Privacy Notice – v2

1. Summary – Our data handling in a nutshell

Dear User!

Before diving into the legal details, we'd like to summarize in plain language how we handle your personal data. The full notice contains detailed information, but if you'd like to quickly understand the essentials, you'll find them here:

What data do we request, and why?

We only request the data that is absolutely necessary for you to use our service. We do not collect unnecessary information and we do not "snoop" on you.

Who do we share your data with?

Your data We do NOT sell it, We do NOT rent it out, and We do NOT share it with third parties for marketing purposes. We only share your data with those who are essential for the operation of the service:

• The chosen provider – the person you are booking an appointment with (hairdresser, masseur, trainer, etc.). They see your name, contact details, and the booking details.
• Technical partners – who ensure the operation of the system (server, email sending, payment). They only have access to the necessary data and have contractually committed to confidentiality.
• Authorities – but only when required by law (e.g. a tax audit, a court order).

How long do we keep your data?

• Account data: As long as you actively use your account. If you delete it, we permanently remove it within 60 days.
• Invoices, financial data: For 8 years – required of us by law.
• Technical logs (IP address, browser): for 90 days, for security reasons.

What rights do you have?

You retain full control over your data:

• You can view it – request information about what data we store about you
• You can modify it – correct inaccurate or outdated data
• You can delete – request the deletion of your data (with certain exceptions)
• You can export it – take your data with you in a machine-readable format
• Can object say no to direct marketing

How do we protect your data?

• Encrypted connection (HTTPS) – all data travels securely
• Encrypted passwords — not even we can see your password
• Two-factor authentication – extra protection for your account
• Continuous security monitoring – we watch for suspicious activity

2. Data controller's details and contact information

The data controller is the natural or legal person who determines the purposes and means of processing personal data. In the case of the AI Booking system, the data controller is:

Dobó Imre, sole trader

Important: Who is the data controller in your case?

AI Booking is a multi-actor system, where data controller roles are shared. It's important to understand who is responsible for your data in a given situation:

1. If you use the system directly (register, change settings):

Data controller: Dobó Imre E.V. (the system operator)

2. If you book an appointment with a service provider:

The primary data controller: the service provider (e.g. hairdresser, masseur, trainer)
Role of Dobó Imre E.V.: Data processor (providing technical infrastructure)

What does this mean in practice?

• The provider determines what data is requested from you for booking
• The provider is responsible for how it uses your data
• If you have a problem with the provider's data processing, please contact them first
• We (Dobó Imre E.V.) provide the technical background and help if you have any questions

Practical example

Situation: You book an appointment at a hairdresser called "Szépség Szalon" through AI Booking.

What happens to your data?

1. You provide your name, email address, phone number, and select the appointment time
2. This data is stored in our system (we are the data processors)
3. "Beauty Salon" has access to this data in order to be able to receive you (they are the data controller)
4. We send the confirmation email on behalf of "Beauty Salon"

If you want to delete your data:

• From the system (AI Booking): Contact us
• From the records of "Beauty Salon": Please contact them directly

3. Legal background – Which laws protect your data?

The protection of your personal data is ensured by a complex legal framework, both at European Union and Hungarian level. Below we present these regulations and their most important provisions in detail.

3.1. European Union legislation

GDPR – General Data Protection Regulation

Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016)

The GDPR (General Data Protection Regulation) is the European Union's unified data protection regulation, directly applicable in all EU member states since 25 May 2018. It is one of the strictest data protection regulations in the world.

The key principles of GDPR:

• Lawfulness, fairness, transparency (Article 5(1)(a)): Data processing must be lawful, fair, and transparent.
• Purpose limitation (Article 5(1)(b)): Data may only be collected for specified, explicit and legitimate purposes.
• Data minimization (Article 5(1)(c)): Only the necessary data may be collected — no more, no less.
• Accuracy (Article 5(1)(d)): Data must be accurate; inaccurate data must be erased or rectified.
• Storage limitation (Art. 5(1)(e)): Data may only be stored for as long as necessary.
• Integrity and confidentiality (Article 5(1)(f)): The data must be properly protected.
• Accountability (Article 5(2)): The data controller must be able to demonstrate compliance with these principles.

The relevant GDPR articles for our data processing:

3.2. Hungarian legislation

Infotv. – the Hungarian Act on Informational Self-Determination

Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information

This is the Hungarian basic data protection act, which supplements the GDPR with domestic specifics. Its most important elements:

• Defines the operation and scope of authority of the National Authority for Data Protection and Freedom of Information (NAIH)
• Regulates data protection authority procedures and sanctions
• Contains additional provisions on the publicity of data of public interest

Civil Code (Hungary)

Act V of 2013 on the Civil Code

Sections 2:42-54 § contain the the protection of personal rights:

• 2:42. §: General protection of personal rights
• 2:43. §: Cases of violation of personality rights (including the right to protection of personal data)
• 2:51-54. §: Sanctions for personality rights violations – non-pecuniary damages, compensation

What does this mean for you? If our data processing infringes your personal rights, you may claim compensation for damages and non-pecuniary damages.

Accounting Act

Act C of 2000 on Accounting

A Section 169(2) according to which accounting documents (including invoices, contracts, financial records) for 8 years must be retained.

VAT Act

Act CXXVII of 2007 on Value Added Tax

A 159. § és 169. § defines the mandatory content elements of invoices and the related record-keeping obligations.

Eker tv. – Act on Electronic Commerce

Act CVIII of 2001 on certain issues of electronic commercial services (Hungary)

A 13/A. § regulates that when providing an online service:

• What data we may process and for how long
• How to inform the customer about data processing
• What data we may process for billing the service fee

Grt. — Hungarian Advertising Act

Act XLVIII of 2008 on the Basic Conditions of Economic Advertising Activity

A 6. § states that direct marketing communications – including newsletters sent by email – prior, explicit consent is required.

• We only send newsletters or promotional emails if you have explicitly subscribed
• Subscription must be active (you check the box)
• A pre-checked checkbox is not sufficient
• You can unsubscribe anytime with one click

Eht. – Electronic Communications Act

Act C of 2003 on Electronic Communications

It contains the rules regarding electronic communication and the use of cookies, in particular the 155. §, which regulates the conditions for placing cookies.

4. Definitions – What do the legal terms mean?

Under Article 4 of the GDPR

Data protection laws often use technical terms that may seem complicated at first. Below, we explain the most important ones in plain language, with examples.

4.1. Personal Data

Definition: Any information relating to an identified or identifiable natural person.

