Privacy policy

1. The controller and its contact details

1.1. The controller: R-Szoft Informatikai Korlátolt Felelősségű Társaság (R-Szoft Kft.). Registered seat: 1224 Budapest, XIII. utca 45. Place of business and postal address: 1095 Budapest, Soroksári út 48. (Hungária Malomudvar, building 8, 2nd floor). Company registration number: 01-09-407280 (Court of Registration of the Budapest-Capital Regional Court, Fővárosi Törvényszék Cégbírósága). Tax number: 26615934-2-43. Represented by: Bálint Rákosi, managing director.

1.2. Name of the service: SmartAIAssist (formerly SmartAIChat). Websites: https://smartaiassist.hu and https://smartaiassist.eu.

1.3. Contact details: ; telephone: +36 30 181 2087 (Monday–Friday, 9:00–17:00 CET).

1.4. Under Article 37 GDPR, our company is not required to appoint a data protection officer. Questions concerning data protection may be addressed to the contact details above.

2. Scope and purpose of processing

2.1. This policy describes the processing activities of R-Szoft Kft. Its activity as controller covers the operation of its own website, the management of prospects and customer relations, the conclusion of contracts and invoicing.

2.2. The customer using the service is the controller in respect of its own visitors and buyers, and R-Szoft Kft. acts as processor on behalf of the customer. This processing is governed by the Data processing agreement.

2.3. The data provided on the website forms (demo, contact and callback requests) are stored in the HubSpot customer relationship management (CRM) system; see clauses 3.1 and 5.1 for details.

3. Personal data processed and legal bases

3.1. Prospects, contact requests

3.1.1. Data processed: surname, first name, email address, telephone number, company name, website address, message, the page and time of the form submission, the advertising source (UTM parameters), the price list displayed (HUF or EUR) and, for prospects in Romania, the county.

3.1.2. The sole purpose of processing is to make contact: to answer the enquiry and to establish the nature of the interest.

3.1.3. Legal basis: legitimate interest (Article 6(1)(f) GDPR), on the basis of a balancing test; for the “Notify me when available” request, consent (Article 6(1)(a) GDPR). We do not send newsletters.

3.1.4. Retention period: 2 years from the last contact, or until an objection is made, if earlier; if a contract is concluded, as set out in clauses 3.4 and 6.2.

3.1.5. For prospects in Romania, we forward the data to our Romanian partner responsible for the county concerned, so that it can make contact and carry out onboarding. The partner acts on our behalf, as a processor (clause 5.1).

3.2. Demo requests

3.2.1. Data provided on the demo preview form: website address, email address, telephone number, and the declaration of authorisation.

3.2.2. The automatic preview is generated from the public content of the website provided and is deleted after 24 hours.

3.2.3. Legal basis: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

3.3. Appointment requests by email

3.3.1. The name and contact details provided in the email sent for the live demo are used solely to arrange the appointment and to hold the demo. Legal basis: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

3.4. Customers’ contact persons

3.4.1. Data processed: surname, first name, email address, telephone number, technical and billing data relating to the contract.

3.4.2. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

3.5. Invoicing

3.5.1. Data required for invoicing: name, address, tax number and, for EU businesses, the EU VAT number and its VIES verification. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; Hungarian Act CXXVII of 2007 on Value Added Tax and Act C of 2000 on Accounting). Retention: accounting documents are retained for 8 years (Section 169 of the Accounting Act).

3.6. Displaying the price list

3.6.1. To show the right price list, Cloudflare determines the country you are visiting from based on your IP address. We do not store your IP address or use it for any other purpose; the website receives only the country code. If you choose a price list manually, your choice is kept in a cookie for 30 days (see the Cookie policy). Legal basis: legitimate interest (Article 6(1)(f) GDPR).

3.7. Website analytics

3.7.1. With your consent, we measure use of the website with Google Analytics 4 (pages viewed, form submissions, the price list displayed and the language). Legal basis: consent (Article 6(1)(a) GDPR), which you can withdraw at any time using the “Cookie settings” button in the footer. The data are retained for a maximum of 14 months.

3.8. Social AI – connecting a Facebook Page

3.8.1. When our customer connects its Facebook Page to Social AI (Facebook Login for Business), we process the Facebook name and Facebook ID of the Page administrator who logs in, and the Page access token issued by Meta. Purpose: providing the Social AI service. Legal basis: performance of a contract (Article 6(1)(b) GDPR); where the administrator is an employee of our customer, the legitimate interest of our customer and of us (Article 6(1)(f) GDPR). The token is stored in encrypted form.

3.8.2. We process the Facebook Page’s posts, comments and reactions, the names and Facebook IDs of commenters and the posts’ interaction data (number of reactions and comments) on behalf of our customer, as a processor; our customer is the controller of these data, and we act on its instructions. Social AI only flags unsolicited or offensive comments for hiding; our customer decides on hiding. We use the data received from Facebook solely to operate Social AI: we do not sell them, we do not use them for advertising, profiling or training artificial intelligence models, and we do not disclose them to third parties other than the processors listed in section 5.

