What happens to what you type.

Who is responsible for your data

The controller of your data is István Orbán. For questions about your data, you can reach me at: istvan@orban.studio.

Workshop: the conversation and the brief

• Your browser saves the Workshop conversation and the project brief (localStorage). I cannot see this. The ‘New brief’ button deletes the conversation, the brief and the estimate. Clearing your browser data does the same. If you sent the brief through the contact form or the ‘Send it to István’ button, I keep a copy in the email. The ‘New brief’ button does not delete that.
• For every message, my server processes the conversation and the brief. In live AI mode, the server passes it to the provider of the language model, OpenAI (United States), which writes the reply. By default, OpenAI does not use data sent through its developer interface (API) to train its models. In my requests I switch off separate storage of the replies, so the conversation does not appear in your OpenAI account's interface. Abuse-monitoring logs still run. By default, the provider keeps these logs for up to 30 days. In exceptional cases, where the law or security requires it, they may be kept longer. The data goes to the United States. The transfer is covered by the standard data protection clauses adopted by the European Commission (GDPR Article 46(2)(c)). OpenAI has committed to follow these clauses. You can find the details in OpenAI's data handling policy: developers.openai.com: data handling (opens in a new window).
• My server does not store or log the conversation. If an error happens, the error log records the type of error, not your text.
• I do not ask for your name, email address or phone number in the conversation. Please do not type in a password, an access key (an API key, for example) or a bank card number. If the filter finds an access key or a bank card number, the request does not go on to the AI provider. If it finds text that looks like a password, it replaces only that part with ‘[password hidden]’. The rest of the message goes on to the AI provider. Only the hidden version is saved in the conversation in your browser, even when a request fails or is interrupted.
• I prepare the brief and the estimate at your request, to get a contract ready (GDPR Article 6(1)(b)). I count requests to protect the site from overload, and I log the type of error. My legal basis for this is my legitimate interest in running the site (Article 6(1)(f)).
• You can dictate only in live mode. Recording starts when you press the microphone button. OpenAI's transcription service (in the United States) turns your voice into text. The provider may keep it for up to 30 days to catch abuse, in the same way as an AI conversation. I do not store or log the recording on my server. The transcribed text goes into the message box, and you decide whether to send it. One recording can be 60 seconds at most. Your browser asks for separate permission to use the microphone. You can withdraw that permission in your browser at any time.
• You can send an image only in live mode, and only if you attach it yourself. Before sending, your browser makes a smaller copy of it. This copy leaves out the file's hidden data, such as where it was taken and details of the device. The AI provider receives only the images attached to the latest message, not earlier ones. I do not store the image on my server. Your browser keeps only a small preview image with the conversation. The ‘New brief’ button deletes that too. If you tick it separately in the ‘Send it to István’ window, the images you sent in the conversation are also attached to the email to me (see Contact form and email below). Please do not attach an image that shows a password, an access key or another person's details.

Contact form and email

• Your name, email address, message and (if you tick it) your brief reach my inbox through an email service, Resend. My server does not store them. Resend is a US company. It sends the emails from the European Union, from its data centre in Ireland, but it handles account data and delivery logs in the United States. According to Resend's public information, it keeps the details of sent emails and the delivery logs for 30 days, and backups for 7 days. Data that goes to the United States is covered by the standard data protection clauses adopted by the European Commission (GDPR Article 46(2)(c)), which the provider has committed to follow. The emails have no open or click tracking.
• With the Workshop's ‘Send it to István’ button, you send only the details shown in the preview. These are your name, your email address, the brief and the estimate. If you give them, your phone number, your message and the times when I can call you are included too. Your own messages from the conversation go only if you tick that separately. I ask for a phone number only to call you back, and I use it only for that. Resend passes the email to my inbox from the EU (Ireland). My server does not store it, and no AI is used for this. The ‘Send me a copy’ box is ticked by default. If you leave it ticked, you receive one confirmation email at the address you provided. Resend sends this email too, and the same retention periods apply. It contains a short summary of the brief and the estimate, without your message, the conversation or your phone number. At most two such emails go to one address in 24 hours. If you tick it separately, the images you sent in the conversation are attached to the email to me. Resend keeps them with the email for 30 days, and I keep them with the correspondence for up to one year after the enquiry is closed.
• If you write from your own email account, the message comes straight to my inbox, without Resend.
• I use your details only to reply and to deal with your enquiry. You do not go on any list, and I do not send newsletters. I keep the correspondence for up to one year after the enquiry is closed, then I delete it.
• Legal basis: answering your enquiry, or preparing a contract (GDPR Article 6(1)(b)).

Cookies, analytics, technical data

• The site uses ‘io-lang’ to remember your preferred language, Hungarian or English. If your browser is not set to Hungarian, you start on the English site. You can change the language at any time. If you choose a currency, ‘io-currency’ remembers that choice too. Both cookies expire after one year. They store only these preferences, and I do not use them for tracking. I use no other cookies or visitor analytics. Your choice of light or dark theme stays only in your browser.
• To protect against overload, the server counts requests per IP address, only in memory, in a ten-minute window. It does not write them to a log. The server deletes expired entries when it handles a later request. If no new request arrives, the entries may stay in memory until the server process ends. They are always deleted on a restart. For the confirmation email requested in the Workshop, the server counts emails per IP address in a one-hour window. Instead of your email address it keeps a one-way fingerprint of it (SHA-256) for up to 24 hours, in memory only, so that no more than two such emails go to one address a day. To catch double sends, it keeps a fingerprint of the request for 10 minutes.
• The server fetches the European Central Bank's public euro exchange rate (frankfurter.dev). It passes no data about you while doing so.
• The hosting provider (Railway) may log the IP address, the time of the request and the page requested, to run the service. The site runs on Railway. These logs do not contain the text of your messages, and, depending on the Railway plan, they are kept for 30 days at most.
• I handle this technical data so that the site runs securely. My legal basis is my legitimate interest in running the site securely (GDPR Article 6(1)(f)).

Your rights

You can ask me to tell you what data I hold about you. You can ask me to correct or delete it, or to restrict how I use it. You can object to processing that is based on legitimate interest. You can also ask for the data you gave me in a machine-readable format. This is called data portability. Write to the address above. I will reply without undue delay, and within one month at the latest. If you think I have not handled your data properly, you can go to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu) or to a court.

Last updated: 7 October 2026. If what I handle or how I handle it changes, I will update this page.