In plain terms: Any data that can identify you, or that can be linked to you as a person.

Examples of personal data:

Is an email address always personal data?

Igen, mert azonosítható személyhez kapcsolódik. Még a "xyz123@example.com" típusú cím is személyes adat, ha az adatbázisban összekapcsolható egy konkrét személlyel.

4.2. Special (sensitive) data

Definition: A particularly protected category of personal data, the processing of which is prohibited as a general rule, except in certain exceptional cases.

This includes:

• Racial or ethnic origin referential data
• Political opinion
• Religious or philosophical beliefs
• Trade union membership
• Genetic data (DNS information)
• Biometric data (fingerprint, facial recognition, retina)
• Health Data (illnesses, medications, treatments)
• Sexual life or orientation relevant data

AI Booking does NOT process special categories of data

Our system does not collect or store special (sensitive) data. If a service provider requests such data from you in the comments field (e.g. "do you have any allergies"), only that specific provider is responsible for it as an independent data controller.

4.3. Data subject

Definition: The natural person whose personal data is processed.

In plain terms: You! In the AI Booking system, the data subject can be:

• Guest: Anyone who registers and books an appointment with providers
• Provider user: Anyone using the system for business purposes (hairdresser, massage therapist, trainer, etc.)
• Team member: Someone whom a service provider has added to their system

4.4. Data Controller

Definition: The natural or legal person that determines the purposes and means of the processing of personal data.

In plain terms: The one who decides, why és how processes your data. The data controller bears responsibility for the lawfulness of the processing.

Who is the data controller for AI Booking?

4.5. Data Processor

Definition: The natural or legal person who processes personal data on behalf of the data controller.

In plain terms: The one who, on behalf of the data controller and per their instructions, performs the "technical" work with the data.

Examples of data processor roles:

• We (AI Booking) we act as data processors for the providers – they are the data controllers, we provide the technical background
• SendGrid is a data processor for us – we decide who receives the email, they just send it
• Hostinger (server + database) data processor – stores and runs the system, but does not make decisions about data processing

4.6. Data Processing

Definition: Any operation or set of operations performed on personal data.

In plain terms: Everything we do with personal data:

• Collection (registration, form submission)
• Recording (saving to the database)
• Organization (categorization, grouping)
• Storage (retention on the server)
• Modification (updating data)
• Query (viewing data)
• Forwarding (sending data to others)
• Linking (merging of data)
• Restriction (data "freezing")
• Deletion (data removal)
• Destruction (permanent deletion)

4.7. Consent

Definition: A freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their personal data.

The consent must meet the following criteria:

• Voluntary: Szabad döntés, nem kikényszerített, nem jár hátránnyal a megtagadása
• Specific: It applies to a specific purpose, not a general one
• Informed: You know what you're consenting to
• Clear: An active act (clicking, signing), not silence

What does NOT count as valid consent?

• Pre-checked checkbox
• "If you do not object, we will consider it as consent"
• Conditional consent ("you only get the service if you agree to marketing")
• Vague, generic wording

4.8. Data breach

Definition: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.

Types:

4.9. Profiling

Definition: Any form of automated processing of personal data used to evaluate certain characteristics of a person.

In plain terms: When we use computers to analyze your data in order to draw conclusions from it – for example, to predict what you will buy or which ads will interest you.

We do not automatically analyze your behavior, do not create a "profile" of you, and do not make automated decisions based on your data.

5. Data Processors – Who has access to your data and how?

For the AI Booking service to work, we need to cooperate with other companies. These partners are so-called "data processors" — they handle your data on our behalf and according to our instructions. We have signed a written agreement with every partner (a data processing agreement under Article 28 GDPR), which guarantees that they too comply with data protection requirements.

5.1. Server services — Where the data "lives"

Hostinger International Ltd. – VPS hosting, database, email and website

Registered office: 61 Lordou Vironos Street, 6023 Larnaca, Cyprus

Website: hostinger.com

Privacy notice: hostinger.com/privacy-policy

Outside the EU: No – EU member state (Cyprus), GDPR applies directly

What does it do? Hostinger provides the entire infrastructure for the AI Booking system:

• VPS (Virtual Private Server) hosting: The web application and all backend services run on this server
• PostgreSQL database: Storage of all structured data (users, bookings, settings)
• Email service: Email accounts linked to the domain and certain transactional messages
• Landing page hosting: Hosting of the aibooking.hu introductory website

What data does it have access to?

• All data stored on the server (application, database, log files)
• User data: names, email addresses, bookings, settings
• Technical logs (for troubleshooting)

Security features:

• Data storage within the European Union (GDPR-compliant)
• Encrypted data transfer (TLS/SSL)
• Regular security backups
• Firewall and basic DDoS protection
• 24/7 server monitoring

What can you NOT use it for? As an infrastructure provider, Hostinger does not access the data for business purposes, only to ensure the technical provision of the service. It has contractually undertaken data processor obligations under the GDPR.

Why is it good that the server is in the EU?

Since Hostinger is a Cyprus-based company and the data stays within the EU, no special data transfer safeguards are required (as would be the case for transfers to the USA). GDPR applies directly, which means stronger protection for your data.

Landing page – custom Node.js application

Page: aibooking.hu (introductory/landing page)

Platform: an in-house Node.js + Express + React application (the same codebase as app.aibooking.hu)

Hosting: Hostinger (see above)

What does it do? The aibooking.hu landing page is the introductory website of the service, from which visitors are directed toward the application. It's custom-built, sharing a codebase with the application — there is no external CMS (we replaced the earlier WordPress/Elementor version in May 2026).

Services used on the landing page:

• Google Analytics 4: Visitor statistics (only with consent)
• Cookie Management: Cookie banner for managing consent
• AI chatbot: The AI assistant available in the bottom right corner (see the next section)

What data does the landing page process?

• Technical data: IP address, browser type, device (in server logs)
• Analytics data: page views, time on site (Google Analytics, only with consent)
• Contact form data (if any): name, email, message
• AI chatbot conversation history (with anonymous session ID, details below)

AI chatbot – Conversation storage (aibooking.hu)

What does it do? The AI assistant available in the bottom right corner of the landing page answers visitor questions and, if needed, guides them into the consultation booking process. Conversations are stored for auditing and quality assurance purposes.

What do we store in every case?

