Privacy Policy

Who we are

Apex Chatbot is operated by Tokár Ádám EV (sole proprietor), registered at 5700 Gyula, Szőlős utca 4/1, Hungary. Registration number: 62232744. Tax number: 92003747-1-24. Contact: adam@apexchatbot.com. We are the data controller for the personal data described below.

What data we process

Account data: your name, email address, business name, website URL, phone number, and the knowledge base text you provide during onboarding.

Optional social sign-in: if you deliberately continue with Google, GitHub or Apple, we receive the basic account identifier, email address, name and avatar made available by that provider. Apple may provide a private relay email and does not provide the full name in the web OAuth flow. We request only the account data needed to authenticate you; we do not use the provider token to access your files, repositories, contacts or other services.

Chatbot conversations: messages exchanged between your website visitors and your chatbot, including any contact details (email, phone) a visitor chooses to share.

Billing data: your Stripe customer ID and subscription status. Card numbers are processed by Stripe and never reach our servers.

Website content: the public pages of the website URL you provide, which we periodically read so your chatbot can answer with current information.

Optional first-party analytics: after analytics consent, we record the page visited, first landing page, referrer domain and path, UTM campaign parameters, session ID, country and region supplied by our hosting provider, and coarse device/browser category. We do not store a raw IP address or create a fingerprint for this analytics.

Optional product tips and offers: only after you explicitly enable this separate preference in your account. We store the account email, current preference, preference source, and the timestamps needed to honor it. You can turn it off in Billing or by the one-click unsubscribe link in a promotional email; account, security, billing, and setup messages are separate.

Active demo usage: when you deliberately start a public chatbot, support, browser voice, or verified callback demo, we record the demo type, current and first landing page, random session ID, referrer host, campaign parameters, country and region supplied by our hosting provider, coarse device/browser category, response language, and whether the demo started, completed, or failed. For text chat and support demos, we also retain the conversation text so the operator can review answer quality and understand the requested help. If analytics consent exists, the demo can be linked to that consented page journey and named funnel actions. We do not store a raw IP address, create a browser fingerprint, or infer an unobserved reason for leaving.

Voice demos: browser audio is processed by Vapi to provide the live demo and is not recorded by Apex. For an optional phone callback, Telnyx verifies ownership with an SMS code; we store the verified number, request IP address, requested page, campaign source and call outcome to provide the requested call and prevent abuse.

Business outreach and Apex Lead Rescue

For narrowly targeted business outreach, we may use a business name, public business email address, website, location, public phone number, publicly stated owner or manager name and role, source URL and date, relevance note, and contact, reply, delivery, objection and suppression status.

The source is the business's official public website or another official public business listing. We use the data to assess relevance, make a transparent one-to-one business approach, answer requests, and prevent repeated contact.

Our proposed legal basis is our legitimate interest in relevant business development under GDPR Article 6(1)(f), subject to every separately applicable electronic-marketing rule. You may object to direct marketing at any time by replying to the message or writing to adam@apexchatbot.com. We stop marketing to the objecting address and retain only the minimum suppression record needed to prevent repeat contact.

Nonresponsive prospect records and source evidence are retained for no more than 12 months after the final contact. Delivery evidence and suppression records may be retained longer where reasonably necessary to honor an objection, demonstrate compliance, or handle a legal claim.

Apex Lead Rescue is a business-only 30-day pilot. Any salon enquiry data used in the pilot must be minimized and represented by salon-created pseudonymous IDs. The salon remains the controller and Apex Chatbot acts only on documented instructions as processor. The pilot creates an internal priority queue and owner-reviewed reply drafts. It does not send salon-client messages or make legal or similarly significant decisions automatically.

Why we process it (legal basis)

To provide the service you signed up for (contract performance, GDPR Art. 6(1)(b)).

To send transactional emails such as welcome emails and lead notifications (contract performance).

To send optional product tips and offers only after your explicit opt-in; you may withdraw this preference at any time without affecting the service.

To improve reliability and prevent abuse, including rate limiting (legitimate interest, Art. 6(1)(f)).

Processors we use

OpenAI (USA): generates chatbot replies. Conversation text is sent to OpenAI for processing.

Supabase (EU, Frankfurt): database and authentication hosting.

Vercel (EU edge/US): application hosting.

Stripe (EU/USA): payments and subscription management.

Resend (USA): email delivery, including private operational demo notifications to the operator that may contain the visitor's questions and the chatbot's answers. Email copies are stored separately from the 90-day demo database and are not removed by its automatic cleanup; contact us to request deletion of those copies.

Telnyx (USA/EU): SMS phone ownership verification and telephone connectivity for requested demo calls.

Vapi (USA): real-time browser and telephone voice-agent orchestration for voice demos.

Soniox (USA or configured EU processing region): real-time speech recognition for the Voice product.

Google and GitHub (only when you choose their sign-in button): identity verification and basic profile data for account authentication.

Microsoft Clarity (only after analytics consent): heatmaps and session-level interaction analytics used to improve the public website. Sensitive content is masked and advertising storage remains disabled.

Telnyx (USA/global telecommunications network): phone numbers, call routing, and SMS verification for optional callbacks.

Rackhost Zrt. (Hungary): business email hosting and delivery for messages sent from the apexchatbot.com domain.

Processor use and international-transfer safeguards depend on the exact service configuration and provider entity. For Apex Lead Rescue, we verify and document the applicable processing terms, region, and transfer mechanism before any salon-customer data is processed; an unverified provider is excluded from that pilot workflow.

Retention

Account and conversation data is kept while your account is active and deleted within 30 days after account deletion. Consent-based first-party analytics is retained for up to 13 months. Public demo activity and demo callback security and delivery logs are retained for up to 90 days. Promotional preference and minimal suppression records are kept only as long as reasonably necessary to honor the preference and prevent repeat marketing. Nonresponsive business-prospect records are retained for no more than 12 months after the final contact. Billing records are kept as long as Hungarian accounting law requires (8 years).

Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing. An objection to direct marketing is honored without requiring you to give a reason. Write to adam@apexchatbot.com. You may also lodge a complaint with the Hungarian supervisory authority (NAIH, naih.hu).

If your visitors exercise their rights regarding conversation data, we assist you as your processor for that data.

Cookies

We use essential cookies for login sessions. Optional first-party analytics starts only if you accept analytics in the cookie banner. You can change your choice at any time; opting out clears the local analytics session.