegram — bot messaging and payments. Receives: Telegram ID, display name, message content. Privacy Policy
- OpenAI — AI bot responses and evaluations. Receives: conversation transcripts and task responses. Privacy Policy
- Anthropic — AI bot responses and evaluations. Receives: conversation transcripts and task responses. Privacy Policy
- Sentry — error monitoring (EU region). Receives: IP address, browser information, error details, and in some cases email and name. Privacy Policy
- Cloudflare R2 — file storage. Receives: uploaded media files, generated PDF reports, database backups. Privacy Policy
- Railway — hosting and database. Receives: all data stored in the platform database. Privacy Policy
AI credit-pack purchases are processed through Stripe-hosted Checkout.
We do not sell your data to third parties.
Cookies
Limino uses cookies and browser local storage for authentication, functional preferences, and consented landing-page analytics.
Authentication cookies. The platform uses these strictly necessary cookies:
__Secure-authjs.session-token— session authentication__Secure-authjs.callback-url,__Secure-authjs.pkce.code_verifier,__Secure-authjs.state— OAuth security (temporary, max 15 minutes)
These authentication cookies are first-party, HttpOnly, and Secure.
Landing-page consent preference. After you choose “Accept analytics” or “Necessary only”, the public Limino landing site sets a first-party limino_landing_consent_v1 preference cookie for up to 365 days. The cookie records that a choice has been made. Browser local storage under the same name records whether you accepted analytics or chose necessary storage only. This preference record is functional and does not measure your use of the site.
Optional analytics cookies. If you accept analytics, Google Analytics may set first-party _ga and _ga_<container-id> cookies to distinguish users and sessions. Google Analytics and Vercel Speed Insights stay unloaded until analytics consent is granted. If you change an accepted choice to necessary storage only, the page reloads and the site makes a best-effort attempt to remove Google Analytics cookies.
Calendly booking cookies. The optional embedded booking flow loads only after you interact with an onboarding-call control. Calendly displays its own cookie choices inside that flow and manages its cookies according to the choice you make there.
You can reopen the consent choices through the analytics-preferences control in the landing-page footer. Analytics remains off when the preference record is missing, unreadable, or set to necessary storage only.
The platform also uses browser local storage to remember email marketing preferences and user-interface settings such as sidebar state.
International Transfers
Some processors operate outside the EEA:
- OpenAI and Anthropic process data in the United States. Transfers are governed by Standard Contractual Clauses included in their data processing agreements.
- Google processes data in the United States under the EU–US Data Privacy Framework.
- Cloudflare may process data in various locations globally. Transfers are governed by Standard Contractual Clauses included in their data processing agreement.
- Sentry processes data in the EU (Frankfurt). No transfer outside the EEA occurs.
- Railway hosts data in the United States. Transfers are governed by Standard Contractual Clauses included in their data processing agreement.
You may request a copy of the relevant safeguards by contacting us at hello@purposelabs.eu.
Data Retention
We retain your data for as long as your account is active and for 30 days after account deletion. Payment records are kept for six years to comply with Finnish accounting obligations (kirjanpitolaki). Sentry error logs are retained for 90 days. Database backups run nightly and are retained for 7 days.
After retention periods expire, data is deleted or anonymised.
The public landing site retains its consent preference for up to 365 days, unless you change the preference or clear your browser data. Retention of consented analytics and performance data is governed by the settings of our Google Analytics and Vercel accounts. Contact us for the currently configured periods.
Your Rights
Under the GDPR, you can:
- Access your personal data (Art. 15)
- Correct inaccurate data (Art. 16)
- Delete your data (Art. 17)
- Restrict processing (Art. 18)
- Export your data in a portable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time for marketing communications or public landing-site analytics (Art. 7(3)); withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal. Use the landing-page footer's analytics-preferences control to change the analytics choice.
Contact hello@purposelabs.eu to exercise any of these rights. We will respond within one month.
You also have the right to lodge a complaint with your local data protection authority. A list of EEA supervisory authorities is available at edpb.europa.eu.
Automated Decision-Making
AI models generate conversation responses and evaluate client responses with scores and feedback. These evaluations are educational feedback only and do not produce legal or similarly significant effects on users. No automated decisions restrict access to the Service or determine outcomes beyond the program context.
Children
The Service is not intended for children under 16. We do not knowingly collect data from children and do not implement age verification. Contact us if you believe a child has used the Service.
Security
Data in transit is encrypted via TLS. Sensitive values stored in the database are encrypted at rest. Authentication cookies use HttpOnly, Secure, and SameSite attributes. Database backups are automated nightly.
Changes to This Policy
We will update the “Last updated” date when this policy changes. For material changes, we will notify affected users by email or in-app notice.
© 2025–2026 Purpose Labs Oy
Business ID (Y-tunnus): 3575936-7
Messitytönkatu 9 C 50, 00180, Helsinki, Finland