• Conversation content (questions and AI response text)
• Anonymous session identifier (4-hour lifetime, stored in the visitor's browser in localStorage — the session identifier alone is not identifying personal data)
• Browser type (user agent)
• Referring page (referer)

IP address storage — dual mode (GDPR / EDPB guidelines):

• Masked IP (default, even without consent): If you have not accepted the analytics cookie category, we store your IP address in masked form. For IPv4, the last octet is replaced with 0 (e.g. 192.168.1.42 → 192.168.1.0), for IPv6 we remove everything except the first 3 hextets (e.g. 2001:db8:abcd:1234::5678 → 2001:db8:abcd::). This is identical to Google Analytics 4's default IP-anonymization behavior, and according to the EDPB (European Data Protection Board) is not identifiable personal data — so the legal basis is legitimate interest under GDPR Art. 6(1)(f) (spam filtering, abuse protection).
• Full IP (with consent only): If you have expressly accepted the analytics category in the cookie banner, we store the full IP address. Legal basis: GDPR Art. 6(1)(a) — your consent. Consent can be withdrawn at any time by reopening the cookie banner.

Retention period: 90 days, after which it's automatically deleted. If you manually delete the conversation history (using the "Delete conversation" button in the chat window), it disappears immediately on the client side, and is deleted server-side according to the 90-day automatic retention policy.

AI model and third-party provider: A chatbot az Ollama Cloud platformon működő nyelvi modellt használja. A beszélgetés-tartalom az AI-szolgáltatóhoz (Ollama – ollama.com, üzemeltető: Ollama, Inc., Egyesült Államok; harmadik országba történő adattovábbítás) továbbítódik a válasz generálásához; az AI-szolgáltató nem őrzi meg a tartalmat (zero-retention beállítás). A válaszok elkészítéséhez az Ollama mellett az OpenAI (openai.com, üzemeltető: OpenAI, L.L.C., Egyesült Államok; harmadik országba történő adattovábbítás) MI-szolgáltatót is igénybe vehetjük, ugyanezen adatkezelési feltételekkel; az OpenAI vállalása szerint az API-n beküldött adatok alapértelmezetten nem szolgálnak a modelljei tanítására.

Landing page vs. Application

AI Booking consists of two main parts:

• Landing page (aibooking.hu): Introductory website – custom Node.js application with Google Analytics and an AI chatbot
• Application (app.aibooking.hu): The booking system — a custom-developed application

We apply the principles described in this privacy notice on both sides.

Cloudflare Inc. – CDN, security services and image storage

Registered office: 101 Townsend Street, San Francisco, CA 94107, USA

Website: cloudflare.com

Privacy notice: cloudflare.com/privacypolicy

Outside the EU: Yes (USA) – Safeguard: Standard Contractual Clauses (SCC)

What does it do? Cloudflare provides us with several critical services:

1. CDN (Content Delivery Network):

• It stores the website's static content (CSS, JavaScript, icons) on servers located at various points around the world
• This way you reach the page faster, wherever you are

2. Security services:

• DDoS protection: Protects our system from overload attacks
• WAF (Web Application Firewall): Filters out malicious requests (SQL injection, XSS attacks)
• Bot protection: Distinguishes humans from malicious bots
• SSL/TLS: Ensures an encrypted connection (HTTPS)

3. R2 Object Storage – Storing images and files:

• Gallery images: Gallery images uploaded by providers (portfolio, showcase of work)
• Profile pictures: Storage of user profile pictures
• Documents: Uploaded files, attachments

Important about image storage

The Cloudflare R2 service S3-compatible cloud-based storage. Images are accessible via URL and load quickly through Cloudflare's global network. Image content is not analyzed or used for any other purpose.

What data does it have access to?

• IP addresses (to identify the source of requests)
• HTTP headers (browser type, language)
• Request content (passes through the CDN)
• Uploaded images and files (in R2 storage)

Data storage location: Cloudflare allows regional data restriction. Data in R2 storage is kept in the EU region wherever available.

5.2. Email services — How we communicate with you

SendGrid (Twilio Inc.) – Transactional emails

Registered office: 375 Beale Street, San Francisco, CA 94105, USA

Website: sendgrid.com

Privacy notice: twilio.com/legal/privacy

Outside the EU: Yes (USA) – Safeguard: SCC

What does it do? SendGrid sends all system messages to your email address:

• Booking confirmations
• Reminders (1 day and 1 hour before the booking)
• Password reset links
• Account activation emails
• Booking modification/cancellation notifications
• Newsletters (if subscribed)

What data does it have access to?

• Your email address (recipient)
• Email content (message text)
• Delivery information (whether the email was opened, whether a link was clicked)

What can you NOT use it for? SendGrid may not send you its own marketing messages, nor may it sell your email address.

Hostinger International Ltd. – Alternative email

Registered office: 61 Lordou Vironos Street, 6023 Larnaca, Cyprus

Website: hostinger.com

Outside the EU: No – EU member state (Cyprus)

What does it do? It operates as an alternative email provider for certain transactional messages and domain-related email accounts.

5.3. Payment services — How we handle your money

Stripe Inc. – Online card payment

Registered office: 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA

European headquarters: Stripe Payments Europe, Ltd., Dublin, Ireland

Website: stripe.com

Privacy notice: stripe.com/privacy

Certificates: PCI DSS Level 1 (the highest level of payment card security standard)

What does it do? Stripe handles all online card payments. When you pay, you provide your card details directly to Stripe — this data NEVER reach us.

Data processed by Stripe:

• Full card number
• Expiry date
• CVC/CVV code
• Cardholder name
• Billing address

What we see from Stripe:

• Transaction ID (e.g. "pi_3ABC123...")
• Amount paid and currency
• Payment date and status
• Last 4 digits of the card (e.g. "•••• 4242")
• Card type (Visa, Mastercard, etc.)

WARNING: Fraud prevention

Mi We NEVER ask for your full bank card number, expiry date, or CVC code by email, phone, or chat. If anyone requests these on behalf of AI Booking, that is FRAUD. Kérjük, azonnal jelezze nekünk az címen!

Barion Payment Zrt. – Online payment

Registered office: 1117 Budapest, Irinyi József utca 4-20, 2nd floor

Company Registration Number: 01-10-048552

Website: barion.com

Privacy notice: barion.com/adatvedelmi-tajekoztato

Certificates: PCI DSS Level 1, payment institution supervised by the National Bank of Hungary (MNB) (license number: H-EN-I-1064/2013)

Outside the EU: No – Hungary

What does it do? Barion handles online payments in the Hungarian market. Providers can choose Barion as their payment service provider. Payment card data is handled directly by Barion – this data NEVER reach us.

