This page says what data the site https://litaulabs.com ("the site") receives, why, how long it is kept and what you can do about it. I am based in Russia, so Russian law on personal data (Federal Law No. 152-FZ) applies to me. I also keep to the basic principles you know from the GDPR and similar laws in the EU, the UK, Australia and the US: collect little, say what for, keep it short and delete it on request.
1. Who handles the data
The data controller is Ilya Litau, a self-employed individual (a professional income tax payer in Russia).
For every question about personal data, write to litaui100@gmail.com.
2. The site has no forms and no sign-up
The site has no lead forms, no user accounts, no registration and no payments. I do not ask you to leave data on the site. Data reaches me in three cases:
- You write to me yourself on WhatsApp, Telegram, Instagram or email.
- You use the Litau AI Chat on the site's pages.
- The site and the services connected to it receive technical data about your visit automatically.
3. What data is processed
3.1. When you write to me
You click a link to WhatsApp, Telegram, Instagram or email, and an outside service or your mail app opens. I receive what you send:
- your name or nickname, your phone number (on WhatsApp), your username (on Telegram or Instagram), your email address;
- the text of your message and any files and links you attach;
- a prefilled line naming the page you came from (for example, "Hello, I'm writing from the page /en/services/"). It is placed in the message automatically, and you can edit or delete it before sending.
The site itself does not collect this data. It goes straight to the service you chose, and that service's own rules apply (section 7).
3.2. When you use the Litau AI Chat
The chat runs on some pages of the site, from a separate domain, widget.litaulabs.com. If you write in the chat, these are processed:
- the text of your messages and the chat's answers;
- technical data about the session: a conversation ID, message times, your IP address, browser data;
- contact details (name, phone, email, Telegram username) if you give them in the conversation.
Please do not type passport numbers, card numbers, medical or other sensitive details into the chat. They are not needed for a project.
The chat's answers are written by a language model (artificial intelligence). To produce them, the text of your message is sent to the model provider (section 7). The chat does not make decisions about you that have legal effect.
3.3. Technical data when you visit
When any page opens, the hosting server and the connected services receive:
- your IP address and the approximate location it gives (country, city);
- your browser type and version, operating system, device type and language;
- the address of the page you asked for, the page you came from, and the date and time;
- technical details of the request (response code, size of the data).
For overall visit statistics the site may use Cloudflare Web Analytics. It is aggregated statistics without advertising profiles.
3.4. Web analytics (Yandex Metrica)
The site runs the Yandex Metrica counter No. 113767236 (service operator: YANDEX LLC, Russia). Metrica uses cookies and receives: the pages you viewed, where you came from and how long you stayed; clicks on links and buttons; technical data about your device and browser, an approximate location and your IP address.
Webvisor and the click map are switched on. Webvisor records what a visitor does on a page, such as mouse movement, clicks and scrolling, so that I can see where people get stuck. The click map shows where people click most. How Webvisor treats input fields and what masking hides is described in Yandex's documentation. Chat conversations are not sent to Metrica.
Metrica data goes to Yandex and is handled by Yandex under its own rules (Russia). You can opt out of Metrica in your browser settings (block cookies) or with an ad and tracker blocker. General help: yandex.ru/support/metrica.
3.5. Cookies and data in your browser
The site itself sets no advertising cookies. Cookies and browser storage records are created by connected services: Yandex Metrica and the Litau AI Chat (to keep the current conversation). You can block or delete cookies in your browser settings. All sections of the site will keep working.
3.6. Fonts
The site's fonts are stored on the site itself (self-hosted, served from litaulabs.com/fonts/). The pages do not load fonts from Google Fonts, Bunny Fonts or any other font service, so loading a font sends your IP address and browser data only to the site's own host (Cloudflare, section 7), like any other file on the page.
4. Why the data is needed
- to answer your message, discuss a project and prepare a proposal and a quote (data from 3.1, and from 3.2 if you use the chat);
- to carry out an order if you decide to work together: contacts, correspondence and the data you give me for the work;
- to run the Litau AI Chat: answering questions about the services and passing the conversation to me (3.2);
- to keep the site running and safe, and to protect it from attacks and failures (3.3);
- to understand which pages are useful and to improve the site, and to see which page a message came from (3.4 and the prefilled line in 3.1);
- to meet legal requirements: bookkeeping, taxes, answers to requests from state bodies.
