Legal
Privacy Policy
Last updated:
AI Squad (operated by Hess & Partners Kft.) is committed to protecting your personal data. This notice sets out what we collect, why, on what legal basis, and how you can exercise your data protection rights.
This is an English translation for convenience. In case of any discrepancy, the Hungarian version of this document governs. Read the Hungarian version →
1. The controller
| Controller | Hess & Partners Kft. |
|---|---|
| Registered office | Pécs, Hungary |
| hello@aisquad.hu | |
| Website | https://aisquad.hu |
| Activity | Building and operating voice AI agents |
2. What we process, and why
2.1 Getting in touch (contact form, email)
- Data: name, email address, phone number (optional), the content of the message
- Purpose: answering the enquiry and sending a quote
- Legal basis: consent (GDPR Article 6(1)(a)) and/or the controller's legitimate interest (point (f))
- Retention: 2 years from the close of the enquiry, unless a contract is concluded
2.2 Booking a slot (Google Calendar)
- Data: name, email address, the agreed time
- Purpose: arranging a consultation or a demo
- Legal basis: consent (GDPR Article 6(1)(a))
- Processor: Google LLC (Google Calendar)
- Retention: 6 months from the end of the event
2.3 AI voice agent calls (on a client's instruction)
- Data: audio recording, automatically generated transcript, call time, the caller's phone number
- Purpose: providing the voice AI agent service ordered by the client
- Legal basis: performance of a contract (GDPR Article 6(1)(b)) and/or the instruction of the client acting as controller
- Processors: ElevenLabs Inc. (speech synthesis), Telnyx LLC (telephony), Supabase Inc. (database, EU — Frankfurt)
- Retention: as set out in the client contract; 90 days by default
2.4 Cookies and analytics on the website
- Data: IP address, browser data, page view data (aggregated)
- Purpose: keeping the site working, and visitor statistics
- Legal basis: legitimate interest (point (f)) for necessary cookies; consent (point (a)) for analytics cookies
- Google Tag Manager (GTM-W4K2R32D): tag management — only active tags process data
- Retention: session cookies until the browser closes; analytics cookies for 12 months
2.5 Publishing content on social media (LinkedIn, Facebook, Instagram, YouTube)
AI Squad publishes marketing and informational content (blog posts, company updates, case studies, video) on its own social media profiles: László Sabján's personal LinkedIn profile, the AI Squad company LinkedIn page, the Facebook page, the Instagram Business profile, and the YouTube channel. Publishing is partly automated, through the platforms' APIs.
- Data: the published content (text, image, video), the time of publication, platform identifiers (post ID, video ID), and the API access tokens belonging to AI Squad's own accounts (access token, refresh token)
- Purpose: automated publishing of company communications on our own channels, content scheduling, performance measurement
- Legal basis: the controller's legitimate interest (GDPR Article 6(1)(f)) — business communication
- Third-party data: published content may include images, names, or accounts of AI Squad staff or — with explicit consent — of clients (references, testimonials). In such cases AI Squad acts on the prior written consent of the person concerned.
- APIs used: LinkedIn Marketing Developer Platform (Community Management API, w_member_social and w_organization_social scopes), Meta Graph API (Pages + Instagram Business), YouTube Data API v3, YouTube Analytics API
- Retention: API tokens until the service ends or the token is revoked; published content under each platform's own terms
2.6 Social media lead generation (Meta Lead Ads, LinkedIn Lead Gen Forms)
- Data: whatever the person enters in the lead form (name, email address, phone number, company name, job title, free-text message)
- Purpose: handling the enquiry, sending a quote, getting in touch
- Legal basis: consent (GDPR Article 6(1)(a)) — given by submitting the lead form
- How it is processed: lead data from LinkedIn or Meta is transferred automatically into AI Squad's internal systems (Supabase database, HubSpot CRM, Notion) for processing
- Retention: 2 years from the close of the enquiry, unless a contract is concluded
2.8 B2B cold email outreach (Saleshandy)
AI Squad may send personalized emails to corporate decision-makers and potential clients for B2B sales purposes. These are not consumer advertising messages — they are business-context approaches tied specifically to the recipient's professional role.
