Privacy Notice
Mondigo

This notice applies to the users of the Mondigo service and — where relevant — to the quote, job and contact data flows of the customers of businesses that use Mondigo.

1. Who provides Mondigo?

ZST Radio Korlátolt Felelősségű Társaság (ZST Radio Kft.)

The role of ZST Radio Kft. depends on the purpose of the processing.

• For the Mondigo account, access to the service, the security of the service and ZST Radio's own contractual or operational obligations, ZST Radio Kft. is an independent controller.
• When a business that uses Mondigo processes its own customers' data to prepare quotes, send quotes, arrange appointments or organise work, the business is the controller, and ZST Radio Kft./Mondigo acts as a processor under the data processing agreement between them.

If you are the customer of a Mondigo user, please turn first to the business you received the quote from with any question about your customer relationship with them.

2. What data can Mondigo process?

2.1. Mondigo users or businesses

• name, email address and basic business details;
• a secure hash of the password, authentication and session data, including the cookie that keeps you signed in and the identifiers of signed-out sessions (section 7.17);
• the log of changing actions in the account: who (internal id), when, which action and on which item (section 7.18);
• service settings, trade profile, templates and own price list;
• subscription or billing metadata, if such a function is in use;
• technical, security and access log data;
• support and pilot communication;
• the text, attached images and technical context of bug reports sent from the app (section 7.10);
• if you switch on phone notifications: the device's push subscription data and the device name (section 7.11);
• on-site photos uploaded to a quote, their captions, their assignment (item, job or general) and their visibility (section 6);
• aggregate data on the use of the account: the time of the last login and the last activity, the number of quotes, drafts and sent quotes, and the usage counters of the AI, dictation and photo functions (section 7.13);
• the access status, including a free period granted by the operator (its start, end, length and status) (section 7.13);
• for a registration without an invite: the time the email address was confirmed, the hash of the confirmation link or code and the times of the confirmation, a keyed hash of the IP address in the hourly registration counter, and, if the bot check is active, the browser and device signals processed by Cloudflare (section 7.15);
• if you came to Mondigo through a campaign or referral link: the link's campaign tags (utm_source, utm_medium, utm_campaign, utm_content), the landing page's sample trade and the referral code (section 7.5);
• the record of the service emails sent to the account owner: which email we sent, when and with what result (section 7.19);
• if you ask for them: the record of giving and withdrawing the marketing consent (time, the version and language of the consent text, the source and the email address) (section 7.20).

2.2. The business's customer and job

• name, email address, phone number and work address;
• the description of the job, quote items, quantities, prices and tax settings;
• the status and versions of the quote, and its opening and decision events;
• appointments, notes and customer communication;
• optionally uploaded photos of the work area or of documents;
• on-site photos of the work area, if the business uploads them; a photo shows the subject of the work (for example a room, a wall surface or equipment) and, exceptionally, a detail of the customer's home or a personal item (section 6);
• technical identifiers and event data of the public quote page;
• the customer rating requested after the job is finished: the recommendation answer, the star ratings, the answer on how the job turned out, the optional written comment, and the times the request was sent, first opened and submitted (section 7.12);
• the processed item rows of earlier quotes loaded by the business (spreadsheet, PDF or image): description, quantity, unit, unit price, price type, VAT rate, category, quote date and trade (section 7.8);
• the use of Szokásos munkák in quotes: which version of which Szokásos munka went into the quote and how, and — if learning is active — the description, unit and quantity of the items of the sent quote (section 7.16).

2.3. A person requesting an invite

• email address;
• if provided: name or company name, trade, phone number and a short message;
• the source of the request (for example the home page), the number of requests and their times;
• the handling status of the request (pending, invite sent or rejected) and the identifier of the related invite (section 7.14);
• if the bot check is active: the IP address, browser and device signals and the check's token, processed by Cloudflare (section 7.15).

Dictated text, voice recordings or uploaded images may unintentionally contain further personal data. Only data needed for the job may be recorded; entering special-category or unnecessarily sensitive data should be avoided.

3. For what purposes do we use the data?

• creating and operating the user account, keeping you signed in and blocking signed-out sessions (section 7.17);
• structuring the job description and preparing an editable quote suggestion, including quality assurance of those suggestions (sections 5 and 7.7);
• transcribing spoken work notes, if the Voice Composer voice function is active;
• putting together, sending and tracking quotes;
• attaching on-site photos to a quote so that the customer can see what an item or job refers to (section 6);
• handling the customer-facing quote page, change requests and customer decisions;
• arranging appointments, organising work, managing templates and prices;
• asking the business's customer for a rating after the job is finished, and showing the answer to the business so that it can improve its service and resolve a customer's negative experience (section 7.12);
• sending phone notifications about quote events and the next day's job, if the user switches them on (section 7.11);
• preparing own price and Szokásos munka suggestions from earlier quotes loaded by the business; a quote uploaded as a PDF or image is read by an AI model (section 7.8);
• recognising the business's saved Szokásos munkák in the note by their name, and suggesting changes to Szokásos munkák from the business's sent quotes, exclusively within that business's account (section 7.16);
• forming the business's own pricing patterns from the quotes it sent, and suggesting prices in the business's new quotes based on them, exclusively for use within that business's account (section 7.9);
• operator management of Mondigo accounts: managing invites, access and free periods, customer support and abuse prevention in the operator console (section 7.13);
• receiving and deciding on invite requests (section 7.14);
• protecting registration without an invite: confirming the email address, protection against bots and mass registration, filtering out disposable email addresses and lower daily limits for new accounts (section 7.15);
• security of the service, abuse prevention and troubleshooting, including the log of changes made in the account (section 7.18);
• investigating and fixing problems reported from the app, including the repair proposals of the automatic repair environment (section 7.10);
• support and pilot assistance;
• pseudonymised product-usage and pain-point analysis to improve the pilot, if product analytics is active; also narrowed to one account or user for customer support and troubleshooting (section 7.13);
• measuring through which marketing channels (advertising, social media, referral, the footer of a customer-facing quote) Mondigo users arrive, and which of them make and send quotes and subscribe (section 7.5);
• sending service emails to the account owner about the start and status of the account: a welcome email, a one-time help email if the first quote has not been sent, and information that the free sends are used up and on the terms for going on (section 7.19);
• sending tips, news and offers by email, only to those who separately consented to it, and keeping the register of consents (section 7.20);
• meeting legal and contractual obligations.

Pilot product analytics is a separately approved production data flow. Screen recording (Session Replay) is a separate data flow of higher sensitivity, which is active on the basis of a separate legal/data protection approval: only in the authenticated professional application, on a sample of at most 10% of users (section 7.6).

4. What is the legal basis of the processing?

When ZST Radio Kft. acts as an independent controller, the legal basis depends on the purpose:

• GDPR Article 6(1)(b) — performance of the Mondigo service contract;
• GDPR Article 6(1)(c) — compliance with an applicable legal obligation;
• GDPR Article 6(1)(f) — the legitimate interest in the security and integrity of the service, protection against abuse and troubleshooting;
• GDPR Article 6(1)(a) — consent, where a genuinely optional purpose requires it; at present, sending tips, news and offers by email (section 7.20).

The legal basis for processing the business's own customers' data is determined by the business as controller. In this respect Mondigo acts on the business's documented instructions.

The Decision Fabric check of quote drafts (section 5) and the recording of quality-assurance evidence (section 7.7) are not a new processing purpose, but the quality-assurance part of structuring the job description and preparing the quote suggestion. For the data of the business's customers the same role and legal basis therefore apply as for the structuring itself: the business is the controller, and Mondigo acts under the data processing agreement. Where ZST Radio Kft. is an independent controller, the legal basis is the legitimate interest in the integrity of the service and troubleshooting (GDPR Article 6(1)(f)).

ZST Radio Kft. processes a bug report sent from the app (section 7.10) as an independent controller, on the basis of its legitimate interest in troubleshooting and fixing the service (GDPR Article 6(1)(f)). Reporting is voluntary. If, despite the filtering, the report or the attached quote context contains data about the business's customer, the same role applies as for quote preparation: the business is the controller, and Mondigo acts under the data processing agreement.

ZST Radio Kft. processes the data needed for phone notifications (section 7.11) as an independent controller, to perform the Mondigo service contract at the user's request (GDPR Article 6(1)(b)). Notifications are optional: they only work if the user switches them on and approves the browser's permission prompt, and they can be switched off at any time. Notifications do not contain the data of the business's customers, and that data does not reach the push services.

In the operator console (section 7.13) ZST Radio Kft. acts as an independent controller. Viewing account and usage data and managing invites, access and free periods are necessary to perform the Mondigo service contract (GDPR Article 6(1)(b)). The product analytics view linked to an account or user and the logging of operator actions are based on ZST Radio Kft.'s legitimate interest in improving the product, customer support, preventing abuse and the accountability of operator access (GDPR Article 6(1)(f)); section 7.13 sets out the essence of the balancing test and how to object. The operator console gives no access to the data of the business's customers.

ZST Radio Kft. processes an invite request (section 7.14) as an independent controller, at the request of the interested person, as a step prior to entering into a contract (GDPR Article 6(1)(b)). The request is voluntary; without an email address we cannot send an invite.

ZST Radio Kft. protects registration without an invite (section 7.15) as an independent controller. Confirming the email address is a step taken at the data subject's request prior to entering into a contract, and it is also needed to perform the contract, because quotes are sent to customers from the account in the user's name (GDPR Article 6(1)(b)). The bot check, the mass-registration counters, the filtering of disposable email addresses and the daily limits for new accounts are based on our legitimate interest in the security of the service and the prevention of abuse (GDPR Article 6(1)(f)). Balancing test: without protection, accounts created automatically, in bulk or with a disposable address could send unsolicited emails and use up costly services, while the protection needs only little data, stored briefly or as a keyed hash, and a person registering reasonably expects such checks, so our interest does not disproportionately override the interests of the data subjects; you can object to this as set out in section 11.

