MacoLabs · Legal information
Privacy Policy
What we collect, why we need it and how you can control your information.
Last updated:
Who is responsible for your data?
- Legal name
- Varga István Bertalan, a sole proprietor registered in Hungary, operating as MacoLabs.
- Registered and postal address
- 1078 Budapest, District VII, Murányi utca 38., ground floor, door 9, Hungary.
- Tax number
- 67025086-1-42
- Registration number
- 42530889
- Register and chamber
- Hungarian Register of Sole Proprietors; registered member of the Budapest Chamber of Commerce and Industry.
How processing works
This policy covers the MacoLabs website, inquiries, newsletter and private AI coaching. Separately operated products linked from this site have their own notices. We obtain information primarily from you and through your use of the website and our correspondence.
Accepting the terms and this policy is not blanket consent to all processing. Inquiries and contracts have their own legal bases. Newsletters and analytics have separate voluntary choices; declining them does not prevent an application. AI processing can take place only in separately explained and authorised cases.
Information, purposes and legal bases
- Inquiries and project briefs
- Name, email and any company, website, collaboration type, project type, budget, timing and message you provide. Purpose: responding, understanding your requirements and preparing an offer. Basis: steps at your request before a contract, GDPR Article 6(1)(b); for business representatives, our legitimate interest in business correspondence, Article 6(1)(f).
- Coaching applications
- Name, email, age group, usage context, selected topics, AI experience, optional details and follow-up answers; submission and declaration dates and versions, and application status. Purpose: personal review of suitability and preparation of an offer. Basis: GDPR Article 6(1)(b). Age group helps tailor the service designed for people over 60; we do not request an exact date of birth.
- Contracts and client portal
- Contact and billing details, offers, contracts, payment status, correspondence, learning materials and documents shared for the service. Basis: contract performance, GDPR Article 6(1)(b), and legal obligations for tax records, Article 6(1)(c). Recording or AI processing requires separate authorisation; applying does not automatically authorise recording later sessions.
- Newsletters
- Name, email, language, signup location and date. Purpose: sending MacoLabs guides and news. Basis: voluntary consent, GDPR Article 6(1)(a). Public and coaching newsletter subscriptions are separate. You can unsubscribe at any time by emailing maco@macolabs.dev; coaching emails also provide an unsubscribe link.
- Operation, security and legal claims
- Technical request data, IP address and browser information, access and error information, identifiers preventing duplicate submissions and abuse, and records needed for disputes. Basis: legitimate interests in secure operation and defending legal claims, GDPR Article 6(1)(f). Mandatory consumer complaint handling is based on Article 6(1)(c).
AI processing
New applications submitted through the short form are reviewed personally by Maco. Submission alone does not start an AI conversation or trigger an AI-assisted internal assessment.
After submitting, you can voluntarily start an AI conversation of up to three questions. By selecting the start button, you consent to the OpenAI API using your selected topics, goals, AI experience, stated tools, additional details and conversation answers to personalise follow-up questions. We do not send the separate name, email or age-group fields for this purpose; free text may still contain personal data. We record the consent date and notice version. Basis: GDPR Article 6(1)(a). You can finish the conversation at any time; your application is complete without it. This does not authorise automatic scoring, pricing recommendations or internal suitability assessment.
For older applications started with separate consent, the OpenAI API may produce an internal summary and recommendation from the answers; it may also help structure free-text answers in the older conversational flow. Shared answers may contain personal data. The legal basis for previously authorised internal assessment is consent under GDPR Article 6(1)(a); age is excluded from potential scoring. AI does not independently decide admission, pricing or contracts; Maco reviews these personally.
Withdraw previously given consent at any time by emailing maco@macolabs.dev. This does not affect earlier lawful processing; we stop further optional AI assessment, and you can request deletion of results kept solely for that purpose. AI processing during coaching is explained and authorised separately; accepting the application terms does not automatically authorise it.
How long do we keep information?
- Applications that do not become client engagements
- Normally 12 months from the start of the application, after which application content is due for deletion or anonymisation. You can request earlier deletion. If a contract follows, necessary information becomes part of the contractual client record.
- Inquiries and correspondence
- Until discussions close, then subject to review of the need for further contact or handling claims. Unneeded inquiries that did not lead to a contract must be deleted. Records demonstrably needed for legal claims may be kept until the applicable limitation period ends, generally 5 years for civil claims.
- Contracts and invoices
- As needed for performance and then until relevant legal claims expire. A sole proprietor’s tax records must be kept at least until the right to assess tax expires, generally 5 years from the end of the year in which the relevant return is due, subject to statutory extensions.
- Portal and learning materials
- Until the access and retention period agreed for the engagement ends. The default portal access period is 12 months; individual files may expire separately. This does not automatically extend retention for other purposes.
- Newsletters and optional AI results
- Until consent is withdrawn or the purpose ends; AI results are retained no longer than the underlying application. Minimal evidence of a declaration may be retained as necessary to defend legal claims.
- Complaints and technical records
- Written consumer complaints and responses are retained for 3 years. Short-term application abuse-prevention entries last 2 hours. Other security and provider logs are retained as needed to investigate errors or incidents and keep the service secure; records relevant to an ongoing dispute may be preserved until it is resolved.
Who can receive information?
Information is handled by Varga István Bertalan and providers needed for the relevant task. We do not sell personal data. Authorities or legal advisers may receive data when legally required or necessary for a legal matter. Necessary billing information may also be shared with an appointed invoicing or accounting provider; the billing process is agreed when contracting.
- Cloudflare Workers
- Website and server endpoint hosting, technical request information and form data passing through the service.
- Hostinger
- Database hosting and SMTP email delivery; application, client and correspondence information.
- Cloudflare R2
- Private storage of documents, recordings and learning materials uploaded for the service.
- OpenAI
- Authorised AI processing through the API; text or learning material supplied for the relevant task.
- Google Analytics / YouTube
- Google Analytics only after analytics consent; YouTube only when you separately load a video. Technical device, network and usage information. Google’s own processing policies also apply.
International processing and safeguards
International providers may process information outside the European Economic Area, including in the United States; we do not claim all data stays in Hungary. Such transfers require a basis and safeguards under GDPR Chapter V, such as an applicable adequacy decision or Standard Contractual Clauses with supplementary measures where needed. Provider processing terms are linked above; email us for details and a copy of safeguards relevant to a transfer.
Access is restricted by permissions. The portal uses private access and files use time-limited access links. Do not share your sign-in or application continuation links. We aim to limit information to what the service needs; only share other people’s information when entitled to do so.
Your rights
Email maco@macolabs.dev to request access and a copy, correction, deletion or restriction. Data portability may apply to automated processing based on consent or contract. You may object to legitimate-interest processing for reasons relating to your situation and to direct marketing at any time. You may withdraw consent at any time without affecting earlier lawful processing.
Without required fields we cannot process the relevant application or inquiry; optional information is not required. Deletion is not absolute: records required by law or necessary for legal claims may be exempt. We explain any applicable exception.
We normally respond within one month. Complex requests may require up to two additional months; we explain an extension within the first month. Where necessary we verify identity proportionately. Requests are normally free of charge.