Legal

Last updated: 20 October 2026

Terms of service

1. Who we are

Limen ("the Service") is operated by Muhammad Talha, an individual based in Abu Dhabi, United Arab Emirates, trading as Limen ("we", "us"). Limen is not a registered company. It holds no commercial register entry, no UAE e-commerce trade licence and no VAT registration. Contact: hello@limen.ae.

By using the Service you agree to these terms. If you do not agree, do not use the Service.

2. What the Service does, and what it does not do

The Service performs automated static analysis of HTML and CSS that you supply, reports detected failures against WCAG 2.1 Level AA, generates suggested remediation, and produces draft documents including an accessibility statement and an evidence record.

The Service does not provide legal advice. It is a software tool. It does not create a lawyer–client relationship, and it is not a substitute for advice from a qualified lawyer in your jurisdiction.

The Service does not certify conformance and never will. Automated testing can evaluate only a subset of the WCAG success criteria. We state this prominently throughout the product. Any check that cannot be proven from the source you supply is reported separately as requiring human review and is excluded from your score. You must not represent the output of the Service as a certificate of compliance, a conformance audit, or an accessibility conformance report to any third party.

Documents generated by the Service, including the accessibility statement, are drafts based on the information you supply and the results of an automated scan. You are responsible for reviewing them for accuracy before publishing them.

3. Your responsibilities

• You confirm you are authorised to submit the page source you analyse.
• You will not use the Service to analyse a third party's website in order to identify them as a target for litigation or an unsolicited demand.
• You will not represent our output as more than it is (see clause 2).
• You are responsible for implementing the suggested changes and for testing that they work on your own site.

4. Licence

On purchase, you receive a non-exclusive, non-transferable licence to use the Service and the generated documents for the website or websites covered by your purchase. Reports and documents generated for your own sites are yours to publish, share and submit to any authority or court. You may not resell access to the Service itself except under an Agency plan.

5. Availability

The scanning engine runs entirely in your browser and does not depend on our servers being available. We do not guarantee uninterrupted availability of the website, purchasing or support functions.

6. Liability

Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be excluded — including, for consumers in the European Union and the United Kingdom, statutory rights that cannot be waived, and, for consumers in the United Arab Emirates, rights under Federal consumer protection law.

Subject to the paragraph above, and to the maximum extent permitted by law, our total aggregate liability arising out of or in connection with the Service is limited to the amount you paid us in the twelve months preceding the event giving rise to the claim.

We are not liable for the outcome of any legal proceeding, demand, regulatory action or settlement. The Service reports what automated analysis can demonstrate; it does not and cannot guarantee any legal result.

7. Governing law and disputes

These terms are governed by the laws of the United Arab Emirates, and the courts of Abu Dhabi have exclusive jurisdiction, except that: consumers resident in the European Union may bring proceedings in their country of residence and retain the protection of its mandatory consumer law; and consumers resident in the United Arab Emirates retain their rights under UAE Federal consumer protection law and may bring proceedings before the competent UAE courts.

8. Changes

We may update these terms. Material changes will be notified on this page with a revised date. Changes do not apply retroactively to a purchase already made.

Privacy policy

1. Controller

The data controller is Muhammad Talha, trading as Limen, Abu Dhabi, United Arab Emirates. For privacy enquiries, to ask what is held about you, or to object to being contacted, write to hello@limen.ae. A UK resident may also complain to the Information Commissioner's Office at ico.org.uk.

This policy is written to satisfy the EU General Data Protection Regulation (GDPR), the UK GDPR, and the United Arab Emirates Personal Data Protection Law (Federal Decree-Law No. 45 of 2021 and Cabinet Resolution No. 33 of 2024).

2. What we do not collect

We want to be specific, because this is the unusual part. When you run a scan:

• Your page source is processed by JavaScript in your own browser tab.
• It is not uploaded, not transmitted, not logged and not stored on any server.
• We never receive it and could not produce it if asked.
• Your scan results, exposure score and findings are likewise never transmitted to us.

This is also why the Service works on staging environments, password-protected pages and logged-in checkout flows.

The free check of a public web address works differently, because it checks a page you do not have open: when you enter an address at limen.ae/scan, or open a link to it, our server fetches that public page, checks it and sends back a summary. The page itself is not stored. The summary is held in Cloudflare's cache for ten minutes, so a link shared in a forum does not make us fetch the same shop again for every reader. We record which website was checked, on which day, and whether the check was started by our own outreach tool or from the page, together with the short channel tag of the link that led there if it carried one (such as “hn” for Hacker News), and nothing about who started it: no IP address, no identifier, no cookie. Those records are deleted after 90 days. To stop one visitor using the scanner to fetch other people's sites in bulk, each request is counted against a keyed one-way hash of the visitor's IP address, which is deleted after an hour.