- Data: name, business email address, job title, company name, industry, the history of the exchange (messages sent, open and click events), segment category
- Purpose: introducing our B2B service to decision-makers, opening contact, making an offer
- Legal basis: the controller's legitimate interest (GDPR Article 6(1)(f)) — under Section 6(4) of Act XLVIII of 2008 on the basic conditions of commercial advertising, a recipient may be approached in their professional role for a business purpose
- Sources: publicly available business databases (LinkedIn, company registries); no purchased lists
- Opting out: every email includes an unsubscribe option; on request we remove the recipient immediately and add them to a do-not-contact list
- Processors: IKIGAI INFOTECH LLP (Saleshandy) — India; and HubSpot CRM as the storage system
- Retention: until unsubscribe or the end of business activity (max. 2 years without activity)
2.7 WhatsApp Business communication
AI Squad may use the WhatsApp Business API for customer service and marketing — both for handling incoming messages (answered by an AI voice or chat agent) and for outgoing notifications (template-based updates, confirmations, reminders).
- Data: the other party's phone number, the content of the message (text, media), timestamp, conversation context
- Purpose: customer support, automated responses, updates, booking confirmations, reminders
- Legal basis: performance of a contract (GDPR Article 6(1)(b)), and consent (point (a)) for outgoing communication
- Processor: Meta Platforms Inc. (operating the WhatsApp Business API)
- Retention: as set out in the client contract; 90 days by default
3. Processors and third parties
AI & speech processing
| Processor | Activity | Privacy notice |
|---|---|---|
| LiveKit Inc. | Real-time voice AI platform — agent sessions, the STT-LLM-TTS pipeline, audio transport | livekit.io/privacy |
| ElevenLabs Inc. | AI speech synthesis (TTS) and transcription (Scribe Realtime STT) | elevenlabs.io/privacy |
| Anthropic PBC | LLM reasoning (Claude models) | anthropic.com/privacy |
| OpenAI LLC | LLM reasoning (GPT models) | openai.com/policies/privacy-policy |
| Google LLC | LLM reasoning (Gemini models), Google Cloud AI services, STT | policies.google.com/privacy |
| Microsoft Corporation / Azure | Speech recognition (STT), Azure AI Services | privacy.microsoft.com |
| Deepgram, Inc. | Speech recognition (real-time audio transcription) | deepgram.com/privacy |
| Gladia SAS | Speech recognition (Hungarian language support) — established in France (EU) | gladia.io/privacy-notice |
| AssemblyAI Inc. | Speech recognition (STT) | assemblyai.com/legal/privacy-policy |
Telephony & messaging
| Processor | Activity | Privacy notice |
|---|---|---|
| Telnyx LLC | SIP telephony, phone number management, SMS | telnyx.com/privacy-policy |
| VCC Live | Telephony provider, contact center infrastructure | vcc.live/privacy-policy |
| DIDWW Ireland Limited | DID (phone number) provider, international numbering — established in Dublin, Ireland (EU) | didww.com/privacy-notice |
| Twilio Inc. | SMS and backup telephony | twilio.com/en-us/legal/privacy |
| Resend Inc. | Transactional email delivery | resend.com/legal/privacy-policy |
| Google LLC | Google Calendar, Google Tag Manager, Google Analytics | policies.google.com/privacy |
Social media & marketing platforms
AI Squad uses the platforms below as its own publishing channels (posts, video, campaigns) and/or as lead capture channels. Sections 2.5, 2.6 and 2.7 describe the processing in detail.
| Processor | Activity | Privacy notice |
|---|---|---|
| LinkedIn Corporation (Microsoft) | Publishing on a personal profile and a company page, LinkedIn Lead Gen Forms, LinkedIn Marketing Developer Platform (Community Management API) | linkedin.com/legal/privacy-policy |
| Meta Platforms Inc. — Facebook | Publishing on a Facebook page (Pages API), Meta Lead Ads | facebook.com/privacy/policy |
| Meta Platforms Inc. — Instagram | Publishing on an Instagram Business profile (Instagram Graph API) | privacycenter.instagram.com/policy |
| Meta Platforms Inc. — WhatsApp | WhatsApp Business API — inbound and outbound customer communication (details in section 2.7) | whatsapp.com/legal/privacy-policy |
| Google LLC — YouTube | Video publishing (YouTube Data API v3), performance measurement (YouTube Analytics API), embedded video | policies.google.com/privacy |
| Google LLC — Google Ads | Advertising campaigns, conversion tracking, and remarketing. Google Analytics (GA4) and the Google Ads account are linked — GA4 conversions are imported into Google Ads for optimization, and GA4 audiences supply the remarketing lists. | policies.google.com/privacy |
On these platforms AI Squad manages only its own publishing accounts. The personal data of visitors (followers, prospects) is governed by each platform's own privacy policy — AI Squad only accesses it as the aggregate statistics the platform provides, and, where someone submits a lead form, as the data they entered voluntarily.