ZST Radio Kft. records the marketing source (section 7.5) as an independent controller, on the basis of its legitimate interest in measuring which marketing channels bring users who actually use Mondigo and subscribe, and which are not worth spending on (GDPR Article 6(1)(f)). Balancing test: without measurement, spending on advertising and promotion would have to be allocated blindly; for this, however, only a few short campaign tags of the link are needed, which are set by the link's creator (Mondigo or the referrer), not by the user. We do not record click ids, store nothing in the browser, do not pass the data to advertising platforms, and do not use it for individual profiling or for advertising to the user. A user who arrives through a campaign link can reasonably expect the provider to know which campaign they came from. Our interest therefore does not disproportionately harm the data subjects' interests; you can object to it as set out in section 11.

ZST Radio Kft. sends the service emails to the account owner (section 7.19) as an independent controller, as performance of the Mondigo service contract (GDPR Article 6(1)(b)). The only legal basis for sending tips, news and offers by email is the data subject's separate consent (GDPR Article 6(1)(a) and section 6(1) of Act XLVIII of 2008 on the basic conditions and certain restrictions of commercial advertising (Grt.)); keeping the register of consents is required by section 6(5) of the Grt. (GDPR Article 6(1)(c)) (section 7.20).

The post-job customer rating (section 7.12) belongs to the job between the business and its customer. Mondigo sends the request on behalf of the business and stores and displays the answer for the business: for this, the business is the controller and determines the legal basis of the processing, and Mondigo acts as a processor under the data processing agreement. Answering is voluntary; a customer who does not want to answer does not need to do anything. The pseudonymous process events recorded about the form, which carry no content, follow the rules of product analytics (section 7.5).

5. Artificial intelligence

Mondigo may use artificial intelligence to interpret the job description entered by the user, dictated text and — if the photo function is active — images, and — if the function is active — to read an earlier quote that the business uploads as a PDF or image (section 7.8). The AI produces editable suggestions; the business decides on the final content of the quote, its items, quantities, prices and whether it is sent. If the photo AI function is active, the AI uses a photo only to suggest which item or job it belongs to and to suggest a short caption. It does not determine quantities, prices or any other quote data from the photo, and the photo is not used for model training. The business checks and can change the suggestion; a photo with an uncertain suggestion stays hidden by default.

Mondigo does not use solely automated decision-making that on its own produces legal effects or similarly significantly affects the data subject.

Mondigo's AI processing takes place on the Microsoft Azure AI Foundry EU Data Zone route (OpenAI GPT models, operated by Microsoft). A direct Anthropic API route may only be used after this notice and the international data transfer documentation have been updated in advance.

To check quote drafts, Mondigo also uses a separate decision model, TypeSafe Jev (Decision Fabric). Jev does not write text: it picks one of the given options for closed questions. The proposals for two question types can affect the draft: (a) which quote line a stated price belongs to, and (b) whether a line is supported by the dictated note. A deterministic Mondigo policy admits a Jev proposal only when strict checks pass; otherwise the line is flagged “ellenőrizendő” (to be checked) for the professional. The system never changes or invents an amount, and never deletes a line automatically. A third question type — whether two lines bill the same work — can only show an advisory warning; the professional decides. The professional always reviews and sends the quote. In production, this guarded policy can be activated by a dedicated software release after this notice is published; until it is active, the Jev result does not change the quote and serves at most to measure the quality of the suggestions.

For this, TypeSafe receives the names, quantities, units, categories and server-side line identifiers of the draft lines, the business's trade, and the selected sentences of the note that mention those lines; for price-to-line binding it also receives the amounts deterministically recognised in the note and their wording. A selected note sentence may contain a stated amount. Sentences containing contact details, addresses or personal names are filtered out by pattern; the filter is not complete, so personal data contained in a work-related sentence may exceptionally be passed on. The full note, photos, customer records and tenant or user identifiers are not transferred.

For the quality assurance of AI suggestions, Mondigo may record the structuring evidence of each quote in production; see section 7.7.

6. On-site photos in the quote

If the function is active, a logged-in business can attach on-site photos to its quote. Photos cannot be uploaded in trial (guest) mode.

On upload. The system removes the photo's metadata (for example GPS data showing where it was taken, and device details), applies the image's orientation and blurs the faces it detects. Face detection is not perfect, so upload only images needed for the job, and avoid unnecessarily showing third parties, documents or personal items. The system does not store a photo without blurring.

Storage. Photos are stored in Microsoft Azure's Warsaw (Poland Central) data centre, in a separate store, encrypted (application-level AES-256-GCM encryption, with a separate key for each photo). Only Mondigo's server can access the store; there is no public access.

Who sees them. The business and its team see the photos. On the public quote link (section 9) the customer sees only the photos that the business reviewed, approved and left visible to the customer before sending; a hidden photo does not reach the customer. The photos of a sent quote are fixed: they cannot be changed afterwards, and a change only appears in a new version of the quote. The email contains no images, only a line stating the number of photos.

The business's responsibility. The business decides on uploading a photo, on its content and on which photos the customer sees, and is responsible for processing the personal data shown in the photo lawfully (for example in the case of a picture taken of the customer's home).

Retention and deletion. A photo is kept together with the quote. A draft that contains only photos (no items and no note) is deleted together with its photos 14 days after its last change; the draft list warns about this beforehand. When a photo, a draft or the account is deleted, the stored image files are deleted too. The store keeps deleted files restorable for at most 90 more days (deletion protection and versioning), after which they are permanently deleted.

Export. The photo data (caption, assignment, visibility) is included in the account's data export, and the photos can be downloaded one by one from the account.

7. Where do we store and process the data?

7.1. Application, database and backup

Mondigo's production application and primary database run in a Microsoft Azure environment in Warsaw, Poland (Poland Central, polandcentral). Backups go to a separate, private Azure Blob Storage container in the same region. Current backup copies expire after 90 days and earlier versions after 7 days; after that, the storage's deletion protection keeps expired copies restorable for a deletion-protection period of at most 30 days, after which they are permanently deleted.

Until 25 September 2026 the service ran in the Madrid (eu-madrid-3) region of Oracle Cloud Infrastructure. The instances and backups stored there are being deleted; that environment held no real user or customer data.

On-site photos are stored encrypted in a separate, private Azure Blob Storage store in the same region (section 6).

The processing of bug reports sent from the app is described in section 7.10, that of phone notifications in section 7.11, and that of the post-job customer rating in section 7.12.

7.2. Transactional email — Amazon SES

Mondigo uses Amazon Simple Email Service (Amazon SES) for transactional email. The separate Mondigo identity, sending, and delivery/bounce/complaint event handling are configured for the Frankfurt (eu-central-1) region.

The data processed may include the recipient's and sender's email address, the subject and content of the message, the quote link, the optional calendar attachment and delivery metadata.

AWS's data processing terms and — where applicable — its international data transfer safeguards apply to the processing. An EU service region is not a general promise that all AWS account, support or contractual metadata stays exclusively in the EU.

The earlier Resend provider is not part of the active data flow of the minimum pilot. Before it is switched on again, this notice, the subprocessor list and the transfer review must be updated.

7.3. AI — Microsoft Azure AI Foundry

The Microsoft Azure AI Foundry route is based on an EU Data Zone deployment: requests are processed within the European Union data zone, and stored data remains in the geography of Mondigo's Azure resource. Microsoft does not use the inputs to train models, and OpenAI, which develops the models, has no access to them. Microsoft may temporarily store inputs and outputs for abuse detection, and authorised Microsoft employees may review content flagged by the abuse monitoring system where necessary. For a service deployed in the EEA, this review is carried out by Microsoft employees located in the EEA. Mondigo switches off the storage of application state in the Responses API. To reduce response times, Microsoft may cache the identical beginning of requests (prompt prefix) for up to one hour, only in the memory of the processing system; this cache is not written to disk, is not accessible to other customers and is not used to train models. Microsoft's data processing terms (Microsoft Products and Services Data Protection Addendum) apply to the relevant processing of personal data; where necessary, the appropriate data transfer safeguards set out in it apply.

The separate TypeSafe Jev decision-model service is hosted in the United States. TypeSafe's privacy notice states that personal data originating from the EEA is transferred to the U.S. for storage and processing. TypeSafe's Data Processing Addendum incorporates the European Commission Standard Contractual Clauses (SCCs); for Mondigo tenant-customer data, processor-to-subprocessor Module 3 applies. TypeSafe may use Customer Data for model training only with prior consent. The DPA does not specify a fixed retention period: Customer Personal Data may be retained for as long as necessary for the processing purpose, taking applicable law into account. The kinds of data transferred to TypeSafe did not change with the update of 1 October 2026; what changed is that a Jev proposal can affect the draft under the strict conditions of section 5.

7.4. Speech transcription — Deepgram

If the Voice Composer transcription function is active, Mondigo uses Deepgram's Speech-to-Text service. Mondigo's server sends the audio to Deepgram's EU-specific api.eu.deepgram.com endpoint; the configuration uses Hungarian and the Nova-3 model.

Mondigo technically enforces the mip_opt_out=true setting on every Deepgram request, so the request does not take part in Deepgram's Model Improvement Program. According to Deepgram's documentation, request data excluded from model improvement in this way is only kept for as long as needed to process the request. Deepgram's EU endpoint serves the processing route within the EU; Deepgram acts as a processor under the applicable contractual and data processing terms.

