Privacy Policy
This Policy explains what personal data Apture Studio processes when you visit www.apture.studio, contact us or work with us, why and on what legal basis we do so, how long we keep it, who receives it and what rights you have. It is based on Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
1. Data controller
- Service provider: Morvai Máté, sole proprietor (trading as Apture Studio)
- Registered office: 9061 Vámosszabadi, Szabadi utca 7., Hungary
- Tax number: 58070222-1-28
- Registration number: 56698413 (register of sole proprietors)
- Representative: Morvai Máté
- E-mail: hello@apture.studio
- Phone: +36 20 397 5977
- Website: www.apture.studio
No data protection officer has been appointed because Article 37 GDPR does not require one.
2. Enquiries and contact form
| Data | name, e-mail address, optional phone number, optional company and website, your message, selected services or estimate, language and time of submission |
|---|---|
| Purpose | responding to your enquiry, preparing an offer and keeping in contact about it |
| Legal basis | Article 6(1)(b) GDPR – steps taken at your request before entering into a contract; for business contact data, Article 6(1)(f) – our legitimate interest in answering business enquiries |
| Retention | until the enquiry is closed, but no longer than two years; if a contract is concluded, under Section 4 |
We send an automatic confirmation to the e-mail address you provide and an internal notification to our own inbox.
3. Mira chat assistant
The chat assistant on this website is Mira, a product operated by the same controller. When you use it, your messages, a conversation identifier and the selected language are processed so that the assistant can answer. Messages are sent to an AI model provider to generate the response (see Section 7). Chat content is not stored persistently; contact details you choose to share in the chat are handled as an enquiry under Section 2.
Legal basis: Article 6(1)(f) GDPR – our legitimate interest in answering visitor questions; Article 6(1)(b) for contact details you provide to request an offer. Please do not share special-category data such as health information in the chat. Further technical details are available in the Mira privacy policy at www.bookwithmira.com/privacy.
4. Clients and contracts
| Data | contact person's name, e-mail address, phone number, billing details, project communication and deliverables |
|---|---|
| Purpose | performing the contract, invoicing and handling claims |
| Legal basis | Article 6(1)(b) GDPR – performance of a contract; Article 6(1)(c) – legal obligation for accounting documents |
| Retention | for five years after the contract ends (general limitation period of the Hungarian Civil Code); accounting documents for eight years under Section 169 of Act C of 2000 on Accounting |
5. Analytics and marketing (only with your consent)
If you accept analytics cookies, we use Google Analytics 4 (Google Ireland Limited) to understand how visitors use the site: pages viewed, clicks, approximate location, device and browser data and a pseudonymous identifier. If you accept marketing cookies, we use the Meta Pixel (Meta Platforms Ireland Limited) and Google advertising signals to measure the results of our advertising.
Legal basis: Article 6(1)(a) GDPR – your consent. No analytics or marketing script is loaded before you consent. You can withdraw your consent at any time under “Cookie settings” in the footer; withdrawal does not affect the lawfulness of processing before it. Google Analytics data is retained for up to 14 months.
6. Cookieless measurement and server logs
We use Vercel Web Analytics and Vercel Speed Insights to measure page views and loading performance. These tools do not use cookies and report only aggregated data that does not identify individual visitors.
Our hosting provider records technical data (IP address, time of request, requested URL, browser type) to operate the website securely and prevent abuse. Legal basis: Article 6(1)(f) GDPR – our legitimate interest in the security and reliability of the website. Logs are kept according to the hosting provider's rotation schedule, generally for no longer than 30 days.
7. Cookies and local storage
| Name | Type and purpose | Lifetime |
|---|---|---|
| apture-consent (localStorage) | essential – stores your cookie choice | until deleted |
| apture-theme (localStorage) | functional – remembers light or dark theme | until deleted |
| Mira chat (sessionStorage) | functional – keeps the chat conversation within one visit | until the browser tab closes |
| _ga, _ga_<ID> | analytics – Google Analytics 4, only with consent | 2 years |
| _fbp | marketing – Meta Pixel, only with consent | 3 months |
8. Processors and recipients
| Recipient | Service | Location and safeguards |
|---|---|---|
| Vercel Inc. (USA) | hosting, cookieless analytics, AI gateway for the chat assistant | EU–US Data Privacy Framework or Standard Contractual Clauses |
| Proton AG (Switzerland) | e-mail hosting for hello@apture.studio and notifications | Switzerland, covered by an EU adequacy decision |
| OpenAI, L.L.C. (USA) | AI model generating chat responses | Standard Contractual Clauses |
| Neon Inc. and Upstash Inc. (USA) | database and rate limiting for the chat assistant | EU (Frankfurt) data location; EU–US Data Privacy Framework or Standard Contractual Clauses |
| Google Ireland Limited | Google Analytics 4 and advertising signals (with consent) | EU; transfers to Google LLC under the EU–US Data Privacy Framework |
| Meta Platforms Ireland Limited | Meta Pixel (with consent) | EU; transfers to Meta Platforms, Inc. under the EU–US Data Privacy Framework |
| Accountant and invoicing provider | invoicing and accounting obligations | Hungary |
Data may be disclosed to a competent authority or court where the law requires it.
9. Transfers outside the EEA
Some recipients operate in the United States. These transfers are protected by certification under the EU–US Data Privacy Framework or, where not available, by the European Commission's Standard Contractual Clauses and any necessary supplementary measures.
10. Security
- all traffic uses encrypted HTTPS/TLS connections;
- strict security headers, including a Content Security Policy, protect the website;
- contact forms and the chat assistant are rate limited to prevent abuse;
- access to enquiries and client data is limited to the people who need it.
11. Automated decision-making
Chat responses are generated automatically, but no decision producing legal or similarly significant effects is made about you, and no profiling within the meaning of Article 22 GDPR takes place. We do not use your data to train AI models.
12. Your rights
- Access (Article 15 GDPR): find out what personal data we process about you.
- Rectification (Article 16): have inaccurate data corrected.
- Erasure (Article 17): request deletion where there is no further legal basis.
- Restriction (Article 18): request that processing be restricted.
- Data portability (Article 20): receive data processed on the basis of contract or consent in a machine-readable format.
- Objection (Article 21): object to processing based on legitimate interests.
- Withdrawal of consent (Article 7): at any time, without affecting earlier processing.
Send your request to hello@apture.studio. We respond within one month, which may be extended by up to two further months where necessary.
13. Complaints and remedies
Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 (1) 391-1400; e-mail: ugyfelszolgalat@naih.hu; website: naih.hu.
You may also bring proceedings before the court competent for your place of residence or stay.
14. Changes
We may update this Policy. The current version is always available on this page, with its effective date.