Privacy Notice
Effective from: October 9, 2026. This English version is provided for convenience; the Hungarian original governs in case of any discrepancy.
Registered / correspondence address: 1148 Budapest, Nagy Lajos király útja 32-34. III/1., Hungary
Hungarian tax number: 46128737-1-41
Sole trader registration number: 58369546
E-mail (also for privacy inquiries): varga.fabian.gyorgy@gmail.com
1. Principles, legal basis
The Data Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") and Hungarian Act CXII of 2011 on the right of informational self-determination and freedom of information ("Infotv."). The Data Controller processes personal data lawfully, fairly, for specified purposes, to the minimum extent and for the minimum period necessary for those purposes, and with appropriate security measures.
2. Data processed, purpose, legal ground, retention
2.1. Anonymous (non-registered) use
| Data | Purpose | Legal ground | Retention |
|---|---|---|---|
| A random identifier stored in the browser (cookie) with its associated lookup counter; the User's IP address | Enforcing the free, non-registered lookup allowance (30 lookups); abuse/overload protection (e.g. too many login attempts from one IP) | Legitimate interest (operating the Service properly, free of abuse) | The cookie lives for up to 1 year; IP-based protection counters expire within minutes |
| The origin/destination place names and vehicle parameters entered (used only to serve the lookup, not stored tied to an account on the server) | Producing the route-cost estimate | Pre-contractual step / legitimate interest | Only for as long as needed to serve the request, not retained |
| The geographic location provided by the browser — only if the User says yes to the browser's permission prompt | Ordering address suggestions by proximity; when the "My current location" option is chosen, determining the starting point of the route | Consent (the answer given to the browser's permission prompt; it can be withdrawn at any time in the browser settings) | Only for as long as needed to serve the request, not retained; only the "My current location" label is saved to the search history, not the location |
Own (first-party), aggregated usage measurement: an irreversible shortened hash of the identifier in the cookie above, the event type (page view, first successful calculation, opening Google Maps, opening the official vignette purchase site, registration), the parameters of the link that brought the visitor (e.g. utm_source), the path of the landing page (e.g. /utmutatok/waze-matrica-en, without query parameters), the kind of the referring site (search engine, social site or other — not its address), the browser language and type. No IP address, referring-page address, place name, route, e-mail address, referral-code value or advertising click-identifier value is recorded. |
Finding out which channels (e.g. a community post, an advertisement) bring visitors who actually use the Service; improving the Service. Not passed on to any third party. | Legitimate interest (measuring how the Service works and how effective marketing is) | 90 days, then deleted automatically |
2.2. Registration, account
| Data | Purpose | Legal ground | Retention |
|---|---|---|---|
| E-mail address, password (stored only as a salted, one-way, non-reversible hash) | Creating and identifying the account, login, password reset | Performance of contract (Terms of Service) | For the life of the account, or until the User requests deletion |
| Vehicle profile (consumption, fuel price, vehicle category, optionally separate motorway/local-road consumption, wear-cost rate) | A more precise, personalised cost estimate | Performance of contract / consent | For the life of the account, or until deletion |
| Saved vignettes, favourite routes, past searches, route decisions and any feedback attached to them | Providing the Service's features (favourites, quick recalculation, "how much you've saved" summary) | Performance of contract | For the life of the account, or until deletion |
| Gamification data (XP, credit balance, unlocked badges, streak, optional leaderboard participation) | Running the Service's motivational/game-like elements | Performance of contract / consent (leaderboard opt-in) | For the life of the account, or until deletion |
| Referral code and the resulting link between the referring and referred accounts | Running the referral programme, crediting the reward | Performance of contract | For the life of the account |
| B2B pricing profile (business address, fee schedule, if set up by the User) | Providing the optional quote-calculator feature | Consent (opting into the feature) | For the life of the account, or until the User deletes the setting |
| Telegram chat identifier (only if the User chooses to link their account to the Telegram bot) | Delivering the password-reset link and optional notifications (e.g. an expiring vignette) | Consent | Until the link is removed |
2.3. Payment
The User enters their card details directly on the hosted payment page of SimplePay Zrt. — the Data Controller never receives, sees, or stores this data. The e-mail address, billing name and billing address the User enters to start a payment are transferred to SimplePay Zrt. as data processor (SimplePay processes this data on our behalf and under our instructions in this respect, not as an independent controller — see SimplePay's own privacy notice: simplepay.hu/adatkezelesi-tajekoztatok). From SimplePay's confirmation, the Data Controller records only the transaction ID, its status, and the purchased credit package, for the purpose of crediting the credits and complying with bookkeeping obligations (legal ground: performance of contract, and legal obligation — accounting-law record retention of 8 years).