Business partners on joint projects
On larger, jointly delivered projects AI Squad works with a standing partner network: 1337 Partners (enterprise AI projects), VCC Live (contact center platform), IP Telekom (telephony, SIP, PBX) and Hello Agency (agency campaigns). Personal data is passed to a partner only to the extent needed to deliver that particular joint project, on a contractual basis (under a data processing or joint controller agreement). The controller roles for each engagement are set out in the client contract.
Hosting & infrastructure
| Processor | Activity | Privacy notice |
|---|---|---|
| Supabase Inc. | Database, authentication, Edge Functions (backend processing), file storage — EU infrastructure (Frankfurt, Germany) | supabase.com/privacy |
| Cloudflare Inc. | CDN, edge hosting, DDoS protection | cloudflare.com/privacypolicy |
| Hetzner Online GmbH | VPS hosting (EU — Germany / Finland) | hetzner.com/legal/privacy-policy |
| Vercel Inc. | Web frontend hosting | vercel.com/legal/privacy-policy |
Website operation
| Processor | Activity | Privacy notice |
|---|---|---|
| EmailJS (EmailJS LLC) | Delivering contact form messages (name, email, phone number, message) | emailjs.com/legal/privacy-policy |
| Google LLC — reCAPTCHA v3 | Protecting forms against automated abuse — risk analysis of visitor interaction signals | policies.google.com/privacy |
| CookieYes Limited | Cookie consent management (consent banner, consent log) | cookieyes.com/privacy-policy |
Business tools — CRM, sales, marketing
| Processor | Activity | Privacy notice |
|---|---|---|
| HubSpot, Inc. | CRM — customer and lead management, contact history, sales pipeline. Controller for EU users: HubSpot Ireland Limited. | legal.hubspot.com/privacy-policy |
| IKIGAI INFOTECH LLP (Saleshandy) | B2B cold email outreach platform — campaigns, sequences, open and click analytics. Established in India. | saleshandy.com/privacy-policy |
| Notion Labs Inc. | Project and internal documentation management, CRM backup | notion.so/privacy |
| Canva Pty Ltd | Visual design tool | canva.com/policies/privacy |
For processors established in the United States, Australia (Canva) and India (IKIGAI INFOTECH LLP / Saleshandy), appropriate safeguards are in place (Standard Contractual Clauses) to make the EU–US, EU–AU and EU–IN transfers lawful. The following are established in the EU, so no transfer to a third country takes place: Gladia SAS (France), DIDWW Ireland Limited (Ireland), Hetzner Online GmbH (Germany), HubSpot Ireland Limited (controller for EU users). We use the Supabase EU region (Frankfurt), so data is stored within the EU.
4. Your rights
Under the GDPR you may exercise the following rights:
- Access (Article 15): you can ask whether we process your data and, if so, what.
- Rectification (Article 16): you can ask us to correct inaccurate data or complete incomplete data.
- Erasure (Article 17): you can ask us to delete your data where the legal basis for processing has ended.
- Restriction (Article 18): in certain cases you can ask us to restrict processing.
- Portability (Article 20): you can ask for the data we hold about you in a machine-readable format.
- Objection (Article 21): you can object to processing based on legitimate interest.
- Withdrawing consent: where processing is based on consent you may withdraw it at any time — this does not affect the lawfulness of processing before the withdrawal.
To exercise your rights, write to hello@aisquad.hu. We reply within 30 days.
5. Complaint to the supervisory authority
If you believe we are processing your data unlawfully, you can complain to NAIH, the Hungarian data protection authority:
| Authority | Hungarian National Authority for Data Protection and Freedom of Information (NAIH) |
|---|---|
| Address | Falk Miksa utca 9-11, 1055 Budapest, Hungary |
| ugyfelszolgalat@naih.hu | |
| Website | naih.hu |
6. Data security
AI Squad applies technical and organizational measures to protect personal data:
- Encrypted transport (HTTPS / TLS 1.3)
- Encryption at rest (AES-256) in the database and in file storage
- Storage within the EU (Supabase Frankfurt region)
- Row-Level Security policies at the database level — per-row access isolation
- Access control and role-based permissions
- Automatic daily backups with point-in-time recovery
- Regular security reviews
- Notification to NAIH within 72 hours in the event of a data breach
7. Changes to this notice
We reserve the right to amend this notice. We will notify those concerned of material changes by email or on the website. An amended notice takes effect from the date shown.
Questions? Write to hello@aisquad.hu