Privacy Notice

Enéh AI Chat Assistant Service

1. Details of the controller and the processor

1.1. Controller (for data relating to the Service's customers / Subscribers)

1.2. Processor capacity (for data typed into the chat by website visitors)

When end-users (visitors) use the Enéh chat widget on a Subscriber's website, the Subscriber is the Controller of the visitors' personal data, and the Provider (Cser Tamás Dániel e.v.) acts as a Processor under Article 28 GDPR.

2. Scope of the data processed, purpose and legal basis

A) Subscribers' (customers') data (B2B relationship)

Purpose of processing	Data processed	Legal basis	Retention period
Contracting and service provision	Name, email address, phone number, company name, seat, website URL	Performance of a contract (Art. 6(1)(b) GDPR)	Duration of the contractual relationship + 5 years
Invoicing and accounting	Billing name, address, tax number, payment transaction identifiers	Compliance with a legal obligation (Art. 6(1)(c) GDPR / Accounting Act)	8 years (under the Accounting Act)
Card payment	Bank card data (handled solely by Stripe; the Provider does not see it)	Performance of a contract (Art. 6(1)(b) GDPR)	Per Stripe's privacy policy

B) Data of Visitors using the chat widget (end-users)

Purpose of processing	Data processed	Legal basis	Retention period
AI responses and customer service	Text messages entered during the chat, attached images (Pro plan), technical identifiers	Subscriber's legitimate interest / consent (Art. 6(1)(a) / (f) GDPR)	90 days by default, then automatically deleted
Lead capture and notification	Name, email address, phone number (if the visitor provides them)	The data subject's voluntary consent (Art. 6(1)(a) GDPR)	Until handed over to the Subscriber and the end of the 90-day cycle
Session continuity	Anonymous session identifier (localStorage)	Legitimate interest (technical data essential to operation)	Until the browser's local storage is cleared

3. Especially important: AI processing and a ban on model training

3.1. Purpose-bound AI processing: Enéh transmits the data and attached images entered during the chat to its partners (Anthropic, PBC and OpenAI, LLC) over a secure API connection in order to generate a response.

3.2. No AI training: The Provider guarantees that the business's data and the messages typed into the chat by visitors are used solely to produce the given response, and that neither the Provider, nor Anthropic, nor OpenAI uses them to train or develop public AI models.

3.3. Location of processing: AI language model processing takes place on servers located in the European Union (EU region), or on servers that provide adequate data-protection safeguards under the EU–US Data Privacy Framework.

4. Processors and recipients

In the course of its operation the Provider engages the following trusted processors:

• Stripe, Inc. (USA/EU): automated card payment and subscription management. (Data Privacy Framework certified.)
• KBOSS Kft. / Számlázz.hu (Hungary): automatic electronic invoicing.
• Anthropic, PBC and OpenAI, LLC (USA/EU): provision of AI language models via API (solely for real-time responses, with a training ban).
• OVH SAS (EU): cloud infrastructure, database and application hosting.

5. Cookies and storage

5.1. The chat widget does NOT use tracking or marketing cookies.

5.2. The widget uses only the browser's local storage (localStorage) to save a randomly generated, anonymous session identifier (Session ID). This exists so that, if the visitor refreshes the page, the chat window remembers the earlier messages. It does not perform any cross-site tracking.

6. Rights of the data subject

The data subject (both the Subscriber and the visitor using the chat) may exercise the following rights via support@eneh.hu:

• Right of access: request information about the personal data processed.
• Right to rectification: request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): request deletion of their data (except mandatory accounting data).
• Restriction of processing: request that data be blocked.
• Data portability: request their data in a machine-readable format.

7. Remedies

If the data subject considers that the Provider has infringed their right to the protection of personal data, they may lodge a complaint with the authority:

For a judicial remedy, the data subject may turn to the regional court with jurisdiction over their place of residence or stay.