Data processed by Barion:

• Payment card details (card number, expiry, CVC)
• Cardholder name
• Email address (for Barion account)

What we see from Barion:

• Transaction ID
• Amount paid and currency
• Payment date and status

OTP Mobil Kft. (SimplePay) – Online payment

Registered office: 1143 Budapest, Hungária krt. 17-19.

Company Registration Number: 01-09-174466

Website: simplepay.hu

Privacy notice: simplepay.hu/adatkezelesi-tajekoztatok

Certificates: PCI DSS Level 1

Outside the EU: No – Hungary

What does it do? SimplePay (OTP Mobil Kft.) is also an online payment solution in the Hungarian market. Providers can also choose SimplePay as their payment processor. Card data is handled directly by SimplePay.

Data processed by SimplePay:

• Payment card details (card number, expiry, CVC)
• Cardholder name
• Email address

What we see from SimplePay:

• Transaction ID
• Amount paid and currency
• Payment date and status

5.4. Billing Services

Billingo Technologies Zrt.

Registered office: 1085 Budapest, József körút 74. III/17.

Company Registration Number: 01-10-140802

Website: billingo.hu

Privacy notice: billingo.hu/adatkezelesi-tajekoztato

Outside the EU: No – Hungary

KBOSS.hu Kft. (Számlázz.hu)

Registered office: 1031 Budapest, Záhony utca 7.

Company Registration Number: 01-09-303201

Website: szamlazz.hu

Outside the EU: No – Hungary

What do they do? Online invoicing and data reporting to the NAV (Hungarian Tax Authority). Providers can choose which system to use.

What data do they have access to?

• Invoice recipient's name
• Billing address
• Tax number (if any)
• Name, quantity, and price of the purchased service
• Payment method and date

Important: In accordance with Hungarian law, invoicing systems automatically forward invoice data to the NAV Online Invoice system.

5.5. SMS Service

LINK Mobility Hungary Kft. (SeeMe) – SMS sending

Registered office: 1062 Budapest, Andrássy út 68. Building C, 1st floor, 1.

Company Registration Number: 01-09-694287

Tax number: 12598582-2-42

Website: seeme.hu

Privacy notice: seeme.hu/adatvedelem

Outside the EU: No – Hungary

What does it do? SeeMe handles the sending of SMS notifications. Providers can enable SMS reminders for bookings, which the system sends via the SeeMe API.

Data managed by SeeMe:

• Recipient's phone number
• SMS message text (booking reminder, confirmation)
• Send time and status

Important: SMS is only sent if the service provider has activated the SMS feature and the guest has provided their phone number. SMS messages can be transactional (booking confirmation, appointment reminder), or — at the service provider's discretion — marketing campaigns. Marketing SMS may only be sent with the recipient's prior, explicit consent (in accordance with Hungarian Act XLVIII of 2008 on commercial advertising activity), and every marketing SMS contains a unique, provider-specific unsubscribe link, with which the recipient can unsubscribe at any time, free of charge — exclusively from that particular provider's messages.

5.5.1. Platform marketing SMS to service providers. As the platform operator, AI Booking may occasionally send its own marketing or informational SMS messages to registered service providers (e.g. new features, promotions) at their provided phone number. Legal basis: the contractual relationship with the service provider, as well as the operator's legitimate interest (recommending its own, similar services); for natural person recipients — where the law requires it — based on prior consent. Every such SMS contains an unsubscribe link; unsubscribing is possible at any time, free of charge, and does not affect booking/system notifications. Delivery of these SMS messages is also carried out by LINK Mobility Hungary Kft. (SeeMe) as a processor.

5.6. Calendar and video conferencing integrations

Google LLC – Calendar, Meet, Analytics

Registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

European data controller: Google Ireland Limited, Dublin, Ireland

Privacy notice: policies.google.com/privacy

Outside the EU: Yes (USA) – Safeguard: SCC

Google Calendar integration:

• When does it activate? If you (or the provider) enable calendar synchronization
• What does it do? Bookings automatically appear in Google Calendar
• What data is transferred? Booking time, service name, participants
• Withdrawal: Can be disconnected anytime in account settings

Google Meet integration:

• When does it activate? If the provider offers an online consultation option
• What does it do? Automatically generates a meeting link that's included in the confirmation email
• What data is transferred? Meeting link, time slot, and attendees' email addresses

Google Analytics 4:

• When does it activate? If you have consented to analytics cookies
• Where Do We Use It? Both on the landing page (aibooking.hu) and in the app
• What does it do? Generates anonymous visitor statistics
• Details: See the Cookie section

Zoom Video Communications Inc.

Registered office: 55 Almaden Boulevard, San Jose, CA 95113, USA

Website: zoom.us

Privacy notice: explore.zoom.us/en/privacy

Outside the EU: Yes (USA) – Safeguard: SCC

What does it do? Providers can connect their Zoom account to the system, so a meeting link is automatically generated for online consultations.

Important: With the Zoom integration, the provider uses the their own Zoom account. Amikor Ön részt vesz egy Zoom hívásban, a Zoom saját adatkezelési tájékoztatója vonatkozik a hívás során keletkező adatokra (videó, hang, chat).

5.7. Marketing and analytics

Meta Platforms Inc. (Facebook Pixel)

Registered office: 1 Hacker Way, Menlo Park, CA 94025, USA

European data controller: Meta Platforms Ireland Limited, Dublin, Ireland

Privacy notice: facebook.com/privacy/policy

Outside the EU: Yes (USA) – Safeguard: SCC

What does it do? If you have consented to marketing cookies, using the Facebook Pixel:

• Measure the effectiveness of our Facebook ads
• We can show you more relevant ads
• We create statistics about visitors (in a non-identifiable way)

What data does it have access to?

• That you visited our website
• Which pages were viewed
• Which actions were taken (e.g. registration, booking)
• Technical data (browser, device)

Disabling: You can disable marketing cookies at any time in the cookie settings, and you can also limit targeted advertising in Facebook's ad settings.

5.8. Login providers (Social Login & Magic Link)

The AI Booking system uses the OAuth 2.0 protocol of the following third-party providers for login. These providers are involved only in the authentication process – the system does not get access to other data in the user's account (friends, messages, posts, etc.).

