Privacy Notice

Enéh AI Chat Assistant Service

1. Details of the controller and the processor

1.1. Controller (for data relating to the Service's customers / Subscribers)

1.2. Processor capacity (for data typed into the chat by website visitors)

When end-users (visitors) use the Enéh chat widget on a Subscriber's website, the Subscriber is the Controller of the visitors' personal data, and the Provider (Cser Tamás Dániel e.v.) acts as a Processor under Article 28 GDPR.

The same division of roles applies when a Subscriber connects its own Facebook Page or WhatsApp number to Enéh: for the messages sent there, the Subscriber is the Controller and the Provider is a Processor. The Subscriber connects the channel itself and can disconnect it at any time from the owner panel — see the Data Deletion Instructions.

2. Scope of the data processed, purpose and legal basis

A) Subscribers' (customers') data (B2B relationship)

Purpose of processing	Data processed	Legal basis	Retention period
Contracting and service provision	Name, email address, phone number, company name, seat, website URL	Performance of a contract (Art. 6(1)(b) GDPR)	Duration of the contractual relationship + 5 years
Invoicing and accounting	Billing name, address, tax number, payment transaction identifiers	Compliance with a legal obligation (Art. 6(1)(c) GDPR / Accounting Act)	8 years (under the Accounting Act)
Card payment	Bank card data (handled solely by Stripe; the Provider does not see it)	Performance of a contract (Art. 6(1)(b) GDPR)	Per Stripe's privacy policy

B) Data of Visitors using the chat widget (end-users)

Purpose of processing	Data processed	Legal basis	Retention period
AI responses and customer service	Text messages entered during the chat, attached images (Pro plan), technical identifiers	Subscriber's legitimate interest / consent (Art. 6(1)(a) / (f) GDPR)	90 days by default, then automatically deleted
Lead capture and notification	Name, email address, phone number (if the visitor provides them)	The data subject's voluntary consent (Art. 6(1)(a) GDPR)	Until handed over to the Subscriber and the end of the 90-day cycle
Session continuity	Anonymous session identifier (localStorage)	Legitimate interest (technical data essential to operation)	Until the browser's local storage is cleared

C) Data of people writing via Facebook Messenger and WhatsApp

Where a Subscriber has connected its own Facebook Page or WhatsApp number, Enéh also answers the messages arriving there. That data reaches us from Meta's platforms; we have no access to the Facebook profile, friends, posts, email address or advertising data of the person writing.

Purpose of processing	Data processed	Legal basis	Retention period
AI responses on Messenger / WhatsApp	The message text and its timestamp, plus the platform-scoped sender identifier (a page-scoped PSID on Messenger, the sender's phone number on WhatsApp)	Subscriber's legitimate interest (Art. 6(1)(f) GDPR) — the data subject initiates the conversation	90 days by default, then automatically deleted
Maintaining the channel (on the Subscriber's side)	The Facebook Page id and name, or the WhatsApp phone number id and WhatsApp Business Account id, together with an access token stored encrypted	Performance of a contract (Art. 6(1)(b) GDPR)	Until the channel is disconnected (deleted immediately)

Meta's own processing — that is, whatever happens inside Messenger or WhatsApp itself — is outside the Provider's control and is governed by Meta's Privacy Policy.

3. Especially important: AI processing and a ban on model training

3.1. Purpose-bound AI processing: Enéh transmits the data and attached images entered during the chat to its partners (Anthropic, PBC and OpenAI, LLC) over a secure API connection in order to generate a response.

3.2. No AI training: The Provider guarantees that the business's data and the messages typed into the chat by visitors are used solely to produce the given response, and that neither the Provider, nor Anthropic, nor OpenAI uses them to train or develop public AI models.

3.3. Location of processing: AI language model processing takes place on servers located in the European Union (EU region), or on servers that provide adequate data-protection safeguards under the EU–US Data Privacy Framework.

4. Processors and recipients

In the course of its operation the Provider engages the following trusted processors:

• Stripe, Inc. (USA/EU): automated card payment and subscription management. (Data Privacy Framework certified.)
• KBOSS Kft. / Számlázz.hu (Hungary): automatic electronic invoicing.
• Anthropic, PBC and OpenAI, LLC (USA/EU): provision of AI language models via API (solely for real-time responses, with a training ban).
• OVH SAS (EU): cloud infrastructure, database and application hosting.
• Google Ireland Ltd. (EU/USA): anonymous visitor statistics (Google Analytics) on the eneh.hu marketing pages — only where you have expressly consented. (Data Privacy Framework certified.)
• Meta Platforms Ireland Limited (EU): delivery of Facebook Messenger and WhatsApp messages — only where a Subscriber has connected its own Page or number. In those conversations Meta is an independent controller of the messaging platform itself.

5. Cookies and storage

5.1. Strictly necessary cookies. On eneh.hu a session cookie keeps the site working (sign-in, form security / CSRF protection, remembering your language choice), and one cookie stores your own cookie preference. These are essential to operate the site and therefore require no consent.

5.2. Statistics cookies (consent-based). On the marketing pages we collect anonymous visitor statistics using Google Analytics. These cookies are set only if you expressly accept them in the banner — if you decline, no statistics cookie is placed in your browser at all. You can withdraw or change your consent at any time via the "Cookie settings" link in the footer.

5.3. The chat widget. The widget does NOT use tracking or marketing cookies. It uses only the browser's local storage (localStorage) to save a randomly generated, anonymous session identifier (Session ID), so that the chat window remembers earlier messages after a page refresh. It does not perform any cross-site tracking.

6. Rights of the data subject

The data subject (both the Subscriber and the visitor using the chat) may exercise the following rights via support (at) eneh (dot) hu:

• Right of access: request information about the personal data processed.
• Right to rectification: request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): request deletion of their data (except mandatory accounting data).
• Restriction of processing: request that data be blocked.
• Data portability: request their data in a machine-readable format.

The steps for deleting a conversation held over Facebook Messenger or WhatsApp are set out separately, in plain language, in the Data Deletion Instructions.

7. Remedies

If the data subject considers that the Provider has infringed their right to the protection of personal data, they may lodge a complaint with the authority:

For a judicial remedy, the data subject may turn to the regional court with jurisdiction over their place of residence or stay.