Clicks on the buy buttons. When you click a button to buy the Fix Pack or the Evidence Pack, on our home page or under a free-check result, your browser tells our server which of the two you clicked, which of those two pages the button was on, and the short channel tag of the link that brought you to the site if it carried one. We count those clicks per day, product, page and channel tag, and record nothing about who clicked: no IP address, no identifier, no cookie, and nothing about whether you went on to buy (the purchase itself happens at Payhip, under its own privacy notice). The counts are deleted after 90 days. Each click is counted against the same keyed one-way hash of the IP address, deleted after an hour, so one visitor cannot inflate the numbers.

Counting page views. When a page of limen.ae opens, your browser tells our server which page it was (its path, such as “/scan”), the short channel tag of the link that brought you to the site if it carried one, and the host name of the site you came from, such as “www.google.com” (never the full address). Our server keeps only a count per day, page, channel tag and kind of referring site (“google”, “reddit”, “webmail”, our own pages and so on): the host name itself is reduced to that kind and not stored. We record nothing about who you are: no IP address, no identifier, no cookie, no user agent. The counts are deleted after 90 days. Each view is counted against the same keyed one-way hash of the IP address, deleted after an hour, so one visitor cannot inflate the numbers. We use these counts to see how many people a link or a search brings, instead of using an analytics service that would need cookies.

Steps of the free check and the fix service. When you start a free check, when it finishes or fails, when you open the fix service page, click through to it from a result, send and confirm a fix request, or ask for, confirm and receive the top 3 fixes email, your browser tells our server the name of that step (such as “check_completed”) and the short channel tag of the link that brought you to the site if it carried one. We keep only a count per day, step and channel tag: no IP address, no identifier, no cookie, and nothing about which site you checked. The counts are deleted after 90 days. Each event is counted against the same keyed one-way hash of the IP address, deleted after an hour, so one visitor cannot inflate the numbers. We use them to see where people stop between the free check and a fix request.

3. What we do collect

Payment card details are handled directly by our payment processor, Payhip, with payments processed by PayPal. We never receive or store your full card number.

3a. Alternative-text generation

Almost everything this product does happens inside your browser, and your page source never leaves it. There is one exception, and it is opt-in every time you use it: generating draft alternative text for images. To describe an image, the image has to be looked at.

When you use that feature, and only after you tick the consent box shown beside it, the following is sent to Anthropic PBC, acting as our processor, for the sole purpose of generating the descriptions:

• the web addresses of the images that were found to have no alternative text; and
• the image files retrieved from those addresses.

Your page source is never sent — not for this feature, and not for any other. The images concerned are already published on your own public website. We retain a count of how many images you have described in the current month, in order to apply your licence allowance; we do not retain the images or the generated descriptions. Anthropic's handling of the data is governed by its commercial terms, under which it does not use the content to train its models.

If you never use the feature, nothing is ever transmitted. Our contact details for questions about this processing are at the end of this document, and our data processing agreement with this processor is available on request to hello@limen.ae.

4. Browser storage

We use your browser's local storage to remember your language and colour theme. This never leaves your device, is not a cookie, is not used for tracking, and is not shared. Because we set no advertising or analytics cookies, no consent banner is required.

4a. Business outreach

We sometimes write to UK companies about accessibility problems we have found on their own websites. If you received such an email, this section tells you where your details came from and what to do about it. It is the notice required by Article 14 of the UK GDPR, which covers personal data obtained from a source other than the person it concerns. Companies in France are written to in French, and their notice, in French, is at limen.ae/fr/confidentialite.

What we hold. A company name and registration number, a registered office address, a website address, one business email address published on that website, and the findings from an automated accessibility check of that website's home page. If the free-check link in our email is used, we also see that the website was checked and on which day, as described in section 2; not who opened it. We do not hold names of individuals, job titles, phone numbers or anything about the people who work there. Where a published address happens to identify a person — a firstname@ mailbox, for instance — that address is the only personal data in the record.

Where it came from. Two public sources, both of them published by the company itself. Company details come from the Companies House Free Company Data Product, filtered to companies that registered SIC code 47910, “retail sale via mail order houses or via Internet”. The email address comes from the company's own website, where UK companies are in any case required to publish contact details under the Companies (Trading Disclosures) Regulations 2008. We did not buy a list, and we did not scrape social media.

