Privacy Policy

1. Data controller

Vágó Péter János e.v. (sole trader, hereinafter: the Controller), operating this website and the digital products under it as Smart Square Productions.

• Registered address: Lejtő út 4, 1124 Budapest, Hungary
• Tax number: 41852718-1-43
• Registration number: 58098091
• E-mail: hello@smartsquareproductions.com

The Controller is not required to appoint a data protection officer and has not appointed one. All privacy requests go to the e-mail address above.

2. What we process, and why

2.1 Contact by form or email

The project form collects your name, email address, selected service and task description. You may also provide a website, preferred timing and how you found us. The submitted enquiry may include the page path, selected portfolio reference and package, campaign labels and a technical request identifier. Existing campaign labels may be carried through internal page links without tracking cookies or local browser storage. Netlify Forms receives and stores form submissions. For email enquiries, we process the message and details you choose to provide. Enquiries are not automatically sent to an AI model. Source information is recorded only with the enquiry you submit, without tracking cookies or browser storage.

• Purpose: answering your enquiry, providing quotes, keeping in touch.
• Legal basis: legitimate interest and pre-contractual steps (GDPR Art. 6(1)(f) and (b)).
• Retention: correspondence for 5 years after the matter is closed; accounting records for 8 years where a contract exists.

2.2 Website operation and server logs

The website consists of static pages hosted by Netlify. The server keeps technical logs of requests, which may include IP address, timestamp, requested path and browser identifier.

• Purpose: operation, troubleshooting, abuse prevention.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
• Retention: according to the provider's own logging practice, typically short.

The website uses no advertising or profiling trackers. There is no Google Analytics, no advertising pixel, and no user profile is built.

Pageview measurement

The public counter measures page openings visible for at least two seconds from its displayed start date. It is a site-wide pageview count, not a count of unique people. Reloading counts as a new pageview. Known automated clients are filtered and retries of the same event are counted once. The counter stores an aggregate total and random, single-event identifiers for up to ten minutes; expired identifiers are removed on the next accepted event. It does not store IP addresses, browser fingerprints, cookies or persistent browser identifiers. The hosting service applies request rate limits. Netlify Web Analytics also provides separate server-side traffic statistics to the operator; its historical totals are not mixed into the public counter.

2.3 Web fonts

The site loads fonts from Google Fonts. Your browser connects directly to Google's servers, which may reveal your IP address to Google. Legal basis: legitimate interest in consistent, readable presentation.

2.4 Social content

The homepage displays Facebook posts as locally stored content cards. Viewing these cards does not load a Facebook embed. If you follow a link to Facebook, its own privacy rules apply there.

2.5 Blog and podcast

Reading blog posts and the podcast page requires no registration and no personal data. The podcast page may link to external video content, played under that provider's own terms.

2.6 Social media publishing (SSP Publisher)

The Controller operates an internal tool that publishes content to its own social channels: the Smart Square Productions and VProperty pages, and the Controller's own LinkedIn profile and company page.

• Data processed: access tokens issued by the social platforms, the text and image of published posts, and the time and result of publication.
• Whose data: only data belonging to the Controller's own accounts. The tool does not collect or store data about other LinkedIn or Facebook users, does not read private messages, and does not profile visitors.
• Legal basis: legitimate interest in managing the Controller's own communication (GDPR Art. 6(1)(f)).
• Security: access tokens are stored encrypted, in server-side environment variables and encrypted database fields. Tokens never appear in public code or in the browser.
• Retention: tokens until revoked or expired; the publishing log for 2 years.

You can revoke access at any time in your LinkedIn or Meta account settings.

2.7 SSP Calendar Connection — preparing consultation times

The Controller named in section 1 uses SSP Calendar Connection to prepare its own business consultations. The application calculates available times using the availability of the Controller's designated Google calendar and consultation hours. Opening this website or submitting an enquiry does not connect a visitor's Google account or calendar.

The connection verifies the email address and verified status of the Controller's authorising Google account. It requests the start and end times of busy periods in the designated calendar from Google. It does not request event titles, descriptions, locations or attendee lists. It does not create or change calendar events or send invitations. The scheduling component does not send calendar data to an AI model or to tools that create or publish social media content.

The raw list of busy periods remains in memory during the calculation. Suggested times and their verification data are stored in a private, access-controlled database. These include the calendar identifier, the time of the availability check, result counts, verification fingerprints and the suggestion's freshness limit. The task input contains the requested time window and scheduling parameters. The suggestion is linked to the consultation task.

Retention. The retention rule for suggestion details and their output verification data is 30 days from the availability check. After 30 days, the next successful maintenance check removes validated, expired output belonging to completed tasks from the active database and the backups managed by the system. A short redaction marker replaces the output. The task input, identifier, state and relationships remain so that completed work is not started again. The 30-day rule does not automatically set a deletion deadline for those remaining records or the connection credentials.

The retention check runs before the application starts and then regularly. Downtime, invalid data or unfinished dependent tasks can prevent cleanup; the application flags an issue requiring attention, and a failed startup check prevents normal operation from starting. Reaching 30 days therefore does not mean immediate deletion in every circumstance. The rule covers the active Mac system and its verified managed backups. It does not establish complete deletion from previous releases, manual exports or every copy on physical storage.

Storage and access. Calendar-based scheduling currently runs in the Controller's internal system on a Mac. Connection credentials are stored in the Mac Keychain; file permissions restrict access to the private database and managed backups. A cloud version is being prepared. The currently verified 30-day operation does not establish a live, complete cloud retention or deletion guarantee. Google provides account identification and calendar availability queries.

Ending access and making requests. Google access can be revoked in the connected-app settings of the Google account. Revoking access and deleting data already stored by SSP are separate actions. To request termination of the connection, access to data or deletion, contact hello@smartsquareproductions.com. The rights and remedies described in sections 5 and 6 of this notice continue to apply.

Using SSP Calendar Connection

SSP Calendar Connection is the Controller's internal scheduling application; its authorised operator connects the designated business calendar. Website visitors do not need to connect a calendar. A displayed time is a suggestion: it does not create a reservation or invitation and must be confirmed separately with the participants before the consultation is finalised. Google access for the connection can be revoked in the Google account. For questions about use or ending the connection, contact hello@smartsquareproductions.com. Data processing is described in the calendar supplement above and this privacy notice.

3. Processors

The Controller uses the following services:

• Netlify, Inc. — website hosting, delivery and storage of project form submissions.
• Render Services, Inc. — running the publishing backend and its database (European region).
• Google LLC / Google Ireland Ltd. — font delivery, working file storage, and account identification and availability queries for the Controller's designated calendar through SSP Calendar Connection.
• Meta Platforms Ireland Ltd. — embedded social content, Facebook and Instagram publishing.
• LinkedIn Ireland Unlimited Company — LinkedIn publishing.
• The e-mail hosting provider — serving e-mail correspondence.

Some providers may process data outside the European Economic Area. In such cases, transfers rely on the providers' standard contractual clauses or on an adequacy decision.

4. Security

The Controller applies measures appropriate to the state of the art: encrypted connections (HTTPS), encrypted token storage, internal endpoints protected by access keys, an audit log of every publishing attempt, and the principle of least privilege.

5. Your rights

You have the right to:

• be informed and to access your data,
• rectification,
• erasure,
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, where processing is based on consent.

Send your request to hello@smartsquareproductions.com. We reply within 30 days at the latest.

6. Remedies

If you believe the processing infringes your rights, you may lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Falk Miksa utca 9–11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9
naih.hu

You may also bring your case before the competent court at your place of residence or stay.

7. Changes to this policy

If the scope of services or the tools used change, this policy is updated too. The effective date is always shown at the top of the page.