The data is not used for mailings you did not ask for, and it is not sold.
5. On what basis
- Your message to me, preparing a proposal at your request and then carrying out the order: the need to deal with your request and to perform a contract with you.
- The Litau AI Chat, Yandex Metrica and cookies that the site does not need to work: your consent. Consent is shown by your action: sending a message to the chat after reading this policy, and carrying on in a browser where analytics is not blocked. If you do not agree to Metrica, block it in your browser or close the site.
- Technical data needed for the site to work and stay safe: my legitimate interest, as long as it does not override your rights.
- Keeping documents and answering requests from authorities: obligations set by law.
You can withdraw consent at any time (section 9). Withdrawal does not affect processing that happened before it.
I do not process special categories of data (health, beliefs, biometrics) and I do not collect data from children. The site is for people over 18.
6. How the data is processed and how long it is kept
Processing is partly automated and partly manual. Actions: collecting, recording, storing, updating, using, transferring (in the cases of section 7), anonymising, blocking, deleting.
- Messages in messengers and by email: no longer than needed to answer your message and carry out the order.
- Litau AI Chat conversations: no longer than needed to answer your request.
- Receipts and documents for completed orders: as long as accounting and tax law requires.
- Server logs and attack-protection data: under Cloudflare's rules.
- Yandex Metrica data (including Webvisor recordings): under Yandex's rules.
When the purpose is reached, when you withdraw consent or when you ask, the data is deleted or anonymised within 30 days, unless the law requires me to keep it longer.
Protection: only I have access to the data, the site uses an encrypted connection (HTTPS), and I use established providers.
7. Who receives the data, and where it goes
I do not sell data and I do not pass it to third parties for advertising. The data goes to the services without which the site and our conversation would not work. Each has its own rules.
- Cloudflare, Inc. hosts the site (Cloudflare Pages) and provides the CDN, attack protection, logs and visit statistics. United States, with servers around the world.
- YANDEX LLC runs Yandex Metrica (the counter, Webvisor, the click map). Russia.
- Hosting and database providers of the Litau AI Chat run the chat and store conversations. Their servers may be outside Russia.
- Anthropic, PBC (Claude) provides the language model behind the chat and prepares its answers. United States.
- WhatsApp, Instagram (Meta), Telegram, Google (Gmail), only if you chose that channel: the service stores and passes on your conversation with me.
Transfers across borders
Some of these services (Cloudflare, the chat's model provider, the messengers) are outside Russia, including in countries that may not protect personal data to the standard of your own country. The transfer happens when you open the site, use the chat or pick a messenger. It rests on your consent and on the fact that the transfer is needed for what you asked for. If you do not agree, do not use the chat, and you can block third-party requests in your browser while browsing.
I may disclose data on a reasoned request from a court or a state body, in cases the law clearly provides for.
8. Links to other sites
The site links to outside resources: messengers, social networks, and the sites of clients and partners (including nexoralegal.ru). I am not responsible for their privacy policies. Read the rules of a site before you give it your data.
9. Your rights
You may:
- ask whether I process your data and get details of the processing (source, purposes, methods, periods, recipients);
- ask me to correct, block or delete data that is incomplete, out of date, obtained unlawfully or not needed for the stated purpose;
- withdraw your consent to processing;
- complain about my actions to the Russian regulator Roskomnadzor (rkn.gov.ru) or to a court;
- claim compensation for damages in court.
If you live in the EU, the UK, Australia, the US or elsewhere with its own data law, I treat a reasonable request under that law in the same way.
How to use your rights: write to litaui100@gmail.com from the address you wrote to me from, or from the messenger where we talked. Give the name you used and say what you want. To make sure the request comes from you, I may ask you to confirm your identity in a way that needs no extra data.
I answer a request for details of processing within 10 working days (this can be extended by 5 working days, with reasons). A request to correct, block or delete data is answered within the period set by Article 21 of Federal Law 152-FZ.
10. Changes to this policy
I may update this policy. The new version is published on this page with the date at the top. If the changes widen the purposes of processing in a material way, I will ask for your consent separately.
11. Contact
Controller: Ilya Litau, self-employed.
Email for personal data questions: litaui100@gmail.com
Site: litaulabs.com
Last updated: October 27, 2026. By Ilya Litau.