Web agencies. We also write, once, to UK web agencies that list themselves in the Shopify Partner Directory, about checking their clients' shops. For these we hold the agency's name, its Companies House name and number, the business email address it publishes under “Contact information” on its directory profile for exactly this kind of enquiry, and the address of that profile. We write only to agencies that are registered companies (corporate subscribers under the Privacy and Electronic Communications Regulations), never to an address at a free mail provider, and the legitimate interest, retention, opt-out and rights described in this section apply in the same way. Since October 2026 we also write, once and in French, to agencies in France listed in the same directory. For these we hold the agency's name, the company name and SIREN number shown on its own website and confirmed in the French Sirene register, the business email address on its directory profile, and the address of that profile. We write only to companies, never to an individual entrepreneur and never to a personal or free-mail address; the French notice at limen.ae/fr/confidentialite says the same.

Why we may do this. Our legitimate interest in telling a business about a defect on its own website, under Article 6(1)(f). We have weighed that against the recipient's interests: the message is a single email, it concerns the recipient's own business rather than their private life, it contains specific findings rather than generic marketing, and it offers a one-word opt-out. Under the Privacy and Electronic Communications Regulations, email to a corporate subscriber does not require prior consent — but a lawful email is still an unwelcome one if it keeps arriving, which is why one reply ends it permanently.

How long we keep it. Contact details are deleted within six months of the last message unless you reply and ask us to continue. What remains is the website address and the date we wrote, so that the same company is never written to twice. Where you ask not to be contacted, we keep the email address on a suppression list indefinitely and for that purpose only — forgetting it is precisely how a company ends up being written to twice. That is the narrower and more privacy-preserving choice, and we would rather explain it than quietly deviate from a stated retention period.

Stopping it. Click the opt-out link at the end of the email, reply with “no thanks”, or write to the address in section 1. The link records the address on our suppression list at once, with its domain and the date and nothing else, and no further email is sent to it from any of our tools. You do not need to give a reason and you will not be asked for one. You may also object under Article 21(1), ask for a copy of what we hold under Article 15, or have it erased under Article 17, and you may complain to the Information Commissioner's Office at ico.org.uk.

4b. Founding testers

Until 31 October 2026 we give 20 free Fix Packs to shop owners who apply on limen.ae/testers, in exchange for feedback. If you apply, we hold your name, email address, shop address, platform, language, the note you write (if any) and the channel tag of the link that brought you (for example agency). Nothing is reserved until you confirm by clicking the link we email you; an application that is never confirmed is deleted after seven days.

What we send. The confirmation email, then your code with the steps to use it, then one reminder three days later with the five questions. That is all. Every one of these emails has a one-click link that stops the rest. The code itself is redeemed through the ordinary Payhip checkout, so Payhip handles that order exactly as it handles a paid one (see section 5).

Your answers and quotes. Your answers to the five questions are read by us and used, in aggregate, to decide what to change in the product; they are never published. A quote appears on limen.ae only if you tick the box that allows it, give the name to show with it, and we approve it. Editing the quote takes it down until we approve the new text, and you can have it removed at any time by replying to any of our emails.

Why we may do this, and for how long. Your consent, given by ticking the box and confirming by email, under Article 6(1)(a). You can withdraw it at any time, which does not affect what happened before. We delete the programme's records on 31 January 2027, or at once if you ask. A shop address is held while the programme runs only to keep it to one spot per shop.

4c. Fix requests

If you ask us on limen.ae/fix to fix the accessibility problems on your store, we hold your name, email address, store address, platform, the size you picked, the message you write (if any), your language and the channel tag of the link that brought you. Nothing happens until you confirm by clicking the link we email you; a request that is never confirmed is deleted after seven days. Once you confirm, the request is emailed to us and we reply with a written scope and a fixed price.

Why we may do this, and for how long. To answer your request and, if you go ahead, to perform the contract you ask for, under Article 6(1)(b). Confirmed requests are deleted from our server after twelve months; if you become a client, the scope, invoices and evidence document are kept as long as accounting law requires. During the work we never ask for or store your store password, and we need no access to your store: you send us a copy of your theme and, for image descriptions, a product export, and we send them back fixed for you to upload.

5. Sharing

We share personal data only with processors necessary to run the business — payment processing, email delivery (Zoho for our own correspondence, Resend for the monthly re-check emails, the top 3 fixes email and the founding tester emails you ask for, and for fix-request emails), hosting, and, where you have opted in, alternative-text generation as described in section 3a — each bound by a data processing agreement. We do not sell personal data. We do not share it for advertising.

6. International transfers

Where personal data is transferred outside the EEA, the UK or the UAE, we rely on adequacy decisions where they exist, and otherwise on Standard Contractual Clauses or equivalent safeguards. Under the UAE PDPL, cross-border transfer is permitted to jurisdictions with adequate protection or subject to appropriate contractual safeguards.

7. Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, and to receive it in a portable format. Under the UAE PDPL you additionally have the right to be informed about how your data is processed and to request that processing be stopped.

To exercise any right, contact hello@limen.ae. We respond within 30 days, which is the maximum period allowed under the UAE PDPL and within the GDPR limit.

