Privacy policy
This is an English translation provided for information. In case of any discrepancy, the Hungarian version prevails.
This policy explains what personal data we process when providing the Estamotion service, for what purposes and for how long, and what rights you have. Processing is carried out under the EU General Data Protection Regulation (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information.
1. Controller
- Name: Boros Márk, sole proprietor (egyéni vállalkozó)
- Registered address: 1112 Budapest, Gazdagréti út 20., ground floor, door 1, Hungary
- Tax number: 92083361-1-43
- Email: hello@estamotion.hu
We are not required to appoint a data protection officer.
2. What data we process and why
2.1. Enquiries and quotes
Data: name, email address, company name, content of your message.
Purpose: answering questions, sending quotes.
Legal basis: steps prior to entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in replying to messages (Art. 6(1)(f)).
Retention: 1 year from the last contact if no contract is concluded.
2.2. Fulfilling orders
Data: name, email address, phone number (if provided), company name, order details, and the photos and other materials you upload.
Purpose: creating, delivering and amending the video, and communication.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Retention: uploaded photos and materials are deleted within 30 days of delivery of the video. The finished video is stored for 90 days after delivery so it can be downloaded again, and then deleted. In both cases, data is kept longer if needed for a change request, a dispute or an infringement notice, until it is resolved. Order details (without the photos and the video) are kept for 5 years after the contract ends (Section 6:22 of the Hungarian Civil Code) to handle any claims (GDPR Art. 6(1)(f)).
Providing the data is a condition of concluding the contract; without it the order cannot be fulfilled.
Where uploaded materials contain personal data of other people (for example identifiable persons), the customer is the controller of that data and we act as processor (see Section 14 of the Terms). The customer is responsible for supplying such data to us lawfully.
2.3. Application account
Data: email address, name, password in encrypted form, login times, orders linked to the account.
Purpose: operating the account and managing orders.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Retention: until the account is deleted; data related to orders is governed by Sections 2.2 and 2.4.
2.4. Invoicing
Data: name or company name, billing address, tax number, amount paid and performance details.
Purpose: issuing invoices and meeting bookkeeping obligations.
Legal basis: legal obligation (GDPR Art. 6(1)(c); Sections 169 and 179 of the Hungarian VAT Act (Act CXXVII of 2007), Sections 78(3) and 202 of Act CL of 2017 on the Rules of Taxation, and Section 169(2) of Act C of 2000 on Accounting).
Retention: at least 8 years.
2.5. Payment
For card payments, card details are processed by the payment provider; we have no access to them. We only see the fact, amount and reference of the payment.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
2.6. Videos shown as references
We show finished videos as references on our website, on social media and in our offers only if the customer has expressly agreed to this.
Legal basis: our legitimate interest in presenting our service (GDPR Art. 6(1)(f)), based on the customer's agreement.
Retention: until the agreement is withdrawn or an objection is made, which can be sent to hello@estamotion.hu; we will then remove the reference within 3 business days.
2.7. Business outreach
We may introduce our service to businesses (for example real estate agencies and accommodation providers) by email. Without prior consent we send such emails only to a business's general business address (for example info@…), never to an address containing a natural person's name.
Data: the publicly available business contact details of the business (company name, general business email address).
Source: the business's own website, public company registers and listing portals.
Legal basis: our legitimate interest in contacting business partners (GDPR Art. 6(1)(f)).
Retention: until objection, but no longer than 1 year from the last contact. Every email explains how to object; after an objection we will not contact you again.
2.8. Use of the website
The website does not use analytics or advertising cookies. Session data needed for login and ordering, and the technically necessary fraud-prevention cookies of the Stripe payment page, are used as strictly necessary tools to provide the service; these do not require consent under the law. Your language choice is stored in your browser's local storage (localStorage) so the site opens in the same language next time; this contains no personal data. The hosting provider may record technical log data (such as IP address, time and browser type) to keep the website secure. Fonts are loaded from Google Fonts, so your browser connects to Google's servers.
2.9. Declarations made when ordering
Data: text of the declarations, time of acceptance, version of the Terms, user ID and IP address.
Purpose: proving that the customer made the required declarations.
Legal basis: our legitimate interest (GDPR Art. 6(1)(f)).
Retention: 5 years after the contract ends.
2.10. Complaints and infringement notices
Data: name and contact details of the complainant or reporter, content of the complaint or notice, and our reply.
Legal basis: for complaints, legal obligation (GDPR Art. 6(1)(c); Section 17/A of Hungarian Act CLV of 1997 on Consumer Protection); for infringement notices, our legitimate interest (Art. 6(1)(f)).
Retention: 3 years for complaints; 5 years after the case is closed for notices.
No automated decision-making or profiling takes place.
3. Who can access the data (processors)
We do not sell data, and we share it only to the extent necessary to provide the service, with the following processors:
- Base44 (Wix.com Ltd.) – hosting the application and database
- Cloudflare, Inc. (USA) – domain management, email forwarding, website delivery
- Google LLC (USA) – email account (Gmail), fonts
- Features & Labels, Inc. (fal.ai) (USA) – AI video generation from uploaded photos
- ElevenLabs – AI voice-over (only if the order includes a voice-over) [verify the contracting entity]
- Amazon Web Services – video assembly (rendering) [verify the contracting entity and region]
- Stripe Payments Europe Ltd. (Ireland) – card payments
- KBOSS.hu Kft. (Számlázz.hu) – invoicing
We do not use uploaded photos to train our own AI models. AI providers process the photos solely to create the video and do not use them for model training. [TO BE VERIFIED: under the terms of fal.ai and the models it uses (e.g. Kling); if photos reach a model running in China, this must be stated here]
Some processors handle data outside the European Economic Area. Transfers to the United States are based on certification under the EU–US Data Privacy Framework or on standard data protection clauses adopted by the European Commission (GDPR Art. 46(2)(c)); a copy can be requested at hello@estamotion.hu. For Israel, an adequacy decision of the European Commission applies.
4. Data security
We keep data in password-protected accounts, transfer it over encrypted connections, and give access only to those who need it to provide the service.
5. Your rights
You can at any time ask us at hello@estamotion.hu for:
- information about the data we hold about you (access);
- correction of inaccurate data;
- erasure of your data where it is no longer needed or processed without a legal basis;
- restriction of processing;
- a copy of the data you provided in a machine-readable format (portability);
- and you may object to processing based on legitimate interest.
We will respond within one month. The balancing tests for processing based on legitimate interest are available on request.
If you believe we have breached your data protection rights, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., phone: +36 1 391 1400, email: ugyfelszolgalat@naih.hu, naih.hu, or with the supervisory authority of the EU member state of your habitual residence or place of work, or bring proceedings before a court, including the regional court (törvényszék) of your place of residence.
6. Changes to this policy
We may update this policy; the current version is always available on this page.