1. Controller
Tokár Ádám, sole trader (5700 Gyula, Szőlős utca 4/1., Hungary, tax number: 92003747-1-24, email: hello@irodaai.hu), "I" or "the service provider" below. For any data protection question, write to this address.
2. Enquiries, demo calls and callbacks
Data: name, the firm's name and size, email address and/or phone number, the chosen time, the content of your message. Purpose: answering your request, arranging the demo call, making an offer. Legal basis: your consent (GDPR Article 6(1)(a)) and steps taken at your request before entering into a contract (GDPR Article 6(1)(b)). Retention: 1 year from the last contact, or until you withdraw your consent.
3. The country waitlist
Data: name, email address, the firm's name, the country you chose and, if you give it, the number of client companies. Purpose: one personal email from me when IrodAI is close to going live in your country, and asking how your firm works so the first version fits it. There is no newsletter and no automatic mailing list. Legal basis: your consent (GDPR Article 6(1)(a)). Retention: until your country goes live and I have written to you, at most 2 years, or until you withdraw your consent. To be removed, write to hello@irodaai.hu.
4. The website chat
The chat is a digital assistant that answers questions about IrodAI. For accounting and tax questions it gives general information, which is not tax advice.
Data: the text of the conversation, the name and content of attached files, and anything you choose to give (name, firm, contact details). Purpose: answering your questions, recording an enquiry and passing it on to me. Legal basis: consent (GDPR Article 6(1)(a)). Retention: the conversation for 30 days, enquiry data as in point 2. Please do not type or attach real client data in the chat.
The read-aloud button turns the reply into speech. Dictation uses your browser's own speech recognition, which the browser's maker provides; the microphone only switches on when you start it.
5. The invoice check demo
Data: the uploaded invoice image or PDF and the fields read from it, and a one-way hash of your IP address used to count the daily limit. Purpose: producing the demo result and preventing misuse. Legal basis: consent (GDPR Article 6(1)(a)); for counting the limit, my legitimate interest (GDPR Article 6(1)(f)). Retention: I do not store the file: it is only in memory while it is being read, and it goes to the AI provider that reads it with a request that is not stored. The daily counter only holds the hash and a count and is not linked to the file. Files up to 8 MB can be uploaded. Please do not upload a real client's invoice.
6. Cookies and local storage
This website uses only storage that is strictly necessary for it to work: the chat keeps a session identifier in your browser, and the site remembers that you dismissed the storage notice. No analytics, marketing or tracking cookies are used. Fonts are loaded from this website's own server.
7. Data of the subscribing firms' clients
For the data of the client companies of subscribing accounting firms (invoices, supporting documents, NAV data, correspondence), the client company is the controller, the firm is the processor, and I am the firm's sub-processor. I act only on the firm's instructions, under a written data processing agreement with the firm (GDPR Article 28). I do not train models on client data. I use encrypted transfer and storage, role-based access and logging.
8. Processors
- Hosting and server functions: Netlify, Inc. (512 2nd Street, Suite 200, San Francisco, CA 94107, USA)
- Text processing in the chat and reading invoices: OpenAI Ireland Ltd. (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland)
- Read-aloud (text to speech): Eleven Labs Inc. (United States)
- Sending email notifications: Resend (Plus Five Five, Inc., United States)
- Text message notifications to me: Telnyx LLC (United States)
- Booking calendar: Supabase, Inc. (United States; data in an EU data centre)
For processors outside the European Economic Area, transfers rely on the standard contractual clauses adopted by the European Commission (GDPR Article 46) or, where the processor is certified, on the EU-US Data Privacy Framework.
9. Your rights
You can ask for access to your personal data, its correction or deletion, restriction of processing, and data portability, and you can object to processing. You can withdraw your consent at any time; this does not affect processing before the withdrawal. Send your request to hello@irodaai.hu; I reply within 1 month at the latest.
You can complain to the Hungarian data protection authority, Nemzeti Adatvédelmi és Információszabadság Hatóság (1055 Budapest, Falk Miksa utca 9-11., Hungary, naih.hu), to the data protection authority of the EU country where you live or work, or go to court.
10. Security
I transfer data over encrypted connections, limit access to what each task needs, and log access. In case of a personal data breach I act under GDPR Articles 33 and 34.
Effective from 14 October 2026.