3.8.3. Retention and deletion: raw notifications received from Facebook are deleted after 14 days, and comments and commenters’ data after 30, 90 or 365 days depending on our customer’s package; the administrator’s data and the token are kept until access is revoked. Within 30 days of revocation of access or termination of the contract, we delete all data received from Facebook and the token. How to request deletion: Deleting Facebook data.

4. Principles of processing and legal references

4.1. In the course of processing, we process personal data lawfully, fairly and transparently; we collect them for specified, explicit purposes; to the extent relevant and necessary in relation to the purpose; accurately, for no longer than necessary to achieve the purpose, and with appropriate security.

4.2. This policy complies with the General Data Protection Regulation (GDPR), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (2011. évi CXII. törvény, Infotv.), Hungarian Act V of 2013 on the Civil Code (2013. évi V. törvény, Ptk.), and the relevant provisions of Regulation (EU) 2024/1689 of the European Parliament and of the Council (AI Act).

5. Processors

5.1. Our processors:

• Amazon Web Services EMEA SARL – service platform and storage, AWS eu-central-1 (Frankfurt), EU
• Google Cloud (Vertex AI, Gemini, regional EU endpoint) – model calls, EU
• AWS Bedrock eu-central-1 – fallback model, EU
• Amazon SES – sending email, EU
• Decodo – reading public website content for the demo preview, EU
• Cloudflare, Inc. – website delivery and form forwarding (Workers), protection against overload, determining the country for the price list; does not store form data – USA
• HubSpot, Inc. – customer relationship management (CRM), forms – USA
• Google Ireland Limited / Google LLC – website analytics (Google Analytics 4, only with consent) and company email (Google Workspace) – EU, USA
• KBOSS.hu Kft. (Számlázz.hu) – invoicing, Hungary
• our implementation partners in Romania – contact with prospects and customers in Romania, onboarding – Romania; the current list of partners is available on the page and by email on request

For Video AI and Social AI – where our customer is the controller and we act as a processor on its behalf – we engage the following additional providers:

• Eleven Labs Inc. – text-to-speech (voice-over) for Video AI videos – USA
• HeyGen Technology, Inc. – avatar video rendering for Video AI videos – USA
• Google Cloud EMEA Limited (Vertex AI) – ad image generation, regional EU endpoint – EU; ad video generation, global endpoint – EU and USA

5.2. The product data are stored in the eu-central-1 (Frankfurt) region of Amazon Web Services EMEA SARL; the website is operated using the services of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA).

5.3. We do not use conversations or the knowledge base for model training.

5.4. Transfers outside the EEA. Some of our processors (Cloudflare, Inc., HubSpot, Inc., Google LLC, Eleven Labs Inc., HeyGen Technology, Inc.) and the parent company of the operator of the Facebook platform used for Social AI (Meta Platforms, Inc.) are companies established in the United States. Personal data are transferred on the basis of their certification under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) or, where no certification applies, on the basis of the standard contractual clauses (SCC) adopted by the European Commission. The chat, conversation and knowledge base data remain in the EU; Video AI voice and video generation also takes place in the United States.

5.5. Social AI operates through the Facebook platform of Meta Platforms Ireland Limited. Meta is not our processor: it processes the data appearing on Facebook as an independent controller, in accordance with its own privacy policy.

6. Retention period

6.1. We delete the demo preview after 24 hours. Product conversations are retained for 90 days after closure and are then deleted automatically; the Data processing agreement covers this in detail.

6.2. After termination of the contract, we delete the data after the 30-day export period, no later than 60 days after termination. Accounting records and documents relating to the handling of matters are retained for the period required by accounting and legal retention obligations.

6.3. The data received from Facebook for Social AI and the access token are deleted within 30 days of revocation of access or termination of the contract (clause 3.8.3).

7. Rights of data subjects

7.1. The data subject may request information on the processing of their personal data, and may request its rectification, its erasure (except for mandatory processing), restriction of processing and data portability, and may object to processing.

7.2. We respond to requests within one month at the latest. Information is provided free of charge, unless the data subject repeatedly requests information on the same set of data.

7.3. In the event of a complaint, the data subject may contact the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH, 1055 Budapest, Falk Miksa utca 9–11., https://naih.hu/) or the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR) – in Romania, the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP, https://www.dataprotection.ro) – and may also apply to a court.

7.4. If a person commenting on a Facebook Page contacts us about their data processed by Social AI, we forward the request to our customer operating the Page, as the controller, and assist in fulfilling it; we inform the requester accordingly. Information on the data stored on Facebook is provided by Meta.

8. Handling of personal data breaches

8.1. We notify the data protection authority of a personal data breach within 72 hours at the latest after becoming aware of it, if the breach poses a risk to data subjects. In the event of a high risk, we also inform the data subjects.

9. Cookies

9.1. Information on the cookies and similar technologies used by the website is provided in the Cookie policy.

10. Changes to this page

10.1. We review this policy regularly. In the event of a significant change, we notify data subjects by email; in the event of a non-significant change, we publish the new version on the website.