Google LLC – Google Login (OAuth 2.0 / OpenID Connect)

Registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

European data controller: Google Ireland Limited, Dublin, Ireland

Privacy notice: policies.google.com/privacy

Outside the EU: Yes (USA) – Safeguard: EU-US DPF + SCCs

Data transferred: Name, email address, profile picture URL

Meta Platforms Inc. – Facebook Login

Registered office: 1 Hacker Way, Menlo Park, CA 94025, USA

European data controller: Meta Platforms Ireland Limited, Dublin, Ireland

Privacy notice: facebook.com/privacy/policy

Outside the EU: Yes (USA) – Safeguard: EU-US DPF + SCCs

Data transferred: Name, email address, profile picture URL

Apple Inc. – Sign in with Apple

Registered office: One Apple Park Way, Cupertino, CA 95014, USA

European data controller: Apple Distribution International Ltd., Cork, Ireland

Privacy notice: apple.com/legal/privacy

Outside the EU: Yes (USA) – Safeguard: EU-US DPF + SCCs

Data transferred: Name (optional), email address (real or Apple Private Relay address)

A unique feature of Apple login is that the user can decide whether to share their real email address or use a private relay address generated by Apple (e.g. xyz123@privaterelay.appleid.com). In both cases, the system works properly.

Microsoft Corporation – Microsoft Login

Registered office: One Microsoft Way, Redmond, WA 98052, USA

European data controller: Microsoft Ireland Operations Limited, Dublin, Ireland

Privacy notice: privacy.microsoft.com

Outside the EU: Yes (USA) – Safeguard: EU-US DPF + SCCs

Data transferred: Name, email address, profile picture URL

GitHub Inc. – GitHub Login

Registered office: 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA

Parent company: Microsoft Corporation

Privacy notice: docs.github.com/privacy

Outside the EU: Yes (USA) – Safeguard: EU-US DPF + SCCs

Data transferred: Username, email address, profile picture URL

Magic Link – Passwordless login

How it works: The user enters their email address, and the system sends a one-time, time-limited login link.

Email sending: Through AI Booking's own SMTP configuration (see SendGrid / Hostinger Email in the sections above)

Token validity: Maximum 15 minutes, single use

Stored data: Only the email address. The token is automatically deleted after use or expiration.

6. Legal bases for data processing – Why may we process your data?

GDPR Article 6(1)

Under the GDPR, we may only process personal data if there is an appropriate our legal basis. A jogalap az a törvényes indok, amely feljogosít minket az adatkezelésre. Az alábbiakban részletesen bemutatjuk, milyen jogalapokat használunk.

6.1. Consent – GDPR Art. 6(1)(a)

What does it mean? You have actively and voluntarily consented to the data processing. The consent must be specific, informed, and unambiguous.

When do we use this legal basis?

About withdrawing consent

Ön anytime, without justification may withdraw their consent — just as easily as they gave it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. For example: if you unsubscribe from the newsletter, we can't "undo" previously sent emails, but we won't send any more.

6.2. Performance of a contract – GDPR Article 6(1)(b)

What does it mean? The data processing is necessary for us to fulfil the contract concluded with you, or to take pre-contractual steps at your request.

When do we use this legal basis?

• Registration: Data required to create an account (name, email, password)
• Booking: Data required to record and fulfill the booking
• Confirmations and reminders: These are part of the service
• Payment: Data required to process the transaction
• Customer Service: To help resolve issues

Practical example

Situation: You are booking an appointment with a hairdresser.

Contract: By booking, a contract is formed between you and the provider (an agreement on the provision of the service).

Required data:

• Their name – so the hairdresser knows who to expect
• Email address – so we can send the confirmation
• Phone number – so we can reach you if something changes
• Time — so we know when they're coming

Without these we cannot fulfill the contract – meaning we cannot guarantee that the booking will work.

6.3. Legal obligation – GDPR Article 6(1)(c)

What does it mean? Data processing is necessary to fulfill a legal obligation. In such cases we have no choice – the law requires us to process this data.

When do we use this legal basis?

Important: We cannot delete this data

If you request deletion of your account, we will do so – but data required by law (e.g. invoices) must be retained. We are legally obliged to do this and have no other choice.

6.4. Legitimate interest – GDPR Art. 6(1)(f)

What does it mean? The processing is necessary for the purposes of the legitimate interests pursued by us (or a third party), except where such interests are overridden by your interests, rights and freedoms.

This legal basis legitimate interest assessment requires: in every case we must weigh whether our interest or your rights take precedence. We may only use it if our interest does not override your fundamental rights.

When do we use this legal basis?

Can I object to data processing based on legitimate interest?

Yes! Under Article 21 of the GDPR, you may object to data processing based on legitimate interest. In this case, we must examine whether our legitimate interest overrides your interest. If not, we must cease the processing.

7. Data processed in detail — What data exactly do we process?

GDPR Article 13(1)(e) and Article 14(1)(d) – Information obligation regarding the categories of data processed

Below we present in detail what personal data the AI Booking system processes, for what purpose, and on what legal basis. We only collect data that is strictly necessary for providing the service.

7.1. Registration and account data

When are they generated? When you create an account in the AI Booking system.

7.2. Booking Data

When are they generated? When you book an appointment with a service provider.

Comment field — Please do not enter sensitive data!

In the booking notes field do not write special (sensitive) data (e.g. health information, allergies). If this is done nonetheless, responsibility for that the service provider is responsible as an independent data controller, not the AI Booking system.

7.3. Payment data

When are they generated? When you pay online for a service, or the provider purchases a subscription.

7.4. Technical and security data

When are they generated? Automatically, every time you use the website or the app.

7.5. Notification settings

7.6. Data for social login and passwordless sign-in

When are they generated? If you register or log in to AI Booking using one of the following third-party providers: Google, Facebook, Apple, Microsoft, GitHub, or if Magic Link uses a passwordless login link sent by email.

Available login methods

Important about social login

When using social login We NEVER get access to your password, contacts, messages, posts, or any other data not necessary for login. We only request the minimally necessary data listed above — this applies equally to every provider (Google, Facebook, Apple, Microsoft, GitHub).

Social login can be disconnected at any time in the account settings — the account then switches to email + password or Magic Link sign-in.

Apple Private Relay email: With Apple login, the user can choose to share their real email address or an Apple-generated private relay address. The system works correctly either way.

7.7. Provider (business) account data

Who does this apply to? To users who register as service providers (e.g. hairdresser, massage therapist, trainer) and use AI Booking for business purposes.

7.8. Staff Data

Who does this apply to? To those individuals whom a provider adds to their system as a team member (e.g., an employed hairdresser, assistant).

Important about staff data

For adding staff members and managing their data, the the given provider is responsible as data controller. The provider is obliged to inform their staff that their data will also appear in the AI Booking system. We (Imre Dobó, sole trader) act as data processor in this case.

