Policy of Confidentiality

1. Who are we

Data controller: Stone Rank Kft.
Address: Honvéd utca 8, 1st floor, gate 2, 1054 Budapest, Hungary
ID: HUOCCSZ.01-09-448748
Tax number: 32904556-2-41
Intra-community VAT: HU32904556
Contact privacy: support (at) ovirank.com
Website: https://ovirank.com

This policy describes what data we collect, for what reasons, for how long, and your GDPR rights.

2. Ported

The policy covers the ovirank.com site, the Ovirank SaaS application and our SEO agency activities. A separate cookie policy details trackers and your consent choices.

3. Data processed

We can deal with the following categories:

• Identity and contact data: name, first name, company, company, email, email, billing address, country, VAT number if applicable.
• Account and usage data: technical identifiers, connection logs, connection logs, parameters, actions in the software, volume of credits consumed, preferences.
• Billing and payment data: invoices, payment history, payment references. Card data is processed by Stripe and is not stored by us.
• Technical data: IP address, user agent, pages viewed, pages viewed, error events, technical cookies and, with consent, analytical and marketing cookies.
• Google connections via OAuth: basic profile information and, depending on your action, read or write access to the files you select. We only use it to perform the requested functionality. Revoking access to your Google account immediately cuts off our access.

4. Purposes and legal bases

We use your data to:

• Provide the service: account creation and management, execution of SaaS functionalities, support. Legal basis: execution of the contract.
• Invoicing and complying with our obligations: issuing invoices, managing VAT, fighting fraud. Legal basis: legal obligation and legitimate interest.
• Improve the product: diagnostics, aggregated usage measurements, service quality. Legal basis: legitimate interest.
• Communicate: service emails and contractual information. Legal basis: execution of the contract.
• Marketing with consent: newsletters, content, offers. Legal basis: consent.
• Security: logging, detecting abuse, protecting our systems. Legal basis: legitimate interest.

5. Subcontractors and recipients

We use service providers acting on our behalf:

• Stripe: payments, PCI DSS security, fraud prevention.
• Számlázz.hu and Számlabridge: compliant billing in Hungary and automation.
• Webflow: hosting the showcase site.
• Notion: internal CRM and project management.
• Google: OAuth authentication and, if you accept it, Analytics.
• Emailing and journaling tools when needed.

We frame these relationships through contracts that comply with the GDPR. In the event of a transfer outside the EU, we use the applicable legal mechanisms, in particular standard contractual clauses and additional security measures.

6. International transfers

Some service providers may be located outside the EU, in particular in the United States. We ensure that adequate guarantees are in place: standard contractual clauses approved by the European Commission, encryption, data minimization.

7. Retention periods

• Account and contractual data: duration of the relationship then up to 3 years in operational archiving, except for longer legal obligations.
• Invoicing and accounting documents: 8 to 10 years depending on applicable law.
• Technical journals: up to 12 months.
• Marketing data: until consent is withdrawn or 3 years without interaction.
• Data from Google integrations: temporary access, deletion within 30 days after revocation.

8. Cookies

We use cookies that are strictly necessary for the operation of the site and, subject to your consent, analytical and marketing cookies. Details and your choices are presented in the Cookie Policy as well as via the consent banner.

9. security

We apply appropriate technical and organizational measures:

• TLS encryption for communications.
• Encryption at rest when available from our service providers.
• Access controls and the principle of least privilege.
• Backups and monitoring.
• Card data managed by Stripe that is PCI DSS compliant.

10. Your RGPD rights

You have the following rights, under the conditions provided by law:

• Right to access and obtain a copy of the data concerning you.
• Right to rectify inaccurate data.
• Right to erasure in the cases provided for by the regulations.
• Right to limitation of treatment.
• Right to object to treatments based on legitimate interest.
• Right to portability for the data you have provided when the processing is automated and based on contract or consent.
• Right to withdraw consent at any time for treatments based on consent, without retroactive effect.

To exercise your rights, write to support (at) ovirank.com. We may ask you for proof of identity in case of reasonable doubt. You can file a complaint with your local supervisory authority or with the competent Hungarian authority.

11. B2C specificities and right of withdrawal

For digital content provided immediately after agreement, the right of withdrawal may not apply once the execution has begun with your consent. The refund conditions are specified in our terms and conditions.

12. Accounts Receivable and Billing

In order to issue compliant invoices, a complete billing address, country and, for EU businesses, a valid VAT number are required. The invoices are issued by Stone Rank Kft., a company registered in Hungary.

13. Minors

Our services do not target minors. If data concerning a minor under the age of 16 were communicated to us, we would delete them as soon as they were identified.

14. Changes

We may update this policy to take account of legal or technical developments. In the event of a substantial change, a notification will be posted on the site and, if necessary, sent by email. The date at the top of the document reflects the last update.

15. Contact

For any questions about confidentiality or the exercise of your rights: support (at) ovirank.com