Privacy Policy

In brief (this does not replace the full notice)

• To use the service we process account and billing data, for the purposes of identification, providing the service and invoicing.
• When analyzing a website and when using the AI assistant, we transmit certain data to a third-party AI provider in order to produce the result. For this reason, please do not provide sensitive or confidential personal data in the content being analyzed or in your questions.
• For protection against abuse we use Cloudflare, and for statistical purposes services from the Google ecosystem. All other data processing is carried out by our own system.
• We may send operational (transactional) and occasional promotional emails. We do not send newsletters.
• On request we delete your data – but billing data prescribed by law remains in the invoicing system for the mandatory retention period.
• You may exercise your rights under the GDPR at any time, and you may lodge a complaint with the Hungarian supervisory authority (NAIH).

1. The data controller

The controller of personal data is the operator of the service:

Company name

AIWORKS Hungary Ltd

Registered office

1045 Budapest, Pozsonyi utca 6/B., Magyarország

Company registration number

01-10-141223

Tax number

29037034-2-41

Phone

+36 30 255 2615

Contact, exercising rights

Contact form, or by post to the registered office address.

Appointing a data protection officer (DPO) is not mandatory under Article 37 of the GDPR; you may contact us with data protection questions through the channels above. In the event of a personal data breach we act in accordance with the statutory requirements.

2. Definitions and principles

The concepts used in this notice (personal data, processing, processor, data subject, consent, etc.) are to be understood as defined in Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). In our processing we observe the principles set out in Article 5 of the GDPR – lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

The applicable legislation includes, among others: the GDPR; Act CXII of 2011 on informational self-determination and freedom of information; Act CVIII of 2001 on electronic commerce services; Act XLVIII of 2008 on commercial advertising activity; Act C of 2000 on accounting; and the electronic communications privacy (ePrivacy) rules.

3. The data processed, the purpose and the legal basis of processing

Most of the service is handled by our own system. The individual processing operations are detailed below.

a) Registration and account data

Data processed: email address, password (exclusively in an encrypted, irreversible "hash" form), contact person's name, optionally phone number and company name; the status and settings of the account.
Purpose: identifying the user, creating and managing the account, providing the service, customer relations.
Legal basis: performance of the contract (terms of use) – GDPR Article 6(1)(b).

b) Billing and payment data

Data processed: billing name, address, and for companies the company name and tax number, the subject, amount and date of the purchase, and the transaction identifiers.
Purpose: fulfilling the order, issuing an invoice, fulfilling accounting and tax obligations.
Legal basis: compliance with a legal obligation – GDPR Article 6(1)(c), based on the Accounting Act; in respect of processing the payment, performance of the contract – Article 6(1)(b).

c) Analysis data

Data processed: the web address(es) you provide for analysis and the information extracted from the publicly available page content, the result of the analysis (scores, recommendations), and the time of the analysis.
Purpose: carrying out the requested SEO/AEO/GEO/AIO analysis and displaying the result, storing the history.
Legal basis: performance of the contract – GDPR Article 6(1)(b). Please only enter a web address that you are entitled to analyze.

d) Data related to the use of the AI assistant

Data processed: the text of the questions asked of the AI assistant, the context of the analysis, and the data needed to produce an answer.
Purpose: producing AI-based, natural-language answers and recommendations.
Legal basis: performance of the contract – GDPR Article 6(1)(b). The details are set out in section 4.

e) Usage, technical and security data

Data processed: IP address, browser and device data (user agent), sign-in and activity logs, the IP address and time of registration (to filter out abuse and artificial registrations, e.g. a weekly registration limit per IP).
Purpose: secure operation of the service, fraud and abuse prevention, troubleshooting.
Legal basis: the legitimate interest of the controller – GDPR Article 6(1)(f) (the security and integrity of the system); partly a legal obligation.

f) Contact

Data processed: the name, email address, subject and message provided on the contact form.
Purpose: answering the enquiry, handling the matter.
Legal basis: arising from your voluntary enquiry, or the legitimate interest of the controller in replying – GDPR Article 6(1)(f), or consent – Article 6(1)(a).

4. Artificial intelligence (AI) – special notice

The website analysis and the AI assistant operate with the involvement of third-party artificial intelligence (large language model) provider(s). This means that in order to produce the result, we transmit certain data to the system(s) of these provider(s).

The data transmitted to the AI provider is typically: relevant parts of the publicly available content of the analyzed page(s), the context of the analysis, and the text of the questions you ask the assistant.

• The AI provider processes the data transferred in accordance with its own data processing terms; some providers may log data for a limited period for abuse prevention purposes.
• The AI provider may be established outside the European Union (typically in the United States); in that case the transfer takes place with appropriate safeguards (see section 6).
• The answers and recommendations given by the AI are informational and can be wrong, and do not constitute professional (legal, financial or marketing) advice. Using the results is your responsibility.
• The AI analysis is automated processing, but it does not produce an automated decision that has legal effects concerning you or similarly significantly affects you (see section 13).

You may request information about the AI provider(s) used at any given time through the contact form.