Mondigo's server processes the audio as a stream or in memory, and does not write it to a lasting audio file. For recovery after a network or provider error, the browser may keep a temporary local safety copy of the audio on the device. It is deleted immediately after a successful transcription; in a failed case that can be retried, it stays usable for at most 48 hours and is then physically cleaned up the next time the application is used.

The vocabulary that helps recognise trade terms may consist of item names from the business's own price list and general trade expressions; the names, addresses, email addresses or phone numbers of earlier customers never go into this vocabulary.

7.5. Product analytics — PostHog EU

If pilot product analytics is active, Mondigo uses PostHog EU to measure how users get from registration to their first quote, where they get stuck while dictating, structuring or editing, and how the business life cycle of quotes develops.

Product analytics uses a closed list of events and properties. We do not send PostHog any dictated or free text, customer name, email address, phone number, address, quote description, price, raw user/tenant/quote identifier, full URL or capability token. The system uses stable, one-way pseudonymous references, and disables forwarding of the IP address for analytics on server-side events. In PostHog the pseudonymous reference does not by itself identify the account or the user; however, in the account- and user-level view under section 7.13 the Mondigo server can link the events of a given account or user to that account or user. If the browser sends a Do Not Track or Global Privacy Control signal, no product analytics event is recorded from the browser; this signal does not apply to events created on the server (for example sending a quote).

Where the account came from (marketing source). If the function is active and you come to Mondigo through a campaign or referral link, we read the campaign tags (utm_source, utm_medium, utm_campaign, utm_content), the landing page's sample trade and the referral code (for example, if you came from the footer of a quote sent to a customer) from the link's address (URL). We read these only from the link's address: we store nothing in your browser or on your device (no cookie or local storage), and we do not record click ids (for example gclid, fbclid). We accept only short, lowercase campaign tags; anything else (for example free text, an email address or a phone number) is discarded. At registration or when a trial starts, we record the source of the first arrival among your account data and also attach it to the registration product analytics event; it may also appear on the landing page's anonymous page-view event. Our aim is to measure which channels bring users who actually use Mondigo and subscribe. We do not pass it to advertising platforms and do not use it for individual profiling or advertising. The source stored on the account is kept until the account is deleted, is included in the data export and is deleted when the account is deleted; the pseudonymous events sent to PostHog are governed by the rules of this section above. You can object to the recording at info@zstradio.com: we then delete the source recorded for your account and do not record it in the future.

The PostHog project runs in the EU region. According to PostHog's current Cloud documentation, product-event retention on paid plans is 7 years and is plan-derived/read-only; a shorter Cloud retention cannot be set and is not available on request. If Mondigo product analytics is active, it uses this actual 7-year provider retention.

7.6. Session Replay — PostHog EU

Session Replay is active on the basis of a separate legal/data protection approval. Mondigo uses masked session replay only in the authenticated professional application, on a sample of at most 10% of users, to uncover navigation and user friction. Whether a user is in the sample is decided deterministically by Mondigo's server from the pseudonymous user reference. If Do Not Track or Global Privacy Control is switched on in the browser, replay is not loaded. The landing page, the public quote pages, staging and the Synthetic World may not be recorded.

The replay client masks every input value, DOM text and DOM attribute; blocks image, video, canvas/iframe/object/embed content; sends no network payload or console log; generic autocapture and automatic pageview/pageleave capture are switched off; there is no lasting browser persistence: the pseudonymous replay session state lives only in the memory of the given page, without cookies/localStorage/sessionStorage. Only a pseudonymous user reference is passed to the replay. The direct connection between the browser and PostHog technically also transmits the IP address and user agent, so discarding IP data on the PostHog project side is mandatory.

Session Replay may not be used for employee monitoring, advertising, customer profiling, automated decision-making or reconstructing quote/customer content. The Session Replay retention period is 30 days.

7.7. Quality-assurance evidence — Azure Evidence Store

In production, Mondigo records, for every AI structuring call and linked to the quote, the evidence of how the quote draft was made. The recording can be activated with a separate switch after this notice is published; before that, no such evidence is recorded. The record may contain:

• the dictated or typed note, including the transcript;
• the AI model's raw reply and the lines derived from it;
• the result shown to the professional;
• the Decision Fabric decisions;
• the professional's edits;
• the lines and amounts of the sent quote version;
• the end customer's response (acceptance, rejection, the topic of a change request) — not the free-text reason for a rejection, only whether a reason was given;
• the model used, the software release identifier and the processing times.

The record contains only the fields on a fixed list; the end customer's structured contact details (name, email address, phone number, address and the recognised address suggestion) are not included. As a data minimisation measure, the system removes from every kept text — the note and the model replies included — passwords, tokens and access links, email addresses, Hungarian phone numbers, street addresses, and everything the system recognised about the end customer's name, contact details and address. This filtering is pattern-based and not complete: contact details or other personal data the system did not recognise can remain in the free text of the note until the end of the 90-day retention, or until deletion by quote or case.

The purpose of the recording is to measure the quality of AI suggestions, to replay earlier cases through newer versions of the processing as a regression check (to verify that a change does not break a result that was correct before), and to analyse errors. Replay, once available, runs only inside Microsoft Azure's EU environment. The records are not used to train or fine-tune models and are not shared with anyone other than the processors listed in section 8. General learning or model training across tenants may only be introduced after a separate decision and a prior update of this notice.

The records are kept only in the Warsaw (Poland Central) EU region of Microsoft Azure: in the production database and in a separate, private, access-restricted storage (Evidence Store) in which object names are pseudonymous. The content is never transferred to GitHub, to a staging environment or to a provider not listed in section 8.

Retention: 90 days from recording, in the database and in the storage alike; longer only under a documented legal hold or during an active data protection/security incident. A copy deleted from the storage can technically be restored for at most 7 more days, so a copy exists for about 98 days in total at most. The backups of the production database do not contain these records.

Deletion: when a business account (tenant) is deleted, the records in the database are deleted immediately and the copies in the storage at the next daily deletion run; the system keeps the deletion request and retries it until the deletion is confirmed, and the deletion becomes final after the 7-day deletion-protection period. Deleting a quote also deletes its records. The records of a data subject (for example a customer of the business) are deleted on the business's instruction, on the basis of the data subject's quotes.

Access and objection: the business's account data export includes the evidence records of its account. The business can ask (info@zstradio.com) that no evidence is recorded for its account; the account is then excluded from the recording and from the transfer to the storage, its existing records are deleted from the database within an hour, and deletion of its copies in the storage is started.

7.8. Loading earlier quotes (CSV/XLSX, PDF, JPG/PNG)

The account owner may load their own earlier quotes as a spreadsheet (CSV or XLSX file) or — if the function is active — as a PDF or photo (JPG, PNG) so that Mondigo can prepare price and “Szokásos munka” (usual job) suggestions for them based on their own earlier items and prices. Loading is optional and is not a condition of registration or of preparing the first quote.

Roles and the business's responsibility. For the personal data of former customers named in the earlier quotes, the business is the controller, and ZST Radio Kft. / Mondigo is a processor acting on the business's instructions. The business is responsible for keeping and using the earlier quotes lawfully. If the use in Mondigo counts as further processing for a purpose other than the original one, it is the business's task to ensure an appropriate legal basis and, where applicable, to carry out the compatibility assessment under Article 6(4) GDPR. The business also ensures that the data subjects are properly informed under Article 13(3) GDPR or, if the data were not obtained from the data subject, under Article 14 GDPR. This Mondigo notice does not replace that obligation.

Before the first upload the business must confirm that it meets these conditions. Mondigo records who confirmed, when, and which text version of the statement. The confirmation log is kept until the account is deleted.

What we process and where. Mondigo processes the file in its Microsoft Azure Poland Central environment in Warsaw. A spreadsheet (CSV/XLSX) is read by Mondigo's server, without AI.

PDF and photo. A PDF or photo is read by an AI model: the same Microsoft Azure AI Foundry EU Data Zone route that also interprets the dictated note (sections 5 and 7.3). No new processor or AI provider is used for it. The model receives the document and a fixed instruction to return only the work and material items, their quantity, unit and unit price, whether the price is net or gross, the VAT rate, the date of the quote and the trade, and never the name, address, contact details, payment data, tax ID or notes of a customer or any other person. A PDF is sent unchanged, so all data in it — for example the former customer's name and address — reaches the model. Before a photo is sent, we remove its metadata (for example GPS data), blur detected faces and downsize it where needed; if this step is not available, the image is not sent. In one upload at most 5 PDFs or images go to the model, each at most 8 MB. Microsoft does not use the input to train models; Microsoft's temporary storage is described in section 7.3. Where an item read this way is uncertain, Mondigo marks it “ellenőrizendő” (to be checked), and the business can correct or exclude it when reviewing the upload.

The whole file is held in the server's memory only while it is processed. We do not store the file itself, its name, the image sent to the model or the model's raw answer: they do not go into the database, the photo store, the evidence store of section 7.7 or product analytics. For the AI call we log only technical data (the model name, the length of the request and the answer, the processing time), no content.

Repeated file. From the file's checksum the system recognises when the same file has already been loaded and is still held; such a file is not read again and is not sent to the model.

We store durably only the data needed to process the quote item: the item's description, quantity, unit and price, whether the price is net or gross, the VAT rate, the item category, the date and trade of the quote, as well as the file's checksum, the warnings produced during processing, the normalised form of the description, and technical attributes of the processing (recognition confidence, review and duplicate status, extraction method and source type).

Other columns of the spreadsheet and other parts of the document, such as the customer's name, address, phone number, email address or notes, are not used and not stored durably.

Personal data in the item description. Email addresses and Hungarian mobile numbers in the item description are removed or replaced at loading; this also applies to the descriptions returned by the AI model. The system also tries to recognise item descriptions that look like a person's name or an address. Such an item is not loaded or stored, so it is not used for a learning pattern, an own price or a Szokásos munka; at the end of loading, the system shows how many such rows it skipped.

