Privacy Policy

Who we are

Apex Chatbot is operated by Tokár Ádám EV (sole proprietor), Gyula, Hungary. Contact: adam@apexweb.hu. We are the data controller for the personal data described below.

What data we process

Account data: your name, email address, business name, website URL, phone number, and the knowledge base text you provide during onboarding.

Optional social sign-in: if you deliberately continue with Google or GitHub, we receive the basic account identifier, email address, name and avatar made available by that provider. We request only the OpenID, email and profile access needed to authenticate you; we do not use the provider token to access your files, repositories, contacts or other services.

Chatbot conversations: messages exchanged between your website visitors and your chatbot, including any contact details (email, phone) a visitor chooses to share.

Billing data: your Stripe customer ID and subscription status. Card numbers are processed by Stripe and never reach our servers.

Website content: the public pages of the website URL you provide, which we periodically read so your chatbot can answer with current information.

Optional first-party analytics: after analytics consent, we record the page visited, first landing page, referrer domain and path, UTM campaign parameters, session ID, country and region supplied by our hosting provider, and coarse device/browser category. We do not store a raw IP address or create a fingerprint for this analytics.

Active demo usage: when you deliberately start a public chatbot, support, browser voice, or verified callback demo, we record the demo type, current and first landing page, random session ID, referrer host, campaign parameters, country and region supplied by our hosting provider, coarse device/browser category, response language, and whether the demo started, completed, or failed. If analytics consent exists, the demo can be linked to that consented page journey. We do not store a raw IP address or create a browser fingerprint in this demo log.

Voice demos: browser audio is processed by Vapi to provide the live demo and is not recorded by Apex. For an optional phone callback, Telnyx verifies ownership with an SMS code; we store the verified number, request IP address, requested page, campaign source and call outcome to provide the requested call and prevent abuse.

Why we process it (legal basis)

To provide the service you signed up for (contract performance, GDPR Art. 6(1)(b)).

To send transactional emails such as welcome emails and lead notifications (contract performance).

To improve reliability and prevent abuse, including rate limiting (legitimate interest, Art. 6(1)(f)).

Processors we use

OpenAI (USA): generates chatbot replies. Conversation text is sent to OpenAI for processing.

Supabase (EU, Frankfurt): database and authentication hosting.

Vercel (EU edge/US): application hosting.

Stripe (EU/USA): payments and subscription management.

Resend (USA): transactional email delivery.

Telnyx (USA/EU): SMS phone ownership verification and telephone connectivity for requested demo calls.

Vapi (USA): real-time browser and telephone voice-agent orchestration for voice demos.

Soniox (USA or configured EU processing region): real-time speech recognition for the Voice product.

Google and GitHub (only when you choose their sign-in button): identity verification and basic profile data for account authentication.

Microsoft Clarity (only after analytics consent): heatmaps and session-level interaction analytics used to improve the public website. Sensitive content is masked and advertising storage remains disabled.

Telnyx (USA/global telecommunications network): phone numbers, call routing, and SMS verification for optional callbacks.

Each processor is bound by a data processing agreement. Transfers outside the EEA rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

Retention

Account and conversation data is kept while your account is active and deleted within 30 days after account deletion. Consent-based first-party analytics is retained for up to 13 months. Public demo activity and demo callback security and delivery logs are retained for up to 90 days. Billing records are kept as long as Hungarian accounting law requires (8 years).

Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing. Write to adam@apexweb.hu. You may also lodge a complaint with the Hungarian supervisory authority (NAIH, naih.hu).

If your visitors exercise their rights regarding conversation data, we assist you as your processor for that data.

Cookies

We use essential cookies for login sessions. Optional first-party analytics starts only if you accept analytics in the cookie banner. You can change your choice at any time; opting out clears the local analytics session.