Roles
For scan-form data and accounts, Core Engineering Kft. is the controller. When an agency adds its clients' businesses, the agency is the controller for its clients' data and we act as its processor; a data processing agreement (DPA) with the EU Standard Contractual Clauses is available on request.
Data categories
| Category | Examples | Retention |
|---|---|---|
| Identity & contact | e-mail address | 12 months after last activity |
| Business details | name, city, sector, website, phone, address | 12 months after last scan |
| Scan output | AI answers, mentions, scores, tasks, reports | 12 months after last scan |
| Billing | plan, Stripe customer id, invoices | 8 years (accounting law) |
| Technical | IP address, timestamps, rate-limit counters | up to 30 days |
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure AI Foundry (OpenAI models) | Asking ChatGPT-style questions; extracting names and facts from answers | EU (Sweden Central) |
| Google Gemini API | Asking Gemini questions | Google Ireland / global, SCCs |
| Perplexity API | Asking Perplexity questions | USA, DPF / SCCs |
| EU hosting provider | Servers, database, backups | EU |
| Resend | Transactional e-mail | USA, DPF / SCCs |
| Stripe Payments Europe | Payments, invoices | Ireland |
Only business name, city, sector and the question text are sent to the AI engines. Your e-mail address and account data never leave our systems and Stripe/Resend.
Security measures
- TLS for all traffic; secrets in environment files with restricted permissions; no credentials in the code base.
- Passwordless login with single-use, expiring links; signed session cookies.
- Rate limiting on scans and logins; access to production limited to operators.
- Encrypted daily backups kept in the EU.
Data subject requests
Access, export, correction and deletion requests: assistant@aiseen.eu. We verify the request against the e-mail address on the account and respond within 30 days. Agencies should route their clients' requests through us so that we can delete the related scans.
Records & breach notification
We keep a record of processing activities and notify the supervisory authority (NAIH) within 72 hours of becoming aware of a breach that risks your rights, and affected users without undue delay.
Full details: Privacy Policy · Terms of Service.