Automatic recognition and the instruction given to the model are not infallible. The business must therefore remove, before loading, names, addresses and other personal data that refer to the customer or another natural person and are not needed to describe the work item. For a PDF or photo, where possible upload a version in which these are covered.

What we use it for. From the loaded item rows Mondigo prepares price and Szokásos munka suggestions only for that business. An own price or a Szokásos munka is created only when the business explicitly saves it.

We do not use the loaded data and documents for other businesses' suggestions, for training general models or for fine-tuning artificial intelligence models.

Retention, deletion and access. The item rows extracted from a load — from a spreadsheet, PDF or image alike — are kept for at most 90 days from the time of loading. They are deleted earlier if the business deletes that import round or closes its account. If the loading feature is not available, deletion of an import round can be requested at info@zstradio.com; the 90-day deletion happens regardless.

The production database backups do not contain the item rows from loading.

The decision on a Szokásos munka offer (accepted or rejected, with a technical key that contains no description and the number of underlying quotes) is kept until the account is deleted, so that the same offer is not repeated. This decision contains no item description, price or customer data.

An own price or Szokásos munka that the business explicitly saved is the business's own, separately handled data, so the 90-day import retention limit does not apply to it.

The loaded item rows and the data of the business's confirmation are included in the account data export. Former customers must address requests for access, rectification, erasure, objection or other data subject requests to the business as controller. As processor, Mondigo supports the business in fulfilling these requests.

7.9. Learning from the business's own quotes

From the item prices that the business entered or changed in the quotes it sent, Mondigo may form pricing patterns, exclusively within that business's account. The purpose is that Mondigo recognises the business's consistently used own prices and — if the price suggestion function is active — can suggest prices based on them in the business's new quotes.

A learning pattern may contain the normalised identifier of the work item (no pattern is made from items that look like a person's name or an address), the unit, the calculated typical price, the number of different quotes and customers it is based on, and measurement data on the accuracy of Mondigo's earlier estimates.

The learning pattern does not store the customer's name, address, phone number or email address. To determine the number of different customers, the system uses the customer data already in the quote only for the time of the calculation. The learning evidence may refer to the technical identifier of the underlying quote.

The system does not use an item whose description looks like a person's name or an address to create a learning pattern.

Saving an own price. When the business enters or changes the price of an item in a quote, Mondigo saves that price, together with the item's name and unit, to the business's own price list (Áraim), so that it can be used in later quotes. An own price can be changed or deleted in Áraim at any time. An item whose name looks like a person's name or an address is not saved as an own price.

Based on the learning patterns, Mondigo may later offer to save a consistent price as an own price (at present, at the earliest when the price occurred in at least three quotes and with at least two different customers). An own price is created from such an offer only if the business explicitly chooses the “Mentés saját árként” (save as own price) action. The offer can be declined. Mondigo may record when the offer appeared and which action the business chose.

Price suggestion based on your earlier quotes. If the function is active and, in a new quote, the business names a work item without saying its price, Mondigo may suggest a price for that item from a learning pattern formed from the business's own previously sent quotes. A suggestion can only come from a pattern that consists exclusively of that business's data, is based on at least three quotes and at least two different customers, and whose accuracy Mondigo has already checked beforehand, invisibly to the user, against the business's later quotes. Mondigo does not add a new item to the quote this way: it only suggests a price for an item already identified.

Mondigo shows the suggested price with a clearly visible label saying that the price comes from the business's earlier quotes (for example “Korábbi ajánlataidból”, from your earlier quotes). The price can be changed freely, and the business must confirm or correct such an item before the quote is sent. A price the business says, an item price saved in Áraim and the price previously used for that customer always take precedence over the suggestion. In place of the hourly rate or call-out fee set in the settings, or the price of a saved Szokásos munka (usual job), Mondigo may suggest the different price that the business consistently uses — likewise labelled as awaiting confirmation.

If the business changes a suggested price several times in a row, Mondigo stops suggesting that price on its own; at most it offers the price the business has used more recently, labelled “bizonytalan” (uncertain) and asking for explicit confirmation. The price suggestion for a work item can be switched off in Áraim and allowed again later. Mondigo records which price it suggested for which item and whether the business kept, confirmed or changed it; it uses this to measure the accuracy of the suggestions and for the holding back described above.

Learning does not change the content of the sent quote. The business always decides on the content and price of the final quote. With this function Mondigo makes no solely automated decision that produces legal effects concerning, or similarly significantly affects, the data subject.

Where the data stays. Patterns, measurements, offers and price suggestions are linked exclusively to that business's account. Other businesses have no access to them, and we do not base suggestions to other businesses on them.

Beyond Mondigo's existing infrastructure, no further provider or artificial intelligence model is used for this, including the price suggestion. Learning patterns are not passed on for product analytics and are not placed in the evidence store of section 7.7.

The patterns are not used to train or fine-tune general models. Cross-tenant learning based on several businesses' data will only be introduced after a separate decision, an appropriate legal basis and a prior change of this notice.

Deletion and retention. If the business deletes a quote that served as learning evidence, we also delete the related evidence and recalculate the affected pattern from the remaining data or, if no suitable evidence remains, delete it. The business cannot delete a quote that has been sent; the evidence from such a quote is deleted when the account is deleted or when a data subject's erasure request is fulfilled.

The remaining learning patterns and the offer and price-suggestion data are kept until the account is deleted. They are deleted with the account, and they expire from database backups according to the schedule set out in section 10.

The learning data are included in the account data export.

7.10. Bug reports from the app (“Visszajelzés” / Feedback)

If the feature is active, a signed-in professional or team member can report a problem or suggestion with the app's Feedback button. Reporting is voluntary.

What is recorded.

• The report text, up to 4,000 characters.
• Up to four attached images of at most 2 MB each: an area selected in the app, or an uploaded or pasted image.
• The page route without query parameters or identifiers, the software release, the reporter's role (owner or team member) and the business's trade.
• When the report is made on a quote: its line items as in the AI draft and now (description, unit, quantity, price source and status) and what the quote is missing. Customer fields (name, e-mail, phone, address) are not included.

The report is stored linked to the account and the reporter. The repair environment receives only pseudonymous references, never a raw account or user identifier.

Filtering. Before storage, the server replaces these with placeholders in the text and the quote context:

• e-mail addresses and phone numbers;
• bank account numbers (IBAN) and tax numbers;
• text that looks like a street address;
• strings that look like passwords or tokens;
• the quote customer's name and address.

The filter is pattern-based and not complete. Please do not write customer data into the report.

Images. On an area selected in the app, these are covered before the image is taken:

• the dictation note;
• the customer's name and contact blocks, on the quote and in the customer list;
• every e-mail, phone, tax, bank and name field;
• the account and team details.

Uploaded or pasted images are neither changed nor filtered, so please do not attach an image that shows customer data. Images are stored encrypted (AES-256-GCM).

Automatic repair environment. If the repair queue is active, the filtered report and its images are processed in an isolated repair environment in the Oracle Cloud Infrastructure Madrid region (eu-madrid-3). It has no public IP address.

• Each report runs in a fresh, isolated container that can reach only the AI service and the public software package registry. Working data is deleted afterwards.
• The environment tries to reproduce the problem with an automated test. If that works, it prepares a proposed code change.
• Our team reviews the proposal. It reaches production only after human approval and the usual checks.
• The proposal is made in ZST Radio's private code repository (GitHub). The report's text and images are not included, only its identifier.

No decision about any person is made. Reports are not used to train models.

AI model. The repair environment uses Microsoft Azure AI Foundry (Azure OpenAI): an OpenAI GPT model (currently gpt-5.4-mini; a newer GPT model may replace it) on an EU Data Zone deployment. It is the same Microsoft service that quote drafting uses (7.3). Requests are processed within the EU data zone and data at rest stays in the resource's geography. Mondigo switches off Responses API state storage (store: false). The Microsoft Products and Services DPA applies. Microsoft does not use inputs to train foundation models, and OpenAI, the model's developer, has no access to them. Microsoft may temporarily store inputs and outputs to detect abuse, and authorised Microsoft staff may review flagged content; for a service deployed in the EEA those staff are in the EEA. The current contractual sources give no storage period, so we state none. For models before GPT-5.6 the provider's prompt cache cannot be switched off: the start of the processed input may stay in the provider's cache temporarily; according to Microsoft's documentation, typically for 5–10 minutes and at most 1 hour after its last use. For GPT-5.6 or later Mondigo switches the cache off in the request. The repair container can reach only this Azure endpoint and the public software package registry.

Linked product analytics (separate switch). This works only if all three conditions hold:

• product analytics (7.5) is active;
• the browser sends no Do Not Track or Global Privacy Control signal;
• this extra function is switched on.

Then the report records the reporter's existing pseudonymous analytics reference and the 15 minutes before the report. With these, the repair environment reads up to 200 events from the PostHog EU project: event names, timestamps, normalised page routes and allowlisted coded properties. It reads no free text. The AI model never receives the references. Nothing new is sent to PostHog: not the report's text, images or identifier.

Who sees it. The report is seen by ZST Radio Kft.'s developers and by the repair environment described above. The business owner sees a short, filtered summary and the status of the team's reports in the account.

Where it is stored. The report and the images are stored in Mondigo's database in the Microsoft Azure Warsaw region (section 7.1). The repair environment receives them only for the time of processing.

Retention.

• Images: 7 days after the case closes, and at most 30 days after submission.
• The filtered text and the case status: 12 months after the case closes, or earlier if you ask (info@zstradio.com).
• When the account is deleted, its reports and images are deleted too.
• Database backups follow section 10. The production database backups also contain the reports and the encrypted images; the images' encryption key is not in the backup.

