Privacy

• Controller: ⟨EV_CONTROLLER⟩
• A Hungarian sole trader (egyéni vállalkozó), providing FirstLine
• Tax number: ⟨EV_TAX_NUMBER⟩
• Sole trader registration number: ⟨EV_REGISTRATION_NUMBER⟩
• Seat: ⟨EV_SEAT_ADDRESS⟩
• Email: ⟨EV_EMAIL⟩

• When you request an Enquiry Teardown: the website address and email address you enter, whether you ticked the box for occasional notes, and your browser’s user-agent string. We use them to produce the readout and send you the link. Legal basis: steps taken at your request before any contract (GDPR Article 6(1)(b)).
• To prevent abuse: your IP address, which we store only as a salted one-way hash, and the number of requests made from it, from your email address and for each website; and a bot check run in your browser by our hosting provider (Vercel BotID) when you submit a form. Legal basis: our legitimate interest in keeping the free service available (Article 6(1)(f)).
• Occasional notes: only if you tick the box. Legal basis: your consent (Article 6(1)(a)) and, for commercial email, section 6 of Hungarian Act XLVIII of 2008 on commercial advertising. You can withdraw consent at any time through the link in every email or by writing to us; withdrawal doesn’t affect what came before it.
• If you write to our intake agent: your messages, their language and time, and what you tell us about your clinic. We use them to answer you, and a person at FirstLine reads any reply the agent holds for review. Legal basis: Article 6(1)(b), and our legitimate interest in answering business enquiries (Article 6(1)(f)).
• If you book a diagnostic call: your name, email address, clinic and the time you choose. Legal basis: Article 6(1)(b).
• How our own funnel performs: our server records steps you take on the site, such as requesting a teardown, opening or printing a readout, starting a conversation or booking a call. Each record is linked to that request or conversation, with the page it started from, any campaign tags in its address (utm), the name of the website that linked to it, and whether an ad click identifier was present, never its value. It holds no IP address and no browser details. Legal basis: our legitimate interest in knowing which of our work leads to enquiries (Article 6(1)(f)).
• Visitor statistics: Vercel Web Analytics counts page views. It records the time, the page address (with readout links and every parameter other than campaign tags removed before it leaves your browser), the referring website, your approximate location, and your operating system, browser and device type. It recognises a visit by a hash of your request that is discarded after 24 hours, and it sets no cookie. Vercel Speed Insights measures how fast pages load: the page, network speed, browser, device, operating system, country and loading measurements. Legal basis: our legitimate interest in knowing which pages are read and whether they load quickly (Article 6(1)(f)). The admin area is not measured.
• When you visit the site: our hosting provider records technical request logs (IP address, time, address requested, browser) for security and to keep the site running. Legal basis: Article 6(1)(f).

When you request a teardown, we fetch public pages of the website you name. Those pages can contain personal data, such as the names and photographs of a clinic’s dentists. We keep text extracts of the pages for up to 30 days to produce and check the readout, and then delete them. The readout itself holds codes, page addresses and short quotes, not the pages. Legal basis: the legitimate interest, yours and ours, in analysing a business’s public website (Article 6(1)(f)).

Each of these processors works for us under a data processing agreement:

• Vercel Inc., United States: hosting, the bot check on our forms (BotID), and cookieless visitor statistics (Web Analytics and Speed Insights). The site’s functions run in Frankfurt, Germany.
• Neon Inc., United States: the database. Data is stored in Frankfurt, Germany (AWS eu-central-1).
• Resend Inc., United States: sending transactional email, from its EU region (Ireland).
• Cal.com Inc., United States: booking diagnostic calls.
• Google Ireland Limited, Ireland: the calendar a booked call is written to.
• Anthropic, PBC, United States: the AI model that reads fetched pages and drafts the intake agent’s replies.

Where personal data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework for certified recipients, or otherwise on the European Commission’s standard contractual clauses.

• Content fetched from websites for a teardown: 30 days.
• Teardown readouts: 12 months.
• Salted IP hashes: 30 days. Request counts: 2 days.
• Conversations with the intake agent, and their messages: 24 months from the last message.
• Your contact details and what you told us about your clinic: until you withdraw consent, or after 24 months without contact, whichever comes first.
• Records of booked calls: 24 months after the call.
• Funnel records: 24 months.
• Visitor statistics: the hash that recognises a visit is discarded after 24 hours; nothing identifies you after that.
• If we work together: project files for the engagement plus 12 months.
• Accounting records: for the period Hungarian law requires (⟨ACCOUNTING_RETENTION⟩).
• Hosting request logs: for the few days our hosting provider keeps them.

This site sets no tracking cookies, and there is no consent banner because nothing on it requires one. The visitor statistics above work without cookies. The only cookies we set are needed for something you asked for:

• NEXT_LOCALE remembers the language you chose, until you close your browser.
• firstline_visitor is set when you first write to the intake agent. It holds a random identifier so you can return to your conversation, and nothing else. It lasts 12 months.

If we ever add a tracker that needs your consent, we will ask for it first.

You can ask us for access to your personal data, and to correct, erase or restrict it; you can ask to receive it in a portable format; and you can object to processing based on our legitimate interest. Where processing relies on your consent, you can withdraw it at any time. Write to ⟨EV_EMAIL⟩; we answer within one month.

You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11.; postal address 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; www.naih.hu. You can also go to court; in Hungary, the regional court (törvényszék) for your place of residence has jurisdiction.

The teardown analyses a website, not a person. We make no decisions about you based solely on automated processing.

We date every version of this notice. If we change what we process or why, we update this page before the change takes effect.