Summary – Overview of data categories

8. Cookies

Eker tv. Section 13/A (4)-(5), GDPR Article 6(1)(a) and (f)

Cookies are small text files that a website stores on your device (computer, phone, tablet). They help the website "remember" you and your settings.

8.1. Types and Purpose of Cookies

Strictly necessary cookies (cannot be disabled)

Legal basis: GDPR Art. 6(1)(f) – Legitimate interest

These cookies are essential for the basic operation of the website. Without them you would not be able to log in, book, or use the site securely.

Analytics cookies (with consent)

Legal basis: GDPR Art. 6(1)(a) – Consent

These cookies help us understand how visitors use our website. We use this data to improve the user experience. We use Google Analytics 4 both on the landing page (aibooking.hu) and within the application.

What do we see in Google Analytics?

• How many visitors do we have (daily, weekly, monthly)
• Which pages are the most popular
• Where visitors come from (direct, search engines, social media)
• Which devices they browse from (mobile, tablet, desktop)
• Which countries/cities they come from
• How much time visitors spend on the site
• Where visitors leave the page (bounce rate)

What we DON'T see?

• Your name, email address, or any personally identifiable data
• Your exact home address
• The content of the forms you have filled in

Marketing cookies (with consent)

Legal basis: GDPR Art. 6(1)(a) – Consent

These cookies allow us to display our ads in a targeted way and measure their effectiveness.

What does this mean in practice?

If you have consented to marketing cookies and visited the AI Booking website:

• Facebook "remembers" that you visited us
• Later, when scrolling on Facebook or Instagram, you may see an AI Booking ad
• We see how many people clicked our ad and how many registered
• We can't see that you specifically clicked — only aggregated numbers

If this bothers you: You can disable marketing cookies in the settings, and also restrict targeted ads in Facebook's ad settings.

8.2. Managing cookies – How can you decide?

1. Cookie banner:

On your first visit to the site, a banner appears where you can choose:

• "Accept all" — allows all cookie types
• "Necessary only" – allows only the cookies essential for operation
• "Settings" — you can decide on each category individually

2. Changing cookie settings later:

You can change your decision at any time by clicking the "Cookie settings" link at the bottom of the page.

3. Browser settings:

You can also manage cookies in your browser:

Browser cookie settings

• Google Chrome: support.google.com/chrome/answer/95647
• Mozilla Firefox: support.mozilla.org/hu/kb/sutik
• Safari: support.apple.com/safari
• Microsoft Edge: support.microsoft.com/edge

Attention

If you disable all cookies in your browser, some functions of the website will not work (e.g. you won't be able to log in, or you'll have to log in again on every page).

9. Retention periods – How long do we store your data?

GDPR Art. 5(1)(e) – storage limitation principle, GDPR Art. 13(2)(a)

GDPR requires that personal data be stored only as long as the purpose of the processing requires. Below we specify exactly how long each category of data is retained, and what happens afterward.

9.1. Overview of retention periods

9.2. Account Deletion Process

Account deletion happens in three steps:

Important regarding retention periods

Certain data must be retained even after account deletion, based on legal obligation:

• Billing data (8 years): Pursuant to Section 169(2) of Act C of 2000 (Accounting Act), accounting documents must be retained for 8 years
• VAT data (8 years): Under Act CXXVII of 2007 (VAT Act), VAT documents must be retained for 8 years.
• Fact of marketing consent (5 years): Proof that the marketing outreach was carried out lawfully (Section 6 of the Hungarian Advertising Act)

We automatically and permanently delete this data once the retention period expires.

10. Data Security – How do we protect your data?

GDPR Article 32 – Security of processing, GDPR Article 25 – Data protection by design and by default

Data protection is not just our legal obligation, but also our technical responsibility. In the AI Booking system we apply multi-layered security measures that meet the security level "appropriate to the risk" required by Article 32 of the GDPR.

10.1. Encryption

10.2. Access protection

10.3. Protection against attacks

10.4. Backup and recovery

10.5. Organizational measures

10.6. Handling of data protection incidents

What happens in the event of a data breach?

If a security incident affecting your personal data occurs (e.g. data breach, unauthorized access), we will proceed as follows regarding the GDPR Article 33-34 in accordance with its requirements:

In summary

In the AI Booking system, data protection is "privacy by design" (privacy by design) and the "privacy by default" (privacy by default) principles. This means data protection is not an afterthought, but a fundamental element of the system's design.

11. Your rights – How can you control your data?

GDPR Art. 15-22, Hungarian Info Act §14-21

The GDPR grants you extensive rights over your personal data. Below we present these rights in detail and how you can exercise them within the AI Booking system.

11.1. Right of access (GDPR Article 15)

What does it mean? You have the right to receive confirmation from us as to whether we process your personal data, and if so, the right to access that data, as well as the following information:

• Purposes of data processing
• Categories of data processed
• Who has received or will receive the data (recipients)
• Planned data retention period
• Information about your further rights
• If the data does not come from you, its source is

How can you exercise it?

• Self-service: Under Account settings → "My Data" you can view most of the data we store
• Written request: Write to and within 30 days we will send you a copy of all data stored about you in a machine-readable format (JSON or CSV)

11.2. Right to rectification (GDPR Art. 16)

What does it mean? You have the right to request, without undue delay, the correction of your inaccurate personal data, or the completion of incomplete data.

How can you exercise it?

• Self-service: You can directly update your name, phone number, email address, and other details in the profile settings.
• Written request: If the data cannot be modified in the system, write to us – within 15 days we will correct it

11.3. Right to erasure – "The right to be forgotten" (GDPR Art. 17)

What does it mean? You have the right to request that we erase your personal data without undue delay, if one of the following conditions applies:

• The data is no longer needed for the purpose for which it was collected
• You withdraw your consent, and there is no other legal basis for processing
• You object to the processing, and there is no overriding legitimate ground
• The data was processed unlawfully
• The data must be deleted to fulfill a legal obligation

When can we NOT delete your data?

The right to erasure cannot be exercised if the processing is necessary:

• To fulfill a legal obligation: E.g. invoicing data — we must retain it for 8 years (Accounting Act Section 169)
• To assert or defend legal claims: E.g. in case of an ongoing legal dispute
• For public interest archiving: If required by law

How can you exercise it?