2.4. Feedback, bug reports
If the User sends a message through the built-in "Feedback" feature, the Data Controller processes the message text and (for a logged-in User) their e-mail address, for the purpose of investigating and responding to the report, on the ground of legitimate interest, until the investigation is closed or, where the report led to a fix, until that fix is documented.
3. Cookies
The Service uses only the following strictly necessary cookies — under the applicable rules (the e-commerce act, GDPR) these do not require separate consent, as they are essential for the Service to function as intended:
| Cookie name | Purpose | Lifetime |
|---|---|---|
session_token | Maintaining the logged-in state | 30 days |
anon_id | Tracking the non-registered lookup allowance (30 lookups) | up to 1 year |
Both cookies contain only a technical identifier (no readable personal data), are set as "httpOnly" and secure — they cannot be read from JavaScript and are transmitted only over an encrypted (HTTPS) connection.
Beyond the above, only with the User's explicit consent (given by choosing "Accept" in the cookie-consent bar shown at the bottom of the homepage), the Service may also place advertising-measurement cookies, to measure which advertisement led to an actual user. Their legal basis is consent under GDPR Article 6(1)(a) — not the "strictly necessary" exemption above — and consent can be withdrawn at any time, without restriction, via the "Cookie settings" button in the footer, which reopens the choice.
| Cookie / provider | Purpose | Lifetime |
|---|---|---|
Meta Pixel (_fbp etc., Meta Platforms Ireland Ltd.) | Measuring the effectiveness of Instagram/Facebook ads | up to 3 months (per Meta's own notice) |
Google Ads (_gcl_au etc., Google Ireland Ltd.) | Measuring the effectiveness of Google Ads ads | up to 90 days (per Google's own notice) |
If the User declines or does not give consent, these cookies are NOT placed — every feature of the Service, including payment, remains fully available without consent.
4. Processors, data transfers
| Processor / recipient | Role |
|---|---|
| Hetzner Online GmbH (Germany) | Hosting/server services — data is stored within the European Union (Germany); no transfer to a third country takes place. |
| SimplePay Zrt. | Processing payment transactions — acts as a data processor on our behalf for the e-mail address, billing name and address (see "Payment" section above); for card data, SimplePay's own privacy notice applies. |
| Telegram Messenger Inc. | Only for Users who choose to link their account to the Telegram bot — for delivering a password-reset link and optional notifications. |
| Meta Platforms Ireland Ltd. | Only for Users who have consented in the cookie-consent bar (see "Cookies" above) — for the data transferred to it, Meta is an independent data controller acting under its own privacy notice (facebook.com/privacy/policy). |
| Google Ireland Ltd. | Only for Users who have consented in the cookie-consent bar (see "Cookies" above) — for the data transferred to it, Google is an independent data controller acting under its own privacy notice (policies.google.com/privacy). |
Beyond the above, the Data Controller does not disclose personal data to third parties, and does not sell it. Profiling for advertising purposes (see "Cookies" above) can only take place with the User's explicit consent, within Meta's/Google's own independent processing — without consent, the Service carries out no such activity.
5. Data security
The Data Controller applies appropriate technical and organisational measures to secure personal data, in particular: passwords are stored only as salted, one-way (non-reversible) hashes; the Service is accessible only over an encrypted (HTTPS) connection; login attempts are rate-limited to protect against unauthorised access (e.g. password guessing).
6. Data subject rights
Under the GDPR, the User may exercise the following rights regarding their personal data by sending a request to varga.fabian.gyorgy@gmail.com:
- Right of access — to obtain information about which personal data the Data Controller processes;
- Right to rectification — to request correction of inaccurate data (the vehicle profile, favourites, etc. can also be edited/corrected by the User directly under "My data" in the Service);
- Right to erasure ("right to be forgotten") — to request deletion of the account and the associated personal data, also available as a self-service "Delete account" action under "My data" in the Service, where there is no further legal ground for processing them;
- Right to restriction of processing;
- Right to data portability — to request the data provided in a machine-readable format;
- Right to object to processing based on legitimate interest;
- Right to withdraw consent — for consent-based processing (e.g. leaderboard participation, Telegram linking) at any time, without giving reasons, either in the Service's interface or at the e-mail address above.
The Data Controller will fulfil or respond to requests without undue delay, and in any event within 1 month.
7. Remedies
If the User's rights are infringed, they are entitled to:
- lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (postal address: 1363 Budapest, Pf. 9., Hungary; address: 1055 Budapest, Falk Miksa utca 9-11., Hungary; e-mail: ugyfelszolgalat@naih.hu; website: naih.hu);
- bring proceedings before a court in the event of an infringement of their rights — at the User's choice, before the competent regional court (törvényszék) of either their place of residence or habitual residence.
8. Changes to this notice
The Data Controller reserves the right to amend this notice, in particular in the event of a change in law or an expansion of the Service's features. The current version is always available on this page; in the event of a material change, registered Users will also be informed by e-mail.