Privacy Policy

Effective from January 1, 2026. Last updated: October 2026.

1. Introduction

Gábor Jurgovszki, sole proprietor (hereinafter: Data Controller) operates the SaaS service available under the autocontent.hu domain. The Data Controller is committed to the protection of users' personal data and processes such data under the following terms, with particular regard to Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR) and applicable Hungarian regulations (in particular Act CXII of 2011, the Hungarian Information Act).

2. What data do we process?

3. Data processors (third parties)

The Data Controller may rely on various technology partners to operate the Service. The specific partner constellation may change continuously during the development, optimisation and quality improvement of the Service. The listed partners process the data transferred to them in accordance with their own privacy policies and access them only to the extent necessary.

3.1 Identity and login providers

• Google LLC (USA): OAuth login (name, e-mail, profile picture). Privacy

3.2 AI language models and content generation providers

For AI operations (article generation, text refinement, embedding, structure analysis, research, translation, image metadata extraction, summarisation, etc.) we may use any of the providers listed below. The specific task and model selection may dynamically vary based on performance, cost and quality considerations; we are not bound to any single provider and may switch to another partner at any time in order to improve the quality of the Service:

• OpenAI (USA)
• Anthropic (USA)
• Google LLC: Gemini (USA)
• Mistral AI (France)
• Meta Platforms: Llama models (USA)
• xAI (USA)
• Cohere (Canada)
• Perplexity AI (USA)
• Groq (USA)
• Together AI (USA)
• DeepSeek (People's Republic of China): only for non-sensitive tasks, with explicit User consent
• Amazon Web Services: Bedrock (USA)
• Microsoft Azure: Azure OpenAI (USA / EU)
• Hugging Face (USA / France)
• Replicate (USA)
• TypeSafe AI, Inc.: JEV decision model, for checking generated content and matching sources (USA)

The prompt provided by the User and the response returned by the AI provider are handled in accordance with that provider's own storage and retention policy. The Data Controller endeavours, where possible, to choose partners that do not use user data for their own model training.

3.3 Visual and image providers

• Stock image providers, including Magnific, Freepik, Shutterstock, Adobe Stock, Unsplash, Pexels, etc. (image search queries, metadata of image downloads)
• AI image generation providers, including OpenAI DALL·E, Stability AI, Midjourney, Black Forest Labs Flux, Google Imagen, Ideogram, etc.

3.4 Search and research APIs

• Web search APIs, including SerpAPI, Bing Search API, Brave Search API, Google Programmable Search, ScraperAPI, etc. (only the search queries are forwarded for topic research)

3.5 Hosting, CDN and infrastructure providers

• Cloud hosting and object storage, including Cloudflare R2, Amazon S3, Google Cloud Storage, Microsoft Azure Blob, Backblaze B2, etc.
• CDN and edge providers, including Cloudflare, AWS CloudFront, Fastly, etc.
• Application hosting partners (EU or Hungarian servers): running the Service

3.6 E-mail and notification providers

• SMTP and transactional e-mail providers, including own SMTP server, Postmark, AWS SES, SendGrid, Resend, Mailgun, etc. (registration confirmation, password reminder, 2FA codes)

3.7 Payment and invoicing providers (future)

• Online payment and invoicing providers: an updated list of data processors will be made available when payment channels are introduced

3.8 Web analytics and ad measurement (only with consent)

• Google Analytics 4 (Google Ireland Ltd.) and Microsoft Clarity (Microsoft Ireland Operations Ltd.): visitor measurement. Details in section 4.
• Google Ads (Google Ireland Ltd.): measuring the performance of our ads. Details in section 4.3.

The above lists are indicative; the partner constellation actually used by the Service may change during the development cycle. The User may at any time request up-to-date information at info@autocontent.hu regarding which partners specifically process their data.

4. Cookies and web analytics

On autocontent.hu and blog.autocontent.hu we use three kinds of cookies: those necessary for operation and, if you agree, statistics and ad measurement cookies. With the Settings button of the cookie banner you can accept or reject the two consent categories separately. Your cookie choice applies to both sites, and you can change it at any time with the Cookie settings link at the bottom of the page.

4.1 Cookies necessary for operation

The Service does not work without these, so no consent is required for them (Section 155 (4) of Hungarian Act C of 2003 on Electronic Communications).

• autocontent_session: managing the logged-in session, for up to 8 hours.
• XSRF-TOKEN: protection against cross-site request forgery (CSRF).
• ac_consent: stores your cookie choice so that we do not ask on every page. It contains only the choice (per category), its time, the version of this notice and a random identifier. It is valid for 6 months, after which we ask again.