7.11. Phone notifications (push)

If the function is active, a signed-in business owner or team member can switch on notifications from Mondigo to their phone or computer. Notifications are only switched on if you explicitly switch them on in the app and also approve the browser's permission prompt. They are optional: Mondigo is fully usable without them.

When you get a notification.

• the customer opened the quote;
• the customer accepted the quote;
• the customer asked for a change;
• a reminder the day before about the next day's job.

The notification reaches every device of the business on which someone switched it on.

Who delivers it. Mondigo does not deliver the notification to the device directly; the push service of the browser's maker does:

• Chrome and Android browsers: Google Firebase Cloud Messaging (Google);
• Safari, and on iPhone an app added to the home screen: Apple Push Notification service (Apple);
• Firefox: Mozilla's push service (Mozilla);
• Edge on Windows: Windows Push Notification Services (Microsoft).

Which service delivers is determined by your browser, not by Mondigo.

What the push service learns. The signal Mondigo sends has no content: no customer name, quote, address or amount. The push service only learns that a signal was sent to a given subscription at a given time, plus the technical delivery settings (how long it is valid, how urgent it is, and whether it may replace an earlier signal not yet delivered). After the signal, the device fetches the short notification text over Mondigo's own authenticated connection. That text contains only counts (for example “1 accepted quote is waiting to be scheduled”), never a customer name, address or amount. The notification may also appear on the device's lock screen.

What we store. When you switch notifications on, the browser creates a subscription. Mondigo's server stores the following from it:

• the subscription address issued by the push service (endpoint URL);
• the subscription's two technical keys (p256dh and auth); the device identifies itself with the auth key when it fetches the notification text;
• the identifiers of the business and of the user who switched it on, and the time it was switched on;
• a short device name (for example “Android telefon”, Android phone) so that devices can be told apart in the device list.

The subscription address identifies the browser within the push service; it contains no name, phone number or email address, and it is not shown in the app's interface. On the device, the browser stores the subscription and the language of the last notification shown. The subscription data is stored in Mondigo's database in the Microsoft Azure Warsaw region (section 7.1).

Switching off and deletion.

• If you switch notifications off in the app, the subscription is deleted immediately.
• If you withdraw the permission in the browser or phone settings, or remove the app, the push service reports at the next signal that the subscription has ended; it is then deleted automatically.
• When the account is deleted, all subscriptions are deleted.
• The production database backups also contain the subscriptions; backups expire as set out in section 10.

We do not use notifications for advertising or profiling, and subscription data is not sent to PostHog for product analytics.

7.12. Post-job customer rating

This section is mainly for the customers of businesses that use Mondigo. When the business marks a job as done in the app, Mondigo sends the customer a short rating request on behalf of the business. The rating is for the business; it is not published.

Who receives a request, and what it contains.

• The request is a single email to the customer email address given in the quote. We do not send reminders.
• The email contains the customer's name (as the greeting), the name of the job, the business's company name and a personal link to the rating form.
• If the request was not sent when the job was marked as done (for example because of a temporary error), the system retries every hour, for at most 60 days after the job was finished.
• We do not send a request if the quote has no email address, if an earlier email to the address could not be delivered permanently or the recipient marked it as unwanted, or if the request has already been sent or the customer has already answered.
• Requests are currently not sent by SMS, because SMS sending is not active (section 8).

The link. The link opens only the rating form for this one job and is valid for 60 days after the job was finished. It cannot be used to open, accept or change the quote. The form shows the name of the business (or its contact person) and the name of the job. Whoever has the link can fill in the form, so please do not forward it. One rating can be submitted per job; it cannot be changed after it is submitted.

What we record.

• whether you would recommend the business to others (yes or no);
• four ratings from 1 to 5 stars: communication, quality of the work, keeping to dates and deadlines, value for money;
• how the job turned out compared with the original quote (one of five answers) and, if something changed, whether the change and any extra cost were agreed with you in advance;
• an optional written comment of at most 2,000 characters;
• the times the request was sent, the link was first opened and the rating was submitted, the channel of the request (email) and the email's delivery data (section 7.2);
• data added by the system: the number of signed variations (extra work) recorded for the quote and the change in their amount, and from these an indication of whether the answer matches the recorded variations.

Please do not write health data or other special category data, or data about other people, into the comment.

Who sees it. The rating is seen in the Mondigo app by the business and the team members of its business account: on the job's page, as a to-do created from a negative answer (with a short quote from the comment and the option to call the customer), and in the business's own summary rating statistics. The rating does not appear on the quote page, to other businesses, on a marketplace or in a ranking, and we do not compare it with other businesses' ratings.

Where the data stays. The rating, including the written comment, stays in the Mondigo production database (Microsoft Azure, Warsaw, section 7.1). It is not passed to artificial intelligence, to the evidence store of section 7.7 or to product analytics. If product analytics is active (section 7.5), only pseudonymous process events reach PostHog: that the request was sent (and its channel), that the link was opened, that filling in started, that it was submitted, and that the business marked a negative answer as resolved. On submission, only whether there was a written comment is recorded. No star rating, answer, comment, name, email address or job name reaches PostHog. The request email is delivered by Amazon SES (section 7.2). No new processor is used for this.

Retention, erasure, export. We keep the rating together with the quote, that is, until the business account is deleted; it is deleted with the account and expires from backups as described in section 10. The rating is included in the business's account data export. If you want the rating corrected or erased, please turn to the business; Mondigo supports the business in handling the request (section 11).

7.13. Operator console (Control Center)

The operator of Mondigo, ZST Radio Kft., manages Mondigo accounts in an internal console that only it can access: invites, access and free periods, and it also provides customer support there. Only a designated person of ZST Radio Kft. — currently the company's owner — can access the console, with two-factor authentication. Every login and action is logged.

What the operator sees about an account.

• the account's email address, company name and trade, the registration date, and the time of the last login and the last activity;
• the number of quotes, drafts and sent quotes;
• the usage counters of the AI, dictation and photo functions (for example how many structurings, minutes of dictation and photos there were on a day);
• the access status: how many free sends have been used, whether there is a pilot or free period and until when, and the subscription status.

What it does not see. The operator console does not show the content of quotes, the text of items, the dictated note or the photos, nor the names, addresses or contact details of the business's customers.

Account- and user-level product analytics. If the function is active, the operator can also view the product analytics events (section 7.5) of a given account, or of a given user of the account (the owner or a team member): for example whether they reached the first sent quote, which functions they use, and where they ran into an error. For this, the Mondigo server links the pseudonymous events stored in PostHog EU to the account and the user, based on the pseudonymous reference of the account or the user. The user-level view also shows the user's email address and role (owner or team member). The view only uses the content-free properties on the closed list under section 7.5: event name, time, normalised page route, coded status and error values. Free text, customer data or quote content do not appear in this view either, because such data never reaches PostHog. Mondigo only displays the queried events and does not store them separately. Every account- and user-level view is logged.

We do not use the view to monitor users' work or evaluate their performance, for advertising or pricing, and we make no automated decision with it. We do not give a team member's user-level events to the account owner for performance evaluation either. (In the data export the owner does receive the account's change log, which includes the team members' changing actions; this is not product analytics, see section 7.18.)

Balancing test. The account- and user-level view is based on the legitimate interest of ZST Radio Kft. (GDPR Article 6(1)(f)): it lets us investigate where a specific account or user got stuck or hit an error, give targeted help, improve the product and detect abuse (for example circumventing the free allowances). Aggregate statistics are not enough for this, because they do not show where a given account or user got stuck. The user-level breakdown is needed because within an account the owner and a team member use different functions, and an error often appears for one user only. Users' interests are protected by the following:

• the events are content-free and pseudonymous;
• the link to an account or user happens only on the server, for one account or one user at a time, and only for the operator;
• every view is logged;
• the view does not serve to monitor work, evaluate performance or make automated decisions, and the account owner does not receive a team member's data for such purposes;
• the account and individual users can be excluded from the view at any time (below).

A user of a business software service can reasonably expect the provider to look at their usage data for customer support and troubleshooting. We therefore consider that, with these safeguards, the legitimate interest does not disproportionately affect users' interests.

Objection and exclusion. You can object to the account- and user-level product analytics view at any time at info@zstradio.com: the account owner for the whole account, and any user — including a team member — for themselves. We then exclude the account or the user from the view; their events then appear at most in aggregate statistics that cannot be broken down by account or user. A browser's Do Not Track or Global Privacy Control signal already excludes events sent from the browser (section 7.5), but it does not apply to events created on the server; the objection covers those.

Free period. The operator can grant an account a free access period, extend it or revoke it. We record the type, start, end, length and status of the period, and which operator action created it. The free period belongs to the account's access data: we keep it until the account is deleted, and it is included in the account data export.

Operator log. We log every login, view and action in the operator console, for example sending an invite, rejecting an invite request, granting a free period and opening the account- or user-level analytics view. The log contains technical identifiers only: the operator's identifier, the affected account's identifier and — for a user-level view — the affected user's identifier, the identifier of the invite, invite request or free period, and the type and time of the action. No email address, name or quote content.

The purpose of the log is that operator access can be checked afterwards, that abuse and incidents can be investigated, and that disputes about free periods can be settled. We therefore keep the log after the account is deleted too: the entry can then no longer be linked back to the account in Mondigo's live database and remains only as a pseudonymous trace. We delete entries 2 years after they were created.

Where the data stays. The operator console runs in Mondigo's existing application (Microsoft Azure, Warsaw, section 7.1); the account- and user-level analytics reads from the PostHog EU project (section 7.5). No new processor is used for this, and no new data is sent to PostHog.

