IISHKI. Legal information
Privacy Policy
The data IISHKI processes, why it is processed, where it is stored, and how to exercise your rights.
1. Operator and Scope
The personal data operator is Individual Entrepreneur Maksim Yuryevich Shelgunov (ИП Шелгунов Максим Юрьевич), Taxpayer ID 21201199940075, address: 413 Kirgizskaya Street, Nizhnyaya Alarcha, Sverdlovsk District, Bishkek, Kyrgyz Republic. Data-related inquiries may be sent to support@iishki.com or through Telegram @maksim_and_ai_support.
This Policy applies to https://iishki.com, the web application, Telegram Mini App, bot, User account, support, and related operations of the IISHKI Service.
This document is the Operator’s policy regarding the processing of personal data and sets out the safeguards applied to it. With respect to personal data of citizens of the Russian Federation, this Policy applies taking into account the requirements of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, including Part 2 of Article 18.1 of that Law.
Individual Entrepreneur Maksim Yuryevich Shelgunov (ИП Шелгунов Максим Юрьевич) is responsible for organising the processing of personal data. Inquiries are accepted through the contacts above.
2. Data We Process
The Operator processes personal data of the following categories of data subjects: Users of the Service, third parties whose personal data are contained in materials provided by Users, and other individuals who contact the Operator.
| Category | Personal data | Purpose |
|---|---|---|
| Account | Telegram ID, username, name, email address, Google, VK ID and Yandex ID identifiers, avatar, sign-in method | Account creation, sign-in, account linking, and support |
| Content | Prompts, images, video, audio, files, outputs, and their parameters | Generation, output storage and delivery, and security |
| Usage | Balance, subscription, generations, favorites, settings, and event logs | Providing the Service, token accounting, and preventing errors and disputes |
| Payment information | Amount, currency, plan, status, and transaction identifier | Payment confirmation, token allocation, refunds, and accounting |
| Technical data | IP address, user agent, cookies, device, timestamps, errors, and diagnostic events | Security, sessions, diagnostics, and abuse prevention |
| Communications | Correspondence, contact details, attachments, and request content | Support and review of complaints and claims |
The Service does not receive full bank-card details, CVC/CVV codes, or passwords for Telegram, Google, VK, or Yandex accounts. These data are processed by the relevant payment and authentication systems.
3. Legal Bases
- Entering into and performing a contract: account, generations, balance, and result delivery.
- Separate consent: personal data processing where required by law, optional analytics, public publication of works, and marketing messages.
- Legitimate interests: security, fraud prevention, protection of rights, and basic diagnostics, following an assessment of proportionality and the right to object.
- Legal obligations: accounting and tax records, responses to public authorities, and retention of transaction evidence for mandatory periods.
Processing takes into account the Digital Code of the Kyrgyz Republic and applicable personal data and consumer-protection laws. Where a User is subject to mandatory laws of another country, including requirements of the Russian Federation, those rules apply to the extent prescribed by them.
4. Recipients and Processors
Data are transferred only to the extent necessary for a specific function:
- Telegram, Google, VK ID, and Yandex ID — authentication; Telegram also delivers notifications at the User’s option.
- Third-party AI model and infrastructure providers engaged for the selected model — processing of prompts and uploaded content only as necessary to provide the requested generation.
- Third-party cloud infrastructure providers — server infrastructure, database, and object storage.
- The payment provider identified during checkout — payment processing, storage of a payment method where separately authorized, and refunds. The Operator remains the seller.
- Third-party monitoring and analytics providers — error diagnostics and optional analytics only after User consent.
- Support contractors and competent authorities — where necessary, under a contract or on another lawful basis.
The list of integrations changes as models change. Before a request is submitted, the interface identifies the selected model. By continuing, the User instructs the Service to transmit the necessary data to that provider.
5. Processing Locations
When personal data of citizens of the Russian Federation are collected, their recording, organization, accumulation, storage, updating (modification), and retrieval are carried out using databases located in the Russian Federation.
Personal data may be processed in countries where the Service’s infrastructure and third-party providers operate, including jurisdictions with different levels of legal protection. Cross-border transfers are based on a contract, consent, or another legal basis provided by law and are limited to the data necessary to provide the Service.
6. Retention Periods
- Account and balance data — while the account is active and then until deletion and mandatory retention periods are complete.
- Completed generations — for at least 180 days from creation unless deleted by the User earlier. After that, scheduled deletion may begin only while the total token balance is zero and no earlier than seven days after notice. Replenishing either token balance cancels a pending countdown.
- Uploaded source files — generally for up to 180 days unless required longer for an active feature.
- Links to source files for failed generations — up to 30 days; inactive reduced-size copies — from 14 days.
- Security, consent, and transaction logs — for the period necessary to protect rights and comply with law; accounting records — for the period required by law.
- Backups may be deleted after a technical delay and are not used for ordinary operations during that period.
7. Public Works
New accounts do not publish works by default. Publication in Inspiration is enabled separately by the User. The work may be displayed together with a display name, avatar, model, and technical parameters. Details are provided in the Publication Consent.
8. Cookies and Analytics
Essential cookies and local storage are used for sign-in, security, language, and settings. Optional analytics are not loaded before the User makes a choice. Analytics can be managed through cookie settings. See the Cookie Policyfor details.
9. User Rights
Subject to applicable law, the User may:
- learn whether their data are processed and obtain information or a copy;
- correct inaccurate data, request deletion, or restrict processing;
- withdraw consent without affecting the lawfulness of earlier processing;
- object to processing based on legitimate interests;
- receive portable data where provided by law; and
- complain to a competent authority or apply to a court.
Requests may be sent by email to support@iishki.com or through Telegram @maksim_and_ai_support. Identity verification may be required to protect the account. If immediate deletion is not possible because of law, a dispute, fraud prevention, or third-party rights, the data will be restricted and deleted after the relevant period ends.
10. Security and Minors
Access controls, encrypted connections, logging, backups, and other reasonable measures are used. Absolute security of data transmission cannot be guaranteed. The Service is intended for persons aged 18 or older and is not designed to knowingly collect children’s data. Please notify the Operator if you become aware of such processing.
11. Changes
The current version, effective date, and version history are available in the Legal Documents section. If the purposes, categories of data, or recipients change materially, the Service will show an in-app notice on the User’s next authenticated visit and request renewed consent before the User continues using the interface where required.