If you are unhappy with our response you may complain to your national supervisory authority. In the United Arab Emirates this is the UAE Data Office. In the European Union it is the data protection authority of your member state.

8. Security

The single largest security decision in this product is architectural: because your page source never leaves your browser, there is no database of customer website source code to breach. That remains true of every paid feature — the monitoring tier stores scores, counts and a content hash rather than the page itself, precisely so that this statement stays accurate. For the data we do hold, we apply access controls, encryption in transit, and encryption at rest with our processors.

9. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Refunds and withdrawal

1. Statutory right of withdrawal (EU, EEA and UK consumers)

As a consumer you normally have 14 days to withdraw from a distance contract without giving a reason.

Because Limen is digital content supplied immediately, at checkout you are asked to tick a box giving express prior consent to immediate supply and acknowledging that you thereby lose your right of withdrawal once supply has begun. This is required by the Consumer Rights Directive; without both the consent and the acknowledgement the waiver is not valid, so the checkbox is mandatory and is never pre-ticked.

If you do not wish to waive the right, do not tick the box — your access will begin after the 14-day period instead.

2. United Arab Emirates consumers

Nothing in this policy limits your rights under UAE Federal consumer protection law, including in respect of a service that does not conform to its description. Where this policy and UAE law differ, UAE law prevails for UAE consumers.

3. Our own refund promise, which is broader than the law requires

We would rather refund you than have an unhappy customer holding a document they do not trust. We refund in full, on request, in each of these cases:

• You changed your mind. Within 14 days of purchase, for any reason or none, we refund in full. No questions, and it does not matter whether you have downloaded the report or the evidence record.
• Nothing useful was found. If a scan reports no failures and a paid manual audit later demonstrates that the same automated checks were in fact failing, we refund in full.
• The product did not do what this website says. Within 30 days of purchase, tell us what you expected and did not get. If we cannot fix it, we refund.
• A duplicate or accidental purchase. Refunded on request, no time limit.

After the first 14 days, we do not refund where the product performed as described and the remediation was simply not implemented.

4. How to request a refund

Email hello@limen.ae with your order reference. We respond within 5 business days and process approved refunds to the original payment method within 14 days.

5. Subscriptions

Watch and Agency plans may be cancelled at any time and continue until the end of the paid period. We do not charge a cancellation fee and we do not require notice.

Accessibility statement

This statement applies to the Limen website and the Limen audit tool.

1. Conformance status

We target WCAG 2.1 Level AA, the standard referenced by EN 301 549 for the European Accessibility Act, by the German BFSG, by the US Department of Justice under the ADA, and by the UAE National Digital Accessibility Policy and the Dubai Universal Design Code.

This site is substantially conformant with WCAG 2.1 Level AA. We do not claim full conformance on the basis of automated testing, because — as we say throughout the product — automated testing evaluates only a subset of the success criteria.

2. How we test

• Every page of this site is audited with the Limen engine itself before release, and must return zero confirmed failures. Publishing an inaccessible page would be indefensible for a product like this.
• The site is operable throughout by keyboard alone, with a visible focus indicator on every interactive element and a skip link as the first focusable item.
• Colour pairings were checked against the 4.5:1 and 3:1 thresholds in both the light and dark themes before implementation.
• The site respects prefers-reduced-motion and prefers-color-scheme, and remains fully usable at 200% zoom and in right-to-left layout.
• The interface is available in English, German, French and Arabic, with correct language declaration and text direction in each.

3. Known limitations

We publish these rather than hide them:

• Technical remediation code samples are provided in English only, because code and file paths are language-neutral. Explanatory interface text is fully translated.
• Rule titles and explanations inside the audit tool are currently translated into English and German. French and Arabic interface users see the tool chrome in their language and rule detail in English. This is stated in the tool.
• We have not yet completed testing with every combination of screen reader and browser. If you hit a barrier, tell us and we will treat it as a defect, not a feature request.

4. Feedback

If you encounter a barrier on this site or in the tool, contact hello@limen.ae. We aim to respond within 14 days. Please describe the page, what you were trying to do, and the assistive technology you were using if any.

5. Enforcement

If you are not satisfied with our response, you may contact the market surveillance authority responsible for accessibility in your EU member state; in Germany, the Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF). In the United States you may contact the Department of Justice Civil Rights Division. In the United Arab Emirates you may contact the Telecommunications and Digital Government Regulatory Authority (TDRA).

Last updated: 30 August 2026.

Imprint

Who is behind this site. The German disclosure duty under § 5 DDG (formerly § 5 TMG) binds service providers established in Germany; this one is established in the United Arab Emirates. The details are published anyway, because a German reader looks for them and an imprint nobody can find is a common ground for an Abmahnung.