• Account deletion: Account Settings → "Delete Account" button → 60-day recovery period → permanent deletion
• Written request: Write to the address – within 30 days we fulfill

11.4. The right to restriction of processing (GDPR Article 18)

What does it mean? You may request that we not delete your data but temporarily "freeze" it — meaning we don't actively process it. This is useful if:

• You dispute the accuracy of the data – until we verify it, the data is restricted
• The processing is unlawful, but you request restriction instead of deletion
• We no longer need the data, but you need it to enforce a legal claim
• You have objected to the data processing – while we assess whether the objection is justified

During the period of restriction, the data we only store, but we do not actively process it (we do not forward or use it), except with your consent or to enforce legal claims.

11.5. Right to data portability (GDPR Article 20)

What does it mean? You have the right to receive your personal data in a structured, widely used, machine-readable format receives, and to transmit them to another data controller.

In what format can we export it?

• JSON – machine-readable structured format
• CSV – a format that can be opened with spreadsheet apps

What data does this apply to? Only to those you have provided us with, based on consent or contract:

• Registration data (name, email, phone)
• Booking history
• Notification settings

How can you exercise it?

Write to the address – within 30 days we will send the data in the requested format.

11.6. Right to object (GDPR Article 21)

What does it mean? You are entitled to object at any time against the processing of your personal data based on legitimate interest. In such cases, we must examine whether our legitimate interest overrides yours.

In particular, you may object to the following:

• Direct marketing: If you object, instantly we must stop marketing-related data processing — no discretion involved
• Logging based on legitimate interest: We review security logging, but for security reasons we cannot always discontinue it
• Data processing for statistical purposes: Does not apply to aggregated, anonymized data (as it is not personal data)

11.7. Protection against automated decision-making (GDPR Article 22)

What does it mean? You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you.

AI Booking does NOT apply automated decision-making

We do not make decisions about your personal data based solely on automated processing. We do not reject bookings, change prices, or restrict access based on automated systems. All such decisions are made by a human.

Summary of rights exercise

Important information for exercising your rights

• Free: A kérelmek teljesítése ingyenes. Ha a kérelem nyilvánvalóan megalapozatlan vagy – különösen ismétlődő jellege miatt – túlzó, ésszerű díjat számíthatunk fel, vagy megtagadhatjuk a kérelem teljesítését.
• Identification: Before fulfilling the request, we must verify your identity. This is usually done via a request sent from the registered email address.
• Deadline extension: In particularly complex cases, the 30-day deadline may be extended by up to 2 months — you will be informed of this within the original deadline.
• Rejection: If we are unable to fulfill the request, we will provide a reasoned response and inform you of the available remedies.

12. Remedies – Where can you file a complaint?

GDPR Art. 77-79, Hungarian Info Act §22-23

If you feel your rights regarding the processing of your personal data have been violated, several remedies are available to you. We recommend that you contact us directly first — we can resolve most issues quickly.

12.1. Direct contact — Reach out to us first!

Get in touch with us

Most data protection questions and complaints quickly and directly we can resolve it. Write to us:

• Email: info@aibooking.hu
• Response time: General inquiry – within 15 days, request to exercise rights – within 30 days

Please state in your request the your registered email address, so we can identify you — this speeds up the process.

12.2. Complaint to the authority – NAIH

What is the NAIH? The National Authority for Data Protection and Freedom of Information is Hungary's independent data protection supervisory authority, which anyone can contact free of charge with a data protection complaint.

The procedure of the NAIH (Hungarian Data Protection Authority)

• Filing a complaint: In writing (letter, email) or via the NAIH online form
• Fee: The procedure free
• Review: The NAIH investigates the complaint and informs you of the outcome
• Action: If it finds a violation, it may call on us to modify or suspend the data processing, or impose a fine

12.3. Legal recourse

If neither direct contact nor the NAIH procedure has brought the desired result, you are entitled to go to court.

12.4. Summary of legal remedies

Important

The legal remedies are independent of each other regardless can also be used — you don't need to exhaust one path before choosing the other. Of course, we recommend that you contact us directly first.

13. Provider Features – Data Protection on the Provider Side

GDPR Article 26 – Joint Controllers, GDPR Article 28 – Processor

AI Booking is a multi-actor system: service providers (hairdresser, beautician, trainer, etc.) use the system as part of their own business, and they themselves become data controllers with regard to their guests' data. This chapter presents the data protection aspects of this.

13.1. Who is the data controller for provider-side operations?

Roles in the multi-user system

In the provider-guest relationship, the data processing roles are divided as follows:

13.2. Data Processing Agreement (DPA)

What is a DPA? The Data Processing Agreement is a mandatory contract between the data controller (the service provider) and the data processor (AI Booking) that governs how the data processor handles personal data on the data controller's behalf.

When a provider registers and actively uses the AI Booking system, the General Terms and Conditions (GTC) by accepting this, you simultaneously accept the AI Booking Data Processing Agreement, which sets out:

• The subject, duration, nature and purpose of the data processing
• The types of personal data processed and the categories of data subjects
• The rights and obligations of the data controller (provider)
• The obligations of the data processor (AI Booking), including:
  • Acts solely according to the service provider's instructions
  • Ensures that persons with access are bound by confidentiality
  • Implements security measures under GDPR Article 32
  • If a sub-processor is engaged, the provider will be informed
  • Helps the provider fulfill data subjects' rights
  • Deletes the data after the agreement terminates

13.3. The provider's own obligations

Important for every service provider!

By using AI Booking, the provider an independent data controller in respect of your guests' personal data. This means the following:

13.4. Provider data export and account deletion

What happens if a service provider leaves the AI Booking platform?

Important regarding guest data upon account deletion

Deleting the provider's account does not delete guests' accounts. A vendégek továbbra is rendelkeznek AI Booking-fiókkal, és más szolgáltatóknál továbbra is foglalhatnak. A korábbi foglalási előzmények anonimizálva megmaradnak (a szolgáltató neve nélkül), hogy a vendég láthassa saját foglalási történetét.

13.5. Sub-processors for service provider functions

When AI Booking acts as a data processor on behalf of a provider, it uses the following sub-processors:

Providers about changes to the list of sub-processors we will notify you in advance, and we provide the opportunity to object under Article 28(2) of the GDPR.

In summary

AI Booking and the providers they cooperate in the field of data protection. We provide the technical infrastructure and the GDPR-compatible system, while providers are responsible for informing their own guests and complying with data handling rules. We support all this with templates, automations, and guides.

14. Frequently Asked Questions (FAQ)

How do I delete my account and all my data?