7.14. Invite requests

While Mondigo is invite-only, you can request an invite on the Mondigo site. You must give your email address; your name or company name, trade, phone number and a short message are optional. We also record where the request came from (for example the home page), and how many times and when you requested an invite. A request creates no account and grants no access.

The operator decides on requests in the console under section 7.13: it sends an invite or rejects the request. We record the status of the request and the identifier of the related invite. The operator may receive a daily summary email about new requests. We send the invite by email (Amazon SES, section 7.2); if you also gave a phone number, we may call you about the invite. We do not send newsletters or advertising to the contact details given.

Retention.

• A request not yet decided: 12 months from the last request.
• A rejected request: 90 days from the rejection, so that we recognise a repeated request.
• A request turned into an invite: until the invite is redeemed or expires, and 90 days after that; when the account is deleted, the request's data is deleted too.
• You can ask for the request to be deleted at any time at info@zstradio.com; after deletion we cannot send an invite.
• The production database backups also contain the requests; backups expire as set out in section 10.

7.15. Protecting registration without an invite

If Mondigo allows registration without an invite (open registration), the protections below can be activated one by one, each with its own switch. Points a) to c) do not apply to registration with an invite, because the invite is bound to an email address; the bot check may also run on the invite request form (section 7.14).

a) Confirming the email address. When you register without an invite, we email you (Amazon SES, section 7.2) a confirmation link and, where the screen asks for it, a 6-digit code. We store the link and the code only as a hash; they expire after 48 hours and can be used only once. At most 3 confirmation emails can be requested per hour. Until the address is confirmed, you can prepare and dictate quotes in the account, but you cannot send a quote to a customer. We record the time of the confirmation with the account data. We keep the confirmation record (the hash, the email address, and the times of sending, expiry and use) until the account is deleted. An account created with an invite counts as confirmed.

b) Bot check — Cloudflare Turnstile. On registration without an invite, when a trial without an invite is started and on the invite request form, the browser runs the Cloudflare Turnstile check so that we can filter out automated submissions. For this, Cloudflare processes the visitor's IP address, technical characteristics and signals of the browser and the device, and the check's token; Mondigo's server sends the token and the visitor's IP address to Cloudflare to verify the result. Mondigo does not store the result of the check, and the Cloudflare script is loaded only if the function is active. If the check is not available, registration or the invite request is temporarily not possible. For this function Cloudflare, Inc. (United States) acts as a processor. Its network is global, so the data may also reach the United States and other countries outside the EEA. Cloudflare, Inc. is certified under the EU–U.S. Data Privacy Framework, so the European Commission's adequacy decision for it applies to the transfer to the United States; Cloudflare's data processing terms also include the European Commission's standard contractual clauses (SCC). Retention on Cloudflare's side follows Cloudflare's data processing terms.

c) Mass registration and disposable email addresses. We count registrations and trials without an invite per hour, per IP address and in total; above the configured limit, registration is not possible for up to an hour. For this we store the IP address only as a keyed hash (HMAC-SHA-256 with the server's secret key), never the raw IP address. The hash is pseudonymous: with the key it can be recomputed for a known IP address. We delete the hourly counters after 48 hours, at the next counted registration. The production database backups may also contain the counters; backups expire as set out in section 10. You cannot register without an invite with a disposable (temporary) email address: we compare the address's domain with a list of such services, and we do not store a refused address.

d) Daily limits for new accounts. In the first 7 days of an account, while there is no subscription or active free period, the daily limits for dictation, AI structuring and the photo function are lower. For this we use the time the account was created, the access status and the existing daily usage counters (section 7.13); we collect no new data. The limit is the same rule for everyone, not an individual assessment.

If a protection wrongly blocks your registration or invite request, write to info@zstradio.com; a member of our staff will look at the request.

7.16. Szokásos munkák: recognition in the note and change suggestions

A “Szokásos munka” (usual job) is a saved list of items for a recurring job (for example “Konnektor csere”, socket replacement) that the business can insert into a quote. Each of the two functions below can be activated separately, with its own switch. Neither uses AI or a new processor, and both work exclusively within that business's account.

Recognition by name. If the dictated or typed note contains, word for word, the name of a saved Szokásos munka or a nickname the business gave it, Mondigo's server recognises this by a fixed rule, before the AI processing, and inserts the items of that Szokásos munka into the quote draft. It compares the note only with the names and nicknames of that business's own Szokásos munkák. If more than one Szokásos munka matches, it inserts none of them and the business chooses. The AI model receives the same note as without this function; the items of the Szokásos munka are not sent to it. The business checks the inserted items before sending and can change them. The nickname is stored with the Szokásos munka; please do not give a Szokásos munka or a nickname a person's name or an address. For the quote we record which version of which Szokásos munka went into it, how (spoken name, nickname or tap) and with what multiplier; the evidence record of section 7.7 may also contain the inserted Szokásos munka as part of the result shown.

Change suggestions from sent quotes. If the function is active, when a quote is sent Mondigo records how the Szokásos munkák used in it appeared. For this it stores the item list of the Szokásos munka at that time, the description, unit and quantity of the items of the sent quote (at most 200 items; without travel items, materials supplied by the customer and items generated by the system), the time of sending and how the Szokásos munka was inserted. This record does not contain the prices of the sent quote or the customer's name, address or contact details, but the system does not filter personal data out of item descriptions here, so do not write customer data into an item description.

If the business consistently enters a different quantity for an item of a Szokásos munka in its most recent (at most 20) quotes sent with the current version of that Szokásos munka — in at least two of at least three uses — Mondigo may suggest changing the default quantity, or making the item's quantity vary per quote. Only the account owner sees the suggestion. The Szokásos munka changes only if the owner explicitly accepts the suggestion; a rejected suggestion is not repeated. We record the decision (the Szokásos munka's identifier and version, a technical key without description, accepted or rejected, the time and the user who decided). The suggestion does not change the sent quote.

Retention, deletion, export. The usage data and the decisions are kept until the account is deleted; when a draft is deleted, the usage data recorded for it is deleted too. The business cannot delete a sent quote; the usage data recorded for it is deleted when the account is deleted or when a data subject's erasure request is fulfilled. They expire from backups as set out in section 10. The data is included in the account data export. Its content does not reach an AI model, another business or product analytics (only content-free counts may go there, section 7.5), and we do not use it to train models.

7.17. Cookies and keeping you signed in

Mondigo only uses cookies that are strictly necessary for the service to work, so no consent is asked for them (section 155(4) of Hungarian Act C of 2003 on electronic communications). We use no advertising, tracking or analytics cookies: product analytics (section 7.5) works without cookies, and Session Replay (section 7.6) uses neither cookies nor the browser's local storage.

• __Host-mondigo_session — the session of a user signed in to the professional app: it keeps you signed in after the browser or the installed app is closed. It holds a signed session token: the internal user and account id, a random session id, the sign-in, issue and expiry times, and the time of the last password confirmation. It never holds your password, e-mail address or customer data. The cookie is HttpOnly (no script on the page can read it), Secure (the browser only sends it over an encrypted connection), SameSite=Lax, and the browser only sends it to Mondigo's own address. It expires after 30 days without use; while you use the app the server renews it, but 90 days after sign-in you always sign in again. Signing out ends the session at once, even if a copy of the token was made. In Settings you can sign out on every device at once; after a password change you sign in again on every device too. Before some risky actions (for example changing the bank account number or the invoicing keys, or the full data export) the app asks for your password again.
• qq_invite_resume — only for people arriving with an invite: it reopens the invite's trial workspace on the same device. It only holds the invite's signed internal id; HttpOnly, Secure, SameSite=Lax. It is valid until the invite expires at the latest, and stops working once the invite is redeemed or revoked, or when you sign out.
• __Host-mondigo_control — only for signing in to the operator console (section 7.13), in the operator's browser; HttpOnly, Secure, SameSite=Strict; it expires after 30 minutes of inactivity and after 8 hours at the latest. It is not valid in the professional app, and neither sign-in can stand in for the other.

The landing page and the public quote link (section 9) set no cookies; the business's customer receives no cookie from Mondigo.

In the browser's local storage (localStorage, sessionStorage) the app only keeps data it needs to work, for example the language setting, a draft not yet saved and the profile data needed to open the app offline; the latter is deleted when you sign out. Local storage holds no sign-in token: a token stored there earlier is exchanged once for the cookie and then deleted.

Signed-out sessions. So that the token of a revoked session cannot be used again, when you sign out the server stores the session id, the user id and the session's expiry time. The entry is used until the session would have expired, at most 90 days after sign-in; expired entries are deleted automatically every hour, and the account's entries are also deleted when the account is deleted. The time of a sign-out on every device and of a password change is stored with the user account.

Legal basis. Here ZST Radio Kft. acts as an independent controller. Keeping you signed in and signing you out is necessary for performing the Mondigo service contract (Article 6(1)(b) GDPR); blocking revoked sessions and asking for the password again rest on our legitimate interest in the security of the accounts (Article 6(1)(f) GDPR).

7.18. Log of changes made in the account

For every account Mondigo keeps a log of who made which changing action in the account and when, and when the account's data was downloaded: for example creating, editing, sending or deleting a quote, changing a photo, the price list, a Szokásos munka, a template or a setting, issuing an invoice, inviting or deactivating a team member, a password change, a data export, and the operator's two technical actions (creating the account and switching on the photo AI feature). Actions taken in the operator console (Control Center) are not recorded in this log but in the operator log described in section 7.13. Creating the account (registration) also gets an entry. An entry is only made for a successful action; when one request performs several actions, each gets its own entry. The log's entries cannot be changed afterwards.