5. Processors and third parties

We use the external providers listed below. Apart from them, all other processing is carried out by our own system. The processors handle the data solely on our instructions and for the stated purpose.

a) AI provider (artificial intelligence)

To operate the analysis and the AI assistant we use partner(s) operating large language models. The data transferred and the related safeguards are detailed in sections 4 and 6.

b) Cloudflare (security, bot protection)

To filter out abuse and automated (bot) traffic we use Cloudflare services (e.g. the Turnstile check, WAF/CDN). In this context technical data, including the IP address, is processed for security purposes. Provider: Cloudflare, Inc. (USA) / the Cloudflare group.

c) Google ecosystem (statistics)

For statistical and traffic measurement purposes we use services from the Google ecosystem (e.g. Google Analytics). These typically work through cookies, based on your consent, and process aggregated or pseudonymized usage data. Provider: Google Ireland Ltd. / Google LLC (USA).

d) Invoicing provider

To issue invoices we use an online invoicing provider (an invoicing application, typically the system of Számlázz.hu – KBOSS.hu Kft.). We transmit the billing data in order to comply with our statutory obligation.

e) Payment provider

Card and online payments are processed by a payment provider (PayPal (Europe) S.à r.l. et Cie, S.C.A.). PayPal processes the payment data as an independent controller under its own policy; we do not see or store full card details.

f) Hosting and email delivery

The system is operated by a hosting provider, and operational emails are delivered by our server (the hosting provider's mail system). This provider acts as a processor.

6. International data transfers

Some of our providers (e.g. the AI provider, Cloudflare, Google, PayPal) may also process data outside the European Economic Area, typically in the United States. In such cases the transfer takes place with the appropriate safeguards under Chapter V of the GDPR: on the basis of the European Commission's standard contractual clauses (SCCs), or – where applicable – certification under the EU–US Data Privacy Framework.

7. Email communication

a) Operational (transactional) emails. We send messages necessary for providing the service, for example the code needed to confirm registration, password resets, and notices related to invoicing, your account or a material change to the service. These relate to the performance of the contract or to a legal obligation, and therefore cannot be unsubscribed from while the account exists.

b) Occasional promotional emails. From time to time we may inform you about offers and promotions relating to our own, similar services. The legal basis is our legitimate interest in promoting our own services, and direct marketing to an existing customer under the advertising and ePrivacy rules. You may unsubscribe from these at any time, free of charge and easily (using the unsubscribe option in the email or through the contact form).

c) Newsletter. We do not send regular, bulk newsletters.

8. Cookies and similar technologies

Cookies strictly necessary for operation (e.g. the session identifier, security and display settings such as the chosen theme) are used without your consent as well, because the service would not work without them. Statistical/analytics cookies (e.g. Google) are only used based on your consent. You can change or delete the cookie settings in your browser at any time.

9. Retention periods

• Account and analysis data: for as long as the account exists, or until a deletion request is fulfilled.
• Billing data: under Section 169 of the Accounting Act we are required to retain accounting documents for at least 8 years from the date of issue.
• Usage/security logs: for the limited period necessary for the security purpose, after which they are deleted or anonymized.
• Contact messages: for as long as needed to deal with the matter.
• Data processed on the basis of consent: until the consent is withdrawn.

10. Deletion and the exception for billing data

On separate request we delete the data relating to you (right to erasure / "to be forgotten", GDPR Article 17). You may submit the deletion request through the contact form or by post; after identification we act without undue delay.

11. Your rights

Under the GDPR you have the following rights:

• Access to the data processed about you (Article 15);
• Rectification (Article 16);
• Erasure / "to be forgotten" (Article 17 – with the exception set out in section 10);
• Restriction of processing (Article 18);
• Data portability (Article 20);
• Objection to processing based on legitimate interest or carried out for direct marketing purposes (Article 21);
• Withdrawal of consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3)).

You may submit your request through the contact form or by post. As a general rule we answer requests within one month, free of charge (in justified cases the deadline may be extended). We may ask for further information in order to identify the data subject.

12. Data security

We apply technical and organizational measures appropriate to the risk and to the state of the art, including: an encrypted (HTTPS/TLS) connection, irreversible hashing of passwords, access restriction and permission management, IP-based abuse protection and bot filtering (captcha), logging and regular maintenance. Perfect data security cannot, however, be guaranteed; please protect your sign-in credentials as well.

13. Automated decision-making and profiling

The analysis and AI features of the service carry out automated processing; however, we do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR. The scores and recommendations generated by AI are informational; the decision is always yours.

14. Children's data

The service is designed for business/professional use and is not intended for persons under the age of 16. To our knowledge we do not knowingly collect data about persons under 16; if we become aware of processing such data, we delete it.

15. Amendment of this policy and the supervisory authority

We reserve the right to amend this notice; the version in force at any given time is available on this page, with the version number and effective date indicated. We will notify users of material changes in an appropriate manner.

If you believe that your data is being processed unlawfully, you may lodge a complaint with the supervisory authority or turn to a court. The Hungarian supervisory authority is:

This notice entered into force on 2026.08.23. (version: 1.0).