Privacy Notice
Effective from: September 1, 2026. This English version is provided for convenience; the Hungarian original governs in case of any discrepancy.
Registered / correspondence address: 1148 Budapest, Nagy Lajos király útja 32-34. III/1., Hungary
Hungarian tax number: 46128737-1-41
Sole trader registration number: 58369546
E-mail (also for privacy inquiries): varga.fabian.gyorgy@gmail.com
1. Principles, legal basis
The Data Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") and Hungarian Act CXII of 2011 on the right of informational self-determination and freedom of information ("Infotv."). The Data Controller processes personal data lawfully, fairly, for specified purposes, to the minimum extent and for the minimum period necessary for those purposes, and with appropriate security measures.
2. Data processed, purpose, legal ground, retention
2.1. Anonymous (non-registered) use
| Data | Purpose | Legal ground | Retention |
|---|---|---|---|
| A random identifier stored in the browser (cookie) with its associated lookup counter; the User's IP address | Enforcing the free, non-registered lookup allowance (5 lookups); abuse/overload protection (e.g. too many login attempts from one IP) | Legitimate interest (operating the Service properly, free of abuse) | The cookie lives for up to 1 year; IP-based protection counters expire within minutes |
| The origin/destination place names and vehicle parameters entered (used only to serve the lookup, not stored tied to an account on the server) | Producing the route-cost estimate | Pre-contractual step / legitimate interest | Only for as long as needed to serve the request, not retained |
2.2. Registration, account
| Data | Purpose | Legal ground | Retention |
|---|---|---|---|
| E-mail address, password (stored only as a salted, one-way, non-reversible hash) | Creating and identifying the account, login, password reset | Performance of contract (Terms of Service) | For the life of the account, or until the User requests deletion |
| Vehicle profile (consumption, fuel price, vehicle category, optionally separate motorway/local-road consumption, wear-cost rate) | A more precise, personalised cost estimate | Performance of contract / consent | For the life of the account, or until deletion |
| Saved vignettes, favourite routes, past searches, route decisions and any feedback attached to them | Providing the Service's features (favourites, quick recalculation, "how much you've saved" summary) | Performance of contract | For the life of the account, or until deletion |
| Gamification data (XP, credit balance, unlocked badges, streak, optional leaderboard participation) | Running the Service's motivational/game-like elements | Performance of contract / consent (leaderboard opt-in) | For the life of the account, or until deletion |
| Referral code and the resulting link between the referring and referred accounts | Running the referral programme, crediting the reward | Performance of contract | For the life of the account |
| B2B pricing profile (business address, fee schedule, if set up by the User) | Providing the optional quote-calculator feature | Consent (opting into the feature) | For the life of the account, or until the User deletes the setting |
| Telegram chat identifier (only if the User chooses to link their account to the Telegram bot) | Delivering the password-reset link and optional notifications (e.g. an expiring vignette) | Consent | Until the link is removed |
2.3. Payment
The User enters their card details directly on the hosted payment page of Barion Payment Zrt. (an independent data controller in its own right) — the Data Controller never receives, sees, or stores this data. From Barion's confirmation, the Data Controller records only the transaction ID, its status, and the purchased credit package, for the purpose of crediting the credits and complying with bookkeeping obligations (legal ground: performance of contract, and legal obligation — accounting-law record retention of 8 years).
2.4. Feedback, bug reports
If the User sends a message through the built-in "Feedback" feature, the Data Controller processes the message text and (for a logged-in User) their e-mail address, for the purpose of investigating and responding to the report, on the ground of legitimate interest, until the investigation is closed or, where the report led to a fix, until that fix is documented.
3. Cookies
The Service uses only the following strictly necessary cookies — under the applicable rules (the e-commerce act, GDPR) these do not require separate consent, as they are essential for the Service to function as intended:
| Cookie name | Purpose | Lifetime |
|---|---|---|
session_token | Maintaining the logged-in state | 30 days |
anon_id | Tracking the non-registered lookup allowance (5 lookups) | up to 1 year |
Both cookies contain only a technical identifier (no readable personal data), are set as "httpOnly" and secure — they cannot be read from JavaScript and are transmitted only over an encrypted (HTTPS) connection. The Service does not use advertising or third-party tracking cookies.
4. Processors, data transfers
| Processor / recipient | Role |
|---|---|
| Hetzner Online GmbH (Germany) | Hosting/server services — data is stored within the European Union (Germany); no transfer to a third country takes place. |
| Barion Payment Zrt. | Processing payment transactions — for the data supplied for payment, Barion is an independent data controller acting under its own privacy notice. |
| Telegram Messenger Inc. | Only for Users who choose to link their account to the Telegram bot — for delivering a password-reset link and optional notifications. |
Beyond the above, the Data Controller does not disclose personal data to third parties, does not sell it, and does not use it for profiling for purposes outside the Service (e.g. advertising).
5. Data security
The Data Controller applies appropriate technical and organisational measures to secure personal data, in particular: passwords are stored only as salted, one-way (non-reversible) hashes; the Service is accessible only over an encrypted (HTTPS) connection; login attempts are rate-limited to protect against unauthorised access (e.g. password guessing).
6. Data subject rights
Under the GDPR, the User may exercise the following rights regarding their personal data by sending a request to varga.fabian.gyorgy@gmail.com:
- Right of access — to obtain information about which personal data the Data Controller processes;
- Right to rectification — to request correction of inaccurate data (the vehicle profile, favourites, etc. can also be edited/corrected by the User directly under "My data" in the Service);
- Right to erasure ("right to be forgotten") — to request deletion of the account and the associated personal data, also available as a self-service "Delete account" action under "My data" in the Service, where there is no further legal ground for processing them;
- Right to restriction of processing;
- Right to data portability — to request the data provided in a machine-readable format;
- Right to object to processing based on legitimate interest;
- Right to withdraw consent — for consent-based processing (e.g. leaderboard participation, Telegram linking) at any time, without giving reasons, either in the Service's interface or at the e-mail address above.
The Data Controller will fulfil or respond to requests without undue delay, and in any event within 1 month.
7. Remedies
If the User's rights are infringed, they are entitled to:
- lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (postal address: 1363 Budapest, Pf. 9., Hungary; address: 1055 Budapest, Falk Miksa utca 9-11., Hungary; e-mail: ugyfelszolgalat@naih.hu; website: naih.hu);
- bring proceedings before a court in the event of an infringement of their rights — at the User's choice, before the competent regional court (törvényszék) of either their place of residence or habitual residence.
8. Changes to this notice
The Data Controller reserves the right to amend this notice, in particular in the event of a change in law or an expansion of the Service's features. The current version is always available on this page; in the event of a material change, registered Users will also be informed by e-mail.