Controller

The controller is Evgenii Shiriaev, Calle de Mendez Alvaro 2, 28045 Madrid, Spain, e-mail: info@catius.app (see Legal notice).

Which data we process

The photo or PDF of the fizetési meghagyás (payment order) that you upload.
The details read out of it and confirmed by you, for example közjegyző (notary), ügyszám (case number), amount claimed, day of service.
Your e-mail address, to send the result and for queries.
Payment data, which arises solely at the payment provider Stripe.
Technical data for abuse protection: your IP address is counted to limit the number of requests and is stored only briefly.

The uploaded document

We use the uploaded photo or PDF solely for automated text recognition and delete it immediately afterwards. For that one step the file is passed to the providers named below under "Recipients of the data"; which of them receives it depends solely on whether the file already contains machine-readable text. Deletion takes place immediately after processing, whether or not it succeeded.

Automated reading: please check it

The notary, the case number, the amount, the day of service and the other details are read out by machine, using text recognition and a language model. The reading can be wrong. We show you the extracted details for confirmation before the document is prepared; please check them carefully.

Retention period of the order

As long as you have not paid, the order is deleted after 48 hours. After a successful payment it is kept for 14 days, or 30 days if extended. When that period ends we delete the files belonging to the order and set your e-mail address and the other case details to null. For accounting purposes only the order ID, the amounts, the country governing VAT and the timestamps are kept, for as long as tax and accounting retention obligations require.

Contact for marketing

If you separately consent to your e-mail address being used for similar offers of our own, we store the address separately from the order, in a separate list, on the basis of your consent. You can object to its use at any time, without any particular form.

Recipients of the data

Cloudflare: hosting, database, file storage and limiting the number of requests. The database and the file storage are located in the EU.
Google Ireland Limited, Dublin, Ireland: measurement of advertising performance through Google Tag Manager and Google Ads, only after your consent. A transfer to Google LLC in the USA is not excluded; Google LLC is certified under the EU-US Data Privacy Framework.
Stripe: handling the payment. We do not see the full payment data; it stays with Stripe.
Resend: sending our e-mails. The e-mail with your result carries your documents (PDF and DOCX) as attachments, so their content, including the details of your case, passes through Resend's systems. Resend processes data in the USA and is certified under the EU-US Data Privacy Framework. The subject and the text of our e-mails contain no details of your case.
Cloudflare Workers AI: reading the text out of PDFs with a text layer, and the language model that breaks the recognised text down into details. By Cloudflare's own statement, the content processed is not used to train models. No EU location is fixed for this step; the processing rests on the data processing agreement with Cloudflare and its general terms.
Mistral AI SAS, Paris, France: text recognition for photos and for scanned PDFs without a text layer. According to the provider, the processing takes place in the EU. We have expressly switched off the use of our API calls for model training.

Third parties' data in the document

The fizetési meghagyás and the prepared ellentmondás (objection) also contain personal data of other people, in particular of the jogosult (claimant). We process it because it is necessary to prepare the document you ordered.

Legal bases

Article 6(1)(b) GDPR: performance of the contract concluded with you, including the processing of the document and the confirmed details.
Article 6(1)(f) GDPR: legitimate interest in preparing the document ordered, also with regard to third parties' data.
Article 6(1)(a) GDPR: your consent, insofar as you have consented to use for marketing.
Article 6(1)(c) GDPR: statutory retention obligation for the accounting data.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Contact us at info@catius.app or through the contact form.

Supervisory authority

You may complain to the supervisory authority, in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, National Authority for Data Protection and Freedom of Information), 1055 Budapest, Falk Miksa utca 9-11. The Spanish Agencia Española de Protección de Datos (AEPD) is also competent for the controller.

Measurement with Google Tag Manager and Google Ads

We advertise our service on Google Ads. To learn which advert brings visitors to us, we use Google Tag Manager and, through it, Google Ads tags. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

These services load only after you have consented in the banner. Until then nothing is transmitted to Google and no Google cookie is set. You can withdraw your consent at any time under "Cookie settings" at the bottom of the page; from the withdrawal the services no longer load.

After your consent Google processes in particular your IP address, the page viewed, the date and time, and browser data, and stores identifiers in cookies on your device. The legal basis for storing and reading on the device is Eht. 155. § (4), for the further processing Article 6(1)(a) GDPR.

We store your answer to the banner in a cookie on your device so that we do not have to ask again on every page. This cookie is created even if you decline, and contains only your answer.

None of this is needed to prepare the document.

Privacy notice