4.2 Statistics cookies (only with consent)

We only turn these on if you click Accept all in the cookie banner, or turn on the Statistics category under Settings. Until then, no measurement script is loaded. Their purpose is to measure where visitors come from, which pages and articles they read, and how many visitors sign up. We do not use the data for ad personalisation, and we do not link it to your account data.

• Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), on the public pages of autocontent.hu and on blog.autocontent.hu. Cookies: _ga and _ga_…, for 13 months. Google does not log or store the IP address of visitors from the EU: it uses it only to derive an approximate location (country, city) and then discards it immediately. We keep the measurement data for 14 months. Advertising features (Google Signals, ad personalisation) are turned off. If you arrive by clicking one of our Google ads, Google Analytics also records the click identifier in the address (gclid), so we can see which ad brought a visit or an order. We only set advertising cookies with your ad measurement consent (section 4.3).
• Microsoft Clarity (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), on the public pages of autocontent.hu and on blog.autocontent.hu (in two separate projects). It does not run in the logged-in area (account, article editor). It creates heatmaps and session replays: it records clicks, scrolling and mouse movement, with text typed into input fields masked. Cookies: _clck, _clsk and, on Microsoft's own domains, CLID, MUID, MR, SM and ANONCHK. Recordings are kept for 30 days, heatmaps for 9 months. Clarity also passes the identifier of the session recording to Google Analytics, so the data of the two measurements can be linked.

4.3 Ad measurement cookies (only with consent)

We only turn these on if you click Accept all in the cookie banner, or turn on the Ad measurement category under Settings. Their purpose is to measure which of the visitors who click our Google Ads ads request a quote or sign up, so we can see which ad performs well. We do not use remarketing or ad personalisation, and we also signal this as refused to Google.

• Google Ads conversion measurement (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), through Google Analytics 4, on the public pages of autocontent.hu and on blog.autocontent.hu. Cookies: _gcl_au and, if you arrive by clicking a Google ad, _gcl_aw, for 90 days. Google Analytics passes the measured conversions (for example a quote request) to our Google Ads account.

Legal basis: your consent (Article 6 (1) (a) GDPR), per category. You can withdraw it at any time with the Cookie settings link; we then delete the cookies of that category from your browser. Withdrawal does not affect the lawfulness of processing before it.

Google LLC and Microsoft Corporation are certified participants of the EU–U.S. Data Privacy Framework, so any transfer to the United States is based on the European Commission's adequacy decision of 10 July 2023.

We do not use remarketing or ad personalisation cookies (such as the Facebook Pixel).

5. Rights of the data subject (Articles 15–22 GDPR)

The User (data subject) has the following rights:

• Right of access: may request information on the data we process about them
• Right to rectification: correction of inaccurate data
• Right to erasure ("right to be forgotten"): upon account deletion, personal data are deleted within 30 days. Exceptions: where the Hungarian Accounting Act requires 8-year retention, and the activity log, which we retain under GDPR Article 17(3)(e) for the establishment, exercise or defence of payment claims, for up to 180 days. Besides the account identifier, this log holds the e-mail address and name as they stood at the time of the event.
• Right to restriction: in certain cases, processing may be suspended upon request
• Right to data portability: data may be requested in a machine-readable format
• Right to object: to processing based on legitimate interest

Rights can be exercised at info@autocontent.hu. The Data Controller will respond to the request within 30 days.

6. Data security

The Data Controller applies the following technical and organisational measures:

• HTTPS encryption for all data traffic
• Passwords hashed using bcrypt (never stored in plain text)
• External API keys protected with envelope encryption (AES-256-GCM)
• Two-factor authentication (2FA) support
• Regular security audits and software updates
• Organised backup and recovery plan

7. Data transfers to third countries

Some data processors (Google, AI providers) are based outside the European Economic Area. Data transfers take place under appropriate safeguards as set out in Article 46 GDPR (Standard Contractual Clauses, SCC).

8. Automated decision-making

The Service includes AI-based content generation features. These features generate content in response to User requests, but they do not make automated decisions concerning the rights or legal status of the User.

9. Right to lodge a complaint (NAIH)

If the User considers that the processing of personal data violates the law, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:

10. Modification of this notice

The Data Controller reserves the right to modify this Privacy Policy. Users will be notified of changes by e-mail or through an in-Service notification. Changes take effect 15 days after notification.

11. Contact

For any questions related to data protection, please contact us: