Privacy Policy

Who we are

Apex Chatbot is operated by Tokár Ádám EV (sole proprietor), registered at 5700 Gyula, Szőlős utca 4/1, Hungary. Registration number: 62232744. Tax number: 92003747-1-24. Contact: adam@apexchatbot.com. We are the data controller for the personal data described below.

What data we process

Account data: your name, email address, business name, website URL, phone number, and the knowledge base text you provide during onboarding.

Optional social sign-in: if you deliberately continue with Google or GitHub, we receive the basic account identifier, email address, name and avatar made available by that provider. We request only the OpenID, email and profile access needed to authenticate you; we do not use the provider token to access your files, repositories, contacts or other services.

Chatbot conversations: messages exchanged between your website visitors and your chatbot, including any contact details (email, phone) a visitor chooses to share.

Billing data: your Stripe customer ID and subscription status. Card numbers are processed by Stripe and never reach our servers.

Website content: the public pages of the website URL you provide, which we periodically read so your chatbot can answer with current information.

Optional first-party analytics: after analytics consent, we record the page visited, first landing page, referrer domain and path, UTM campaign parameters, session ID, country and region supplied by our hosting provider, and coarse device/browser category. We do not store a raw IP address or create a fingerprint for this analytics.

Active demo usage: when you deliberately start a public chatbot, support, browser voice, or verified callback demo, we record the demo type, current and first landing page, random session ID, referrer host, campaign parameters, country and region supplied by our hosting provider, coarse device/browser category, response language, and whether the demo started, completed, or failed. If analytics consent exists, the demo can be linked to that consented page journey. We do not store a raw IP address or create a browser fingerprint in this demo log.

Voice demos: browser audio is processed by Vapi to provide the live demo and is not recorded by Apex. For an optional phone callback, Telnyx verifies ownership with an SMS code; we store the verified number, request IP address, requested page, campaign source and call outcome to provide the requested call and prevent abuse.

Business outreach and Apex Lead Rescue

For narrowly targeted business outreach, we may use a business name, public business email address, website, location, public phone number, publicly stated owner or manager name and role, source URL and date, relevance note, and contact, reply, delivery, objection and suppression status.

The source is the business's official public website or another official public business listing. We use the data to assess relevance, make a transparent one-to-one business approach, answer requests, and prevent repeated contact.

Our proposed legal basis is our legitimate interest in relevant business development under GDPR Article 6(1)(f), subject to every separately applicable electronic-marketing rule. You may object to direct marketing at any time by replying to the message or writing to adam@apexchatbot.com. We stop marketing to the objecting address and retain only the minimum suppression record needed to prevent repeat contact.

Nonresponsive prospect records and source evidence are retained for no more than 12 months after the final contact. Delivery evidence and suppression records may be retained longer where reasonably necessary to honor an objection, demonstrate compliance, or handle a legal claim.

Apex Lead Rescue is a business-only 30-day pilot. Any salon enquiry data used in the pilot must be minimized and represented by salon-created pseudonymous IDs. The salon remains the controller and Apex Chatbot acts only on documented instructions as processor. The pilot creates an internal priority queue and owner-reviewed reply drafts. It does not send salon-client messages or make legal or similarly significant decisions automatically.

Why we process it (legal basis)

To provide the service you signed up for (contract performance, GDPR Art. 6(1)(b)).

To send transactional emails such as welcome emails and lead notifications (contract performance).

To improve reliability and prevent abuse, including rate limiting (legitimate interest, Art. 6(1)(f)).

Processors we use

OpenAI (USA): generates chatbot replies. Conversation text is sent to OpenAI for processing.

Supabase (EU, Frankfurt): database and authentication hosting.

Vercel (EU edge/US): application hosting.

Stripe (EU/USA): payments and subscription management.

Resend (USA): transactional email delivery.

Telnyx (USA/EU): SMS phone ownership verification and telephone connectivity for requested demo calls.

Vapi (USA): real-time browser and telephone voice-agent orchestration for voice demos.

Soniox (USA or configured EU processing region): real-time speech recognition for the Voice product.

Google and GitHub (only when you choose their sign-in button): identity verification and basic profile data for account authentication.

Microsoft Clarity (only after analytics consent): heatmaps and session-level interaction analytics used to improve the public website. Sensitive content is masked and advertising storage remains disabled.

Telnyx (USA/global telecommunications network): phone numbers, call routing, and SMS verification for optional callbacks.

Rackhost Zrt. (Hungary): business email hosting and delivery for messages sent from the apexchatbot.com domain.

Each processor is bound by a data processing agreement. Transfers outside the EEA rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

Retention

Account and conversation data is kept while your account is active and deleted within 30 days after account deletion. Consent-based first-party analytics is retained for up to 13 months. Public demo activity and demo callback security and delivery logs are retained for up to 90 days. Nonresponsive business-prospect records are retained for up to 12 months after the final contact, while minimal suppression records are kept as long as reasonably necessary to prevent repeat marketing. Billing records are kept as long as Hungarian accounting law requires (8 years).

Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing. An objection to direct marketing is honored without requiring you to give a reason. Write to adam@apexchatbot.com. You may also lodge a complaint with the Hungarian supervisory authority (NAIH, naih.hu).

If your visitors exercise their rights regarding conversation data, we assist you as your processor for that data.

Cookies

We use essential cookies for login sessions. Optional first-party analytics starts only if you accept analytics in the cookie banner. You can change your choice at any time; opting out clears the local analytics session.