Privacy Policy

Effective from January 1, 2026. Last updated: October 2026.

1. Introduction

Gábor Jurgovszki, sole proprietor (hereinafter: Data Controller) operates the SaaS service available under the autocontent.hu domain. The Data Controller is committed to the protection of users' personal data and processes such data under the following terms, with particular regard to Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR) and applicable Hungarian regulations (in particular Act CXII of 2011, the Hungarian Information Act).

2. What data do we process?

2.4 Search Console connection

If you authorise the Search Console connection in the Service (section 3/C of the Terms of Service), Autocontent's Google service account adds itself as a verified owner, with full owner rights, to the URL-prefix Search Console property of your website, and reads the website's search data from there for the SEO report. For verification, our WordPress plugin places a verification code on your website: a META tag in the page header and a verification file at the website's root address. The connection is free of charge. A website's search data are mostly not personal data. They may contain personal data if a search query or a page title contains the name of a natural person, or if the website relates to a private individual or a sole proprietor. Google does not release rare search queries in the first place, to protect searchers' privacy.

What data do we process?

• the record of the authorisation: your account ID, your e-mail address and name as they stood at the time of the authorisation, the time of the authorisation (in UTC), your IP address and browser identifier (user agent), the version and checksum (SHA-256) of the authorisation text, the version of the Terms of Service in force at that time, the address of our service account, and the sub-account, WordPress connection and Search Console property the authorisation relates to. At the same moment, with the same timestamp, we also record your acceptance of the Terms of Service;
• the connection data: which account, sub-account and WordPress connection the connection belongs to, the address of the Search Console property, the status of the connection, the verification code (only while the connection is active), the verification method, the main timestamps (authorisation, verification, checks, interruption, removal, revocation), the reason the connection ended and, in case of an error, a short reason;
• the website's search data: from Hungarian web searches on Google (excluding image, video and news search), the number of clicks and impressions, the click-through rate and the average position, per search query and per page, for a completed 28-day period. We keep Google's response in memory only while processing it; we store permanently only the figures that belong to the SEO report's keywords and pages (clicks, impressions, click-through rate, average position), the queried period, the number of rows received and the address of the property, as part of the report;
• the queries from Search Console: the frequent search queries for which your website already appears are added to the report's keywords and marked separately in the report;
• the result of the URL inspection, if the report requests it: the indexing status of the page and the data Google adds to it (for example the time of the last crawl and the canonical address chosen by Google);
• the e-mail addresses of the property's owners: some of Google's responses contain them. We do not store, log or use them;
• the events of the connection (for example the authorisation, the revocation and the interruption) in the activity log, with the website's address, and the outcome of the calls to Google (the service called, success, and a short reason in case of an error) in the provider log, without the content of the responses.

On your website, the plugin stores the verification code and the status of the connection in the WordPress database; deleting the plugin deletes them too.

If there was no Search Console property for the exact address when the connection was set up, our addition creates it, and Google typically collects data only from around the day of the addition: it provides no data for earlier periods. If the property already existed, the earlier data kept by Google are also available; the report uses only the latest completed 28-day period of them.

Purpose: preparing the SEO report with your website's real search data, including the AI-written parts of the report and the keywords suggested from Search Console; setting up, monitoring and ending the connection; proving who authorised access, when, for which website, and when it ended.

Legal basis: the Search Console connection is a service provided at your request, so the processing needed to operate it, including the transfer of the queries and figures from Search Console to AI providers and of the queries to DataForSEO, is necessary for the performance of the contract (Article 6(1)(b) GDPR). We also ask for your express permission for the transfer, because Google's API terms require it; without permission the connection is not set up. Recording and keeping the authorisation, logging, and processing any data of other persons contained in the search data are based on our legitimate interest (Article 6(1)(f) GDPR): this is how we can prove that we obtained access at the request of an authorised person, and how the requested report can be prepared. The owners' e-mail addresses contained in Google's response are likewise processed on the basis of legitimate interest, only temporarily and without storage.

Retention:

• the record of the authorisation: for 5 years from the end of the connection (the general limitation period for civil-law claims, Section 6:22 of the Hungarian Civil Code), also after account deletion; if legal or official proceedings start within this period, until they are finally closed;
• the acceptance of the Terms of Service recorded at the authorisation: for 5 years from the end of the contract (the deletion of your account), but at least as long as we keep the record of the authorisation;
• the connection data: for no longer than 5 years from the closing of the connection; if you later give a new authorisation for the same WordPress connection, the connection data are overwritten with the new ones;
• the verification code: deleted when the connection ends;
• the Search Console figures stored in the report: deleted when the connection ends (on revocation, and also when the WordPress connection, the sub-account or the account is deleted), and the text and PDF version of the report are prepared again without the figures. The keywords added from Search Console remain in the reports already prepared, without their figures, together with the report;
• activity log entries are kept for 180 days, provider log entries for 400 days.