What we record. Only ids and the name of the action: the internal id of the account and of the user who acted (without a user id for operator actions and at registration), the kind of actor (owner, team member, a user acting on their own account without being signed in — for example at registration or a password reset — or the operator), the name and time of the action, and the type and internal id of the item concerned (for example a quote). We record no e-mail address, name, phone number, IP address, browser data, dictated or free text, quote content, and no value before or after the change. The entry remains after the item concerned (for example a quote) is deleted, with its internal id only.

Purpose and legal basis. Making the changes in the account traceable and accountable, for example to investigate a security incident, unauthorised access or a disputed change. Here ZST Radio Kft. acts as an independent controller, on the basis of its legitimate interest in the security of the service and the accountability of the actions taken in the account (Article 6(1)(f) GDPR); you can object to this as described in section 11. The log is not shown in the app and does not go to product analytics or to an AI model. The operator does not see the entries in the Control Center, only a count of how often an entry could not be recorded.

Retention, deletion, export. The log is kept until the account is deleted; when the account is deleted the log is deleted too, and it expires from backups as described in section 10. A deactivated team member's earlier entries remain until the account is deleted; entries cannot be deleted one by one. If the account moves to another Mondigo environment, the log moves with it. In the data export the account owner receives the account's whole log, and a team member only the entries of their own actions. The owner therefore also sees the team members' changing actions (who, when, on which item), but not their content, and not the team members' product analytics events (section 7.13). We provide the log for checking changes in the account; it should not be used to monitor work or evaluate performance.

7.19. Service emails when the account starts

If the function is active, Mondigo sends at most three service emails to the account owner's login email address, each at most once: (a) after the registration, or after saving the account following a trial, a welcome email on how to make the first quote; (b) if no quote has been sent 24 hours after the registration, a help email (“Elakadtál az első ajánlatnál?” / Stuck on your first quote?); (c) when the free sends are used up, factual information on the terms for going on: the subscription fee, that it can be cancelled at any time, and that drafts stay free. The emails relate to the use of the account and the terms of the contract; they contain no advertising, promotion or news.

What we use. The owner's email address and the account's language, the time of registration, whether a quote has already been sent from the account, the number and times of the sent quotes, and the access status (subscription or free period). The emails go through Amazon SES (section 7.2). We record which email we sent, when and with what result, so that none goes out twice; delivery data is logged as for every other email. We do not send such an email to an address that has earlier marked our email as unsolicited or bounced permanently, and while confirming the email address is required (section 7.15), only to a confirmed address. We look for a due email only in the 7 days after the registration or after the latest quote sent.

Legal basis. For this, ZST Radio Kft. is an independent controller and acts in performance of the Mondigo service contract (GDPR Article 6(1)(b)): the emails serve to get the account started and to communicate the terms of the contract (the free allowance and going on). As these are one-time service emails, they contain no unsubscribe link; if you would rather not receive them, write to info@zstradio.com and we block the emails not yet sent for your account.

Retention, export. The record of the sending (the kind, status and time of the email) and the delivery log are kept until the account is deleted; they are included in the data export and are deleted when the account is deleted.

7.20. Tips, news and offers by email (marketing consent)

At registration, or when saving the account after a trial, you can ask with a separate checkbox, unticked by default, for Mondigo to send you tips, news and offers by email: “Kérek a Mondigótól tippeket, újdonságokat és ajánlatokat e-mailben. Bármikor leiratkozhatok.” (I would like tips, news and offers from Mondigo by e-mail. I can unsubscribe at any time.) The consent is voluntary, independent of accepting the Terms and this notice, and you can use Mondigo fully without it. Later you can also give or withdraw it under Settings › Your data and privacy.

Register. As required by section 6(5) of the Grt., we keep a register of consents: for each user, every grant and withdrawal is recorded as a separate entry, with the time of the entry, the id of the version and the language of the consent text shown, its source (registration, account saving, settings or unsubscribe link) and the email address the consent applies to. The entries cannot be changed afterwards; the current state of the consent is the latest entry.

Withdrawal. You can withdraw your consent at any time, without giving reasons and free of charge: with the switch in Settings, with the unsubscribe link at the bottom of such emails (one button on the page that opens), or at info@zstradio.com. Withdrawal does not affect the lawfulness of earlier emails based on the consent. After withdrawal we send no such emails; you still receive the service emails of your account (for example a password reset and the emails under section 7.19).

Legal basis and retention. The legal basis for sending the emails is your consent (GDPR Article 6(1)(a), Grt. section 6(1)); keeping the register is a legal obligation (GDPR Article 6(1)(c), Grt. section 6(5)) and also serves as proof of the consent. The register is kept until the account is deleted; after a withdrawal, the entries are used only to prove the consent and its withdrawal. It is included in the data export and is deleted when the account is deleted. The emails go through Amazon SES (section 7.2); there is no new processor, and the data is not passed to third parties. With this version only the collection and registration of the consent starts: Mondigo does not send such emails at present.

8. Processors and optional providers

Push services (section 7.11). Phone notifications are delivered by the push service of the browser's maker: Google (Firebase Cloud Messaging), Apple (Apple Push Notification service), Mozilla (Mozilla's push service) or Microsoft (Windows Push Notification Services). Mondigo does not choose them, and they do not work on Mondigo's behalf: they are delivery services that are part of the user's browser and operate under their own terms. They are therefore not processors and are not listed in the table above. Mondigo only sends them a signal without content. These providers may also process data in the United States; where a provider is certified under the EU–U.S. Data Privacy Framework, the European Commission's adequacy decision for it applies, otherwise the provider's own transfer safeguards apply. Their processing related to the browser is explained in the privacy notice of the browser's maker.

Session Replay is active as described in section 7.6. The post-job customer rating (including its written comment, section 7.12) can be activated with a separate switch. Reading earlier quotes from a PDF or image (section 7.8) and the two Szokásos munka functions (section 7.16) can also be activated with separate switches; none of them engages a new processor. The service emails under section 7.19 can be activated with a separate switch; the service emails and the emails under section 7.20 go through the already listed Amazon SES and engage no new processor. Still not active by default: Twilio SMS, live invoicing through Számlázz.hu/Billingo, the direct Anthropic API, and the registration protections of section 7.15, including the Cloudflare Turnstile bot check.

9. Public quote link

The business's customer can open the quote with a unique, public quote link. Holding the link gives access to the customer page that belongs to it, so it must be kept confidential and must not be shared publicly. The system may record the opening and decision events related to the quote. If the quote has photos, the link also shows the visible photos approved by the business (section 6); the photos are not cached, indexed by search engines or passed on in the referrer header.

10. How long do we keep the data?

• Mondigo account and profile: while the service exists; after termination, with a technical closing period of at most 30 days, except where retention is legally required.
• Customer, job and quote data: until the business deletes it or the service ends; after termination, deletion from the live system within at most 30 days, except under a legal hold or mandatory retention.
• On-device recovery audio copy: deleted immediately after a successful transcription; after a failure that can be retried, usable for at most 48 hours and then cleaned up the next time the application is used.
• Deepgram transcription request: request data excluded from the Model Improvement Program (mip_opt_out=true) may be processed for the period needed to process the request, as set out in Deepgram's documentation.
• Security and access logs: 90 days, except during an active incident or a documented legal claim.
• Session cookie (__Host-mondigo_session): in the browser; expires after 30 days without use, valid for at most 90 days from sign-in, deleted when you sign out (section 7.17).
• Identifiers of signed-out sessions: until the session would have expired, at most 90 days from sign-in; expired entries are deleted automatically every hour and when the account is deleted (section 7.17).
• Log of changes made in the account: until the account is deleted; deleted with the account; not one of the 90-day security and access logs (section 7.18).
• Support and pilot communication: 12 months from closure, except in case of a legal claim.
• Bug report images: 7 days after the case closes, at most 30 days from submission (section 7.10).
• Filtered text and status of a bug report: 12 months from the closure of the case (section 7.10).
• Phone notification subscription (push): until switched off; deleted automatically when the push service reports that the subscription has ended, and when the account is deleted (section 7.11).
• Post-job customer rating (including the written comment): together with the quote, that is, until the business account is deleted (section 7.12).
• Operator log (section 7.13): 2 years from the creation of the entry; after the account is deleted it remains as a pseudonymous trace until the end of the 2 years.
• Free period granted by the operator and the account's usage counters (section 7.13): until the account is deleted.
• Account- and user-level product analytics view (section 7.13): Mondigo does not store the queried events separately; the retention of the events follows the PostHog product analytics rule.
• Invite request, not yet decided (section 7.14): 12 months from the last request.
• Invite request, rejected or turned into an invite (section 7.14): if rejected, 90 days from the rejection; if an invite was sent, 90 days from the redemption or expiry of the invite, and earlier when the account is deleted.
• Time the email address was confirmed (section 7.15): until the account is deleted.
• Marketing source on the account (section 7.5): until the account is deleted, or until an objection is fulfilled; for the PostHog events, the PostHog product analytics rule applies.
• Record of the service emails sent (section 7.19): until the account is deleted; deleted when the account is deleted.
• Register of marketing consents (section 7.20): until the account is deleted; after a withdrawal only to prove the consent and its withdrawal; deleted when the account is deleted.
• Confirmation link or code (section 7.15): valid for 48 hours; the record with the hash, the address and the times is kept until the account is deleted.
• Registration counters with a keyed IP hash (section 7.15): deleted after 48 hours, at the next counted registration.
• Cloudflare Turnstile bot check (section 7.15): Mondigo does not store the result; retention on Cloudflare's side follows Cloudflare's data processing terms.
• On-site photos: together with the quote, until it is deleted; a draft that contains only photos is deleted 14 days after its last change; a deleted image file can be restored from the store for at most 90 more days (section 6).
• Decision Fabric decision log (formerly the decision-model shadow log): until the related tenant is deleted.
• Quality-assurance evidence record (production database and Azure Evidence Store): 90 days from recording, longer only under a documented legal hold or during an active incident; a copy deleted from the storage can be restored for at most 7 more days (about 98 days in total at most); production backups do not contain it. Deleted earlier with the tenant or the quote, or when a data subject's erasure request is fulfilled (section 7.7).
• Item rows of loaded earlier quotes (from a spreadsheet, PDF or image): at most 90 days from loading, or until the import round or the account is deleted, if earlier; the production backups do not contain these item rows. We do not store the uploaded file or the model's raw answer (section 7.8).
• The business's confirmation for loading: until the account is deleted (section 7.8).
• Decision on a Szokásos munka offer (technical key without description): until the account is deleted (section 7.8).
• Use of Szokásos munkák in quotes and decisions on change suggestions: until the account is deleted; when a draft is deleted, the usage data recorded for it is deleted too (section 7.16).
• The business's pricing patterns, offer and price-suggestion data: until the account is deleted; if an underlying quote is deleted, its evidence is deleted and the pattern recalculated (section 7.9).
• PostHog product analytics, if active: the documented product-event retention of paid PostHog Cloud is 7 years; a shorter Cloud retention cannot be set.
• PostHog Session Replay: 30 days.
• Backups: current backup copies 90 days; earlier versions 7 days; expired copies can then still be restored during a deletion-protection period of at most 30 days.

Deletion from the live system does not necessarily mean the immediate, individual deletion of the data from every earlier backup. Backups expire at the end of their life cycle. In case of a restore, deletions completed earlier must be applied again before the data is put back into active use.

11. Data subject rights

Under the applicable GDPR you may in particular be entitled to request information and access, to request rectification, erasure or restriction, to object to processing based on legitimate interest, to request your data in a portable format, to withdraw your consent, and to turn to a supervisory authority or a court.

For matters concerning a Mondigo account: info@zstradio.com.

How to object to the account- and user-level product analytics view, which is based on legitimate interest, is set out in section 7.13.

How to object to the recording of the marketing source (section 7.5) is set out in section 7.5, and the ways to withdraw the marketing consent in section 7.20.

If your request concerns a Mondigo user's own processing of customer, job or quote data — including the post-job rating (section 7.12) — please turn first to the business. Mondigo supports the business according to the roles.

12. Complaints and remedies

You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Under the applicable law you may also seek a judicial remedy.

13. Personal data breaches

ZST Radio Kft. maintains a documented incident handling process. If Mondigo, as a processor, becomes aware of a personal data breach affecting a business's data, it notifies the business without undue delay and supports it in the necessary investigation and notification decisions.

14. Changes to this notice

A new version is prepared for each substantive change. If a change significantly affects the processing of the data of businesses or their customers — for example because of a new provider, a new purpose, a new international transfer or a new optional function — we communicate the change appropriately before it takes effect.

15. Entry into force

Version mondigo-privacy-2026-10-25-v3.9-marketing supplements v3.8 in three respects. (1) Where the account came from (sections 2.1, 3, 4, 7.5, 10 and 11): recording the campaign tags of a campaign or referral link, the landing page's sample trade and the referral code on the account and on the registration product analytics event, without browser storage and without click ids, on the basis of legitimate interest, with the right to object. (2) Service emails when the account starts (sections 2.1, 3, 4, 7.19, 8 and 10): the welcome email, the one-time help email and the factual information that the free sends are used up, as performance of the contract. (3) Marketing consent (sections 2.1, 3, 4, 7.20, 10 and 11): the separate checkbox, unticked by default, the register of consents, the ways to withdraw and the retention; Mondigo does not yet send marketing emails with this version. The marketing source and the service emails take effect after this version is published, each with a separate switch. No new processor is engaged. Its other parts are unchanged.

Version mondigo-privacy-2026-10-25-v3.8-session-audit supplements v3.7 in two respects. (1) Cookies and keeping you signed in (sections 2.1, 3, 7.17 and 10): the HttpOnly session cookie that keeps you signed in after the browser or the installed app is closed and its content, the 30-day idle and 90-day absolute expiry, renewal, signing out and signing out on every device, the retention of the identifiers of signed-out sessions, the cookies of the invited trial workspace and of the operator console, and the browser's local storage. Every cookie is strictly necessary for the service to work, so no consent is asked. Keeping the sign-in in a cookie takes effect with a separate software release after this version is published. (2) The log of changes made in the account (sections 2.1, 3, 7.18 and 10): the ids and action names recorded, what is not recorded, the purpose and legal basis, retention until the account is deleted, and the export; it starts with a separate software release after this version is published. No new processor is added. Its other parts are unchanged.

Version mondigo-privacy-2026-10-25-v3.7-packages-documents supplements v3.6 in two respects. (1) Loading earlier quotes from a PDF or photo (sections 2.2, 3, 5, 7.8, 8 and 10): the document is read by the Microsoft Azure AI Foundry EU Data Zone AI model already in use; what the model receives, how a photo is prepared, that we do not store the file or the model's raw answer, the item data stored and its 90-day retention, and the business's duty to remove personal data. The “not available at the moment” paragraph is removed. (2) Szokásos munkák (sections 2.2, 3, 7.16, 8 and 10): recognising a saved Szokásos munka in the note by its name or nickname, without AI, and the change suggestion formed from sent quotes that takes effect only when the owner accepts it, the data recorded, retention and export. The functions can be activated with a separate switch after this version is published. No new processor is engaged; an earlier quote uploaded as a PDF or image reaches the AI model as a new input. Its other parts are unchanged.

Version mondigo-privacy-2026-10-22-v3.6-rating-prefill supplements v3.5 with the description of two functions. (1) The post-job customer rating (sections 2.2, 3, 4, 7.1, 7.12, 8, 10 and 11): who receives a rating request and when, the personal link valid for 60 days, one answer per job, the data recorded, who sees the rating, that the written comment stays in the production database and does not reach product analytics, the roles and the retention. (2) The price suggestion formed from the business's own earlier quotes (sections 3, 7.9 and 10): when and from what pattern Mondigo may suggest a price, how the suggestion is labelled and must be confirmed, the order of precedence, the holding back and switching off, and the data recorded about suggestions. Both functions can be activated with a separate switch after this version is published. No new processor or artificial intelligence model is engaged, and the kinds of personal data transferred to third parties do not expand. Its other parts are unchanged.

Version mondigo-privacy-2026-10-22-v3.5-admin supplements v3.4 with the description of the operator console (Control Center), of invite requests and of the protection of registration without an invite (sections 2.1, 2.3, 3, 4, 7.5, 7.13, 7.14, 7.15, 8, 10 and 11): what the operator sees about an account and what it does not, the product analytics view linked to an account and user, its balancing test and the right to object, free periods granted by the operator, the operator log and its 2-year retention, the handling and retention of invite requests, and the confirmation of the email address, the Cloudflare Turnstile bot check, the protection against mass registration and the daily limits for new accounts. Cloudflare, Inc. is engaged as a new processor, only for the bot check of section 7.15 and only if that function is active; the data of the businesses' customers does not reach it. The protections of section 7.15 can be activated with separate switches. The account- and user-level product analytics view can be activated with a separate switch after this version is published, following prior notice to users and no earlier than 14 days after that notice. Its other parts are unchanged.

Version mondigo-privacy-2026-10-15-v3.4-photos supplements v3.3 with the description of on-site photos (sections 2.1, 2.2, 3, 5, 6, 7.1, 8, 9 and 10): uploading and the blurring of faces, encrypted storage in Microsoft Azure's Warsaw region, the photos visible to the customer and the approval before sending, the limited role of AI, retention (a draft with only photos is deleted after 14 days, and the store can restore files for 90 days) and export. No new processor is engaged: Microsoft (Azure) is already listed in v3.3. Its other parts are unchanged.

Version mondigo-privacy-2026-10-10-v3.3-push supplements v3.2 with the description of phone notifications (push) (sections 2.1, 3, 4, 7.1, 7.11, 8 and 10): how they are switched on, the events that trigger them, the push services of the browser makers (Google, Apple, Mozilla, Microsoft), the signal without content, the subscription data stored and its deletion. No new processor is engaged: the push services are not processors (section 8), and the data of the business's customers does not reach them. In addition, the Amazon Bedrock AI route ends (sections 5, 7.3, 7.10 and 8): AI processing takes place only on the Microsoft Azure AI Foundry EU Data Zone route, and Amazon Bedrock is not a processor. Amazon Web Services remains a processor for the Amazon SES transactional email service (section 7.2). Its other parts are unchanged.

Version mondigo-privacy-2026-10-09-v3.2-feedback supplements v3.1 with the description of bug reports sent from the app (sections 2.1, 3, 4, 7.1, 7.10, 8 and 10): the data collected, filtering and image masking, the Oracle Cloud Infrastructure repair environment in Madrid, the Microsoft Azure AI Foundry EU Data Zone AI model, retention, and the product-analytics link that works with a separate switch. No new processor is engaged: Oracle Cloud Infrastructure and Microsoft (Azure) are already listed in v3.1. Its other parts are unchanged.

Version mondigo-privacy-2026-10-04-v3.1 supplements v3.0 with the rules for loading earlier quotes from a CSV/XLSX file (section 7.8) and with forming pricing patterns within the business's own account and saving own prices (section 7.9). Sections 2.2, 3 and 10 change accordingly. No new processor is engaged, and the kinds of personal data transferred to third parties do not expand.

Version mondigo-privacy-2026-10-01-v3.0 amends version mondigo-privacy-2026-09-29-v2.9-decision-model in three respects: (1) the TypeSafe Jev decision model (Decision Fabric) moves from the measurement-only shadow phase to a guarded policy: proposals for price-to-line binding and line support can