Answer: You'll find the "Delete account" option in account settings. After deletion, the account can still be restored for 60 days (in case you change your mind), after which it's permanently deleted. Important: by law we must keep billing data for 8 years, so that cannot be deleted.

How can I find out what data is stored about me?

Answer: You have two options:

1. Under Account Settings, in the "My Data" menu, you can view most of your data
2. Write to us at , and within 30 days we will send you a copy of all data stored about you

Why am I still receiving emails after unsubscribing from the newsletter?

Answer: Unsubscribing from the newsletter only affects marketing emails. You will still receive transactional emails (booking confirmation, reminders, password reset) because they are necessary for the service to function. If you don't want any emails at all, you need to delete your account.

Is my credit card data safe?

Answer: Yes! We NEVER see or store the full card number, expiry date, or CVC code. Payments are handled by Stripe, which holds PCI DSS Level 1 certification (the highest security level). We only see the transaction ID and the last 4 digits of the card.

Who can see my bookings?

Answer:

• Ön – in your own account
• the service provider – the party they booked with (and their staff, if any)
• We (AI Booking) – for technical reasons and customer support

Other users, other providers, or third parties CANNOT see your bookings.

What happens to my data if the service provider closes their account?

Answer: If a provider deletes their account from the AI Booking system:

• Your account and data related to AI Booking will be retained
• Previous bookings with the deleted provider are archived (but not deleted, due to accounting law requirements)
• You cannot create more bookings for the given provider

How can I turn off Facebook ads?

Answer: In two steps:

1. On the AI Booking site: Cookie Settings → Turn off marketing cookies
2. On Facebook: Settings → Ads → Ad Preferences → Restrict

Where can I turn if I am not satisfied with the data handling?

Answer: You have three options:

1. Contact us: – in most cases we can solve it
2. Complaint to NAIH: www.naih.hu – the Hungarian data protection authority
3. Court: If you suffered damage, you may claim compensation

Do they use artificial intelligence to analyze my data?

Answer: We do not use AI to analyze your personal data, build profiles, or make automated decisions. The AI Booking system serves solely to simplify appointment scheduling.

15. Contact

If you have any questions, comments, or requests regarding this notice or our data processing, please feel free to contact us at the following:

Our Contact Details

Response times

16. Protection of Minors

The AI Booking service is not intended for persons under 16 years of age. A GDPR 8. cikke és az Infotv. alapján Magyarországon a 16. életévét be nem töltött személy hozzájárulása csak a szülői felügyeleti jogot gyakorló személy jóváhagyásával érvényes.

16.1. How do we handle this?

• Registration: During the registration process, the user must confirm that they have reached the age of 16
• Booking: Only persons over 16 years of age may initiate a booking
• Provider account: A service provider account may only be created by a natural person over 18 with legal capacity, or a legal entity

16.2. What happens if we identify data belonging to a minor?

If we become aware that a person under 16 has registered in the system without parental consent:

1. Immediate account suspension – account use will be temporarily restricted
2. Notification – we will attempt to contact the parent/guardian
3. Delete – if parental consent is not received within 30 days, we permanently delete the account and all related personal data

Parental notification: If you are a parent or guardian and believe your child has registered without your knowledge, please let us know:

17. Data Protection Officer (DPO)

Under Article 37 of the GDPR, appointing a data protection officer is mandatory if the data controller:

• a public authority body or a body performing public duties,
• its main activity requires large-scale, regular and systematic monitoring, or
• main activity is the large-scale processing of special categories of data.

The status of AI Booking's data controller:

Dobó Imre, sole trader is not obliged to appoint a data protection officer, since none of the above conditions apply. AI Booking does not carry out large-scale data processing, does not process special categories of data, and does not operate as a public authority.

17.1. Data protection contact person

Although appointing a DPO is not mandatory, we are available for data protection questions at the following contact:

18. International data transfer

AI Booking's primary server infrastructure is located in the in the European Union is located (Hostinger – Lithuania). However, some of our providers are located outside the EU, mainly in the in the United States work.

18.1. Overview of data transfers outside the EU

18.2. Applied guarantees

EU-US Data Privacy Framework (DPF)

On July 10, 2023, the European Commission adopted an adequacy decision on the EU-US Data Privacy Framework. Every US provider listed above holds DPF certification.

Standard Contractual Clauses (SCCs)

Standard Contractual Clauses (SCCs) approved by the European Commission are in place with every non-EU data processor, ensuring GDPR-level protection of data even during transfer.

Should the EU-US Data Privacy Framework decision be invalidated by the European Court of Justice or another competent authority, we will immediately review the legal basis for data transfer, and if necessary apply alternative safeguards or suspend the use of the affected providers.

19. Amendment of the Notice

We reserve the right to amend this Privacy Notice when necessary. Amendment is particularly necessary in the following cases:

• Change in legislation (GDPR, applicable data protection laws, other relevant regulations)
• Introducing a new service or feature
• Change of data processor or involvement of a new processor
• Regulatory recommendation or notice
• Security or technological changes

19.1. How do we notify you of changes?

Tip: We recommend reviewing this page periodically to stay up to date with any changes. The current version number and date are always shown at the top of the page.

19.2. Version history

Handling of Google user data – Limited Use

AI Booking uses the information received from Google APIs (Google Calendar) exclusively to provide the service's advertised, user-visible features: entering confirmed bookings into the provider's Google Calendar, and reading busy times to avoid double bookings.

We do not sell Google user data, do not use it for advertising purposes, do not pass it on to third parties beyond the functions described above, and do not carry out human reading or analysis of it — unless the user has given explicit consent, it is required for security or legal reasons, or the data is in aggregated/anonymized form.

AI Booking complies with the following when using information received from Google APIs: Google API Services User Data Policy requirements, including the Limited Use requirements.

AI Booking's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Barion Pixel – security for card payments

To ensure the security of online card payments and prevent fraud, our website Barion Pixel we use a fraud-prevention tool called Barion Payment Zrt. (registered office: 1117 Budapest, Infopark sétány 1. I. épület; hereinafter: Barion). Barion Pixel collects data from visitor and customer activity (such as actions taken on the site, as well as device and browser data), based on which Barion performs an automated risk assessment to filter out bank card fraud.

Purpose of data processing: preventing credit card payment fraud and increasing payment security. Legal basis: the legitimate interest of the data controller and Barion (GDPR Art. 6(1)(f)). Recipient of the data: Barion Payment Zrt. as an independent data controller.

For details on Barion's data processing, see the on Barion's legal background and privacy page you can find out more.