Kept after account deletion. If you delete your account, the sub-account or the WordPress connection, we first revoke the Search Console connection. The record of the authorisation and the connection data are then kept until the end of the retention period, because otherwise it could not be proven who authorised access and when. We do not modify the recorded authorisation afterwards. An erasure request does not extend to these data (Article 17(3)(e) GDPR).

Who has access? The Data Controller and your account. To prepare the report, we transfer the queries and figures from Search Console to these AI providers, as data processors: primarily to Google LLC (Gemini), as a fallback to OpenRouter, which forwards the request to Google's Gemini model, and as a last fallback to OpenAI (section 3.2). We do not transfer them to any other AI provider: if a report step used another AI provider, the Search Console data are left out of it. We do not transfer the Search Console figures to search data providers. We send the text of the Search Console queries added to the report's keywords (without the figures) to DataForSEO to measure their position, search volume and difficulty (section 3.4); not to any other search data provider, not even to ScrapingBee. If the report's live Google measurement runs on ScrapingBee, the report shows the position of these queries from the Search Console data only. The Search Console and Site Verification services are provided by Google LLC as an independent controller: we receive the search data from Google, and Google receives the website's address and our service account's requests (section 3.9). The other owners of the property see our service account among the owners in Search Console; Google notifies them by e-mail of our addition, and our removal is visible in the ownership history. If you move a topic suggestion of the report to your topics, the topic, including the query in it, becomes your own topic, and the Service handles it like your other topics (for example in article generation, section 3.2). The data are stored on the Service's hosting (section 3.5).

Revocation: you can revoke the connection at any time in the Service with the “Kapcsolat visszavonása” (Revoke connection) button, or in the WordPress admin, in the settings of the Autocontent plugin (Autocontent › Beállítások › Search Console-ellenőrzés), with the “Eltávolítás” (Remove) button. The plugin then removes the verification code, and afterwards we delete our owner entry at Google: usually within minutes when started from the Service, and at the next daily check when started from the WordPress admin. While the code is still reachable on the website (for example on a cached page), Google rejects the deletion; in that case we repeat it. The connection also ends if you delete the WordPress connection, the sub-account or your account, if the website's address changes, if according to Google our service account's verification has ended, or if the connection has been interrupted for 30 days. It also ends if another WordPress connection in the Service verifies the same website; in that case the new connection's verification code stays on the website, and our owner entry remains because of the new connection. If you remove our service account in Search Console (or another owner of the property removes it), the connection usually ends at the next daily check, the plugin removes the code, and you receive a notification in the Service. We do not verify ourselves again: the connection can only be set up again with a new authorisation. Revocation does not affect the lawfulness of earlier processing. The data already transferred to the AI providers and to DataForSEO are handled by these providers under their own retention rules (sections 3.2 and 3.4). Revocation does not affect the Search Console data stored by Google: Google handles them under its own terms, and the other owners of the property continue to see them.

Your rights: you can request access, rectification, erasure, restriction and data portability under section 5. On request, we tell you when and for which website you authorised the connection. You can object to processing based on legitimate interest; in that case we keep the data only if they are necessary for the establishment, exercise or defence of legal claims (Article 21(1) GDPR).

3. Data processors (third parties)

The Data Controller may rely on various technology partners to operate the Service. The specific partner constellation may change continuously during the development, optimisation and quality improvement of the Service. The listed partners process the data transferred to them in accordance with their own privacy policies and access them only to the extent necessary.

3.1 Identity and login providers

• Google LLC (USA): OAuth login (name, e-mail, profile picture). Privacy

3.2 AI language models and content generation providers

For AI operations (article generation, text refinement, embedding, structure analysis, research, translation, image metadata extraction, summarisation, etc.) we may use any of the providers listed below. The specific task and model selection may dynamically vary based on performance, cost and quality considerations; we are not bound to any single provider and may switch to another partner at any time in order to improve the quality of the Service:

• OpenAI (USA)
• Anthropic (USA)
• Google LLC: Gemini (USA)
• Mistral AI (France)
• Meta Platforms: Llama models (USA)
• xAI (USA)
• Cohere (Canada)
• Perplexity AI (USA)
• Groq (USA)
• Together AI (USA)
• DeepSeek (People's Republic of China): only for non-sensitive tasks, with explicit User consent
• Amazon Web Services: Bedrock (USA)
• Microsoft Azure: Azure OpenAI (USA / EU)
• Hugging Face (USA / France)
• Replicate (USA)
• TypeSafe AI, Inc.: JEV decision model, for checking generated content and matching sources (USA)
• OpenRouter (USA): access to AI models as an intermediary; forwards the request to the provider of the selected model

Of the providers above, only Google LLC (Gemini), as a fallback OpenRouter (forwarded to Google's Gemini model) and as a last fallback OpenAI receive the queries and figures from the Search Console connection (section 2.4), as data processors, to prepare the SEO report.

The prompt provided by the User and the response returned by the AI provider are handled in accordance with that provider's own storage and retention policy. The Data Controller endeavours, where possible, to choose partners that do not use user data for their own model training.

3.3 Visual and image providers

• Stock image providers, including Magnific, Freepik, Shutterstock, Adobe Stock, Unsplash, Pexels, etc. (image search queries, metadata of image downloads)
• AI image generation providers, including OpenAI DALL·E, Stability AI, Midjourney, Black Forest Labs Flux, Google Imagen, Ideogram, etc.

3.4 Search and research APIs

• Web search and search data providers, including ScrapingBee, DataForSEO, SerpAPI, Bing Search API, Brave Search API, Google Programmable Search, ScraperAPI, etc. Data forwarded: for topic research, the search queries; for index checks, the submitted URL and the page title; for the SEO analysis, the website's domain and the analysed keywords. The text of the queries from Search Console is received only by DataForSEO, without the Search Console figures (section 2.4).

3.5 Hosting, CDN and infrastructure providers

• Cloud hosting and object storage, including Cloudflare R2, Amazon S3, Google Cloud Storage, Microsoft Azure Blob, Backblaze B2, etc.
• CDN and edge providers, including Cloudflare, AWS CloudFront, Fastly, etc.
• Application hosting partners (EU or Hungarian servers): running the Service

3.6 E-mail and notification providers

• SMTP and transactional e-mail providers, including own SMTP server, Postmark, AWS SES, SendGrid, Resend, Mailgun, etc. (registration confirmation, password reminder, 2FA codes)

3.7 Payment and invoicing providers

• Stripe Payments Europe Ltd. (Ireland): card payments and saving the card (independent controller for card data).
• KBOSS.hu Kft. (szamlazz.hu, Hungary): issuing and delivering invoices.

3.8 Web analytics and ad measurement (only with consent)

• Google Analytics 4 (Google Ireland Ltd.) and Microsoft Clarity (Microsoft Ireland Operations Ltd.): visitor measurement. Details in section 4.
• Google Ads (Google Ireland Ltd.): measuring the performance of our ads. Details in section 4.3.

3.9 Search Console (only with an authorised Search Console connection)

• Google LLC (USA): Google Search Console API and Google Site Verification API. For the Search Console connection (section 2.4), Google is an independent controller: we receive the website's search data from Google, and Google receives the website's address and our service account's requests. Google's API terms of use (Google APIs Terms of Service) govern the relationship between Google and us. Privacy

The above lists are indicative; the partner constellation actually used by the Service may change during the development cycle. The User may at any time request up-to-date information at info@autocontent.hu regarding which partners specifically process their data.

4. Cookies and web analytics

On autocontent.hu and blog.autocontent.hu we use three kinds of cookies: those necessary for operation and, if you agree, statistics and ad measurement cookies. With the Settings button of the cookie banner you can accept or reject the two consent categories separately. Your cookie choice applies to both sites, and you can change it at any time with the Cookie settings link at the bottom of the page.

4.1 Cookies necessary for operation

The Service does not work without these, so no consent is required for them (Section 155 (4) of Hungarian Act C of 2003 on Electronic Communications).

• autocontent_session: managing the logged-in session, for up to 8 hours.
• XSRF-TOKEN: protection against cross-site request forgery (CSRF).
• ac_consent: stores your cookie choice so that we do not ask on every page. It contains only the choice (per category), its time, the version of this notice and a random identifier. It is valid for 6 months, after which we ask again.

4.2 Statistics cookies (only with consent)

We only turn these on if you click Accept all in the cookie banner, or turn on the Statistics category under Settings. Until then, no measurement script is loaded. Their purpose is to measure where visitors come from, which pages and articles they read, and how many visitors sign up. We do not use the data for ad personalisation, and we do not link it to your account data.

• Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), on the public pages of autocontent.hu and on blog.autocontent.hu. Cookies: _ga and _ga_…, for 13 months. Google does not log or store the IP address of visitors from the EU: it uses it only to derive an approximate location (country, city) and then discards it immediately. We keep the measurement data for 14 months. Advertising features (Google Signals, ad personalisation) are turned off. If you arrive by clicking one of our Google ads, Google Analytics also records the click identifier in the address (gclid), so we can see which ad brought a visit or an order. We only set advertising cookies with your ad measurement consent (section 4.3).
• Microsoft Clarity (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), on the public pages of autocontent.hu and on blog.autocontent.hu (in two separate projects). It does not run in the logged-in area (account, article editor). It creates heatmaps and session replays: it records clicks, scrolling and mouse movement, with text typed into input fields masked. Cookies: _clck, _clsk and, on Microsoft's own domains, CLID, MUID, MR, SM and ANONCHK. Recordings are kept for 30 days, heatmaps for 9 months. Clarity also passes the identifier of the session recording to Google Analytics, so the data of the two measurements can be linked.

4.3 Ad measurement cookies (only with consent)

We only turn these on if you click Accept all in the cookie banner, or turn on the Ad measurement category under Settings. Their purpose is to measure which of the visitors who click our Google Ads ads request a quote or sign up, so we can see which ad performs well. We do not use remarketing or ad personalisation, and we also signal this as refused to Google.

• Google Ads conversion measurement (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), through Google Analytics 4, on the public pages of autocontent.hu and on blog.autocontent.hu. Cookies: _gcl_au and, if you arrive by clicking a Google ad, _gcl_aw, for 90 days. Google Analytics passes the measured conversions (for example a quote request) to our Google Ads account.

Legal basis: your consent (Article 6 (1) (a) GDPR), per category. You can withdraw it at any time with the Cookie settings link; we then delete the cookies of that category from your browser. Withdrawal does not affect the lawfulness of processing before it.

Google LLC and Microsoft Corporation are certified participants of the EU–U.S. Data Privacy Framework, so any transfer to the United States is based on the European Commission's adequacy decision of 10 July 2023.

We do not use remarketing or ad personalisation cookies (such as the Facebook Pixel).

5. Rights of the data subject (Articles 15–22 GDPR)

The User (data subject) has the following rights:

• Right of access: may request information on the data we process about them
• Right to rectification: correction of inaccurate data
• Right to erasure ("right to be forgotten"): upon account deletion, personal data are deleted within 30 days. Exceptions: where the Hungarian Accounting Act requires 8-year retention, and the activity log, which we retain under GDPR Article 17(3)(e) for the establishment, exercise or defence of payment claims, for up to 180 days. Besides the account identifier, this log holds the e-mail address and name as they stood at the time of the event. A further exception is the record of the authorisation of a Search Console connection and the connection data, which we retain under GDPR Article 17(3)(e) for no longer than 5 years from the end of the connection (section 2.4).
• Right to restriction: in certain cases, processing may be suspended upon request
• Right to data portability: data may be requested in a machine-readable format
• Right to object: to processing based on legitimate interest

Rights can be exercised at info@autocontent.hu. The Data Controller will respond to the request within 30 days.

6. Data security

The Data Controller applies the following technical and organisational measures:

• HTTPS encryption for all data traffic
• Passwords hashed using bcrypt (never stored in plain text)
• External API keys protected with envelope encryption (AES-256-GCM)
• Two-factor authentication (2FA) support
• Regular security audits and software updates
• Organised backup and recovery plan

7. Data transfers to third countries

Some data processors (Google, AI providers) are based outside the European Economic Area. Data transfers take place under appropriate safeguards as set out in Article 46 GDPR (Standard Contractual Clauses, SCC). Google LLC, acting as an independent controller for the Search Console connection (section 3.9), is a certified participant of the EU–U.S. Data Privacy Framework; the adequacy decision described in section 4 applies to the data transferred to it.

8. Automated decision-making

The Service includes AI-based content generation features. These features generate content in response to User requests, but they do not make automated decisions concerning the rights or legal status of the User.

9. Right to lodge a complaint (NAIH)

If the User considers that the processing of personal data violates the law, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:

10. Modification of this notice

The Data Controller reserves the right to modify this Privacy Policy. Users will be notified of changes by e-mail or through an in-Service notification. Changes take effect 15 days after notification.

11. Contact

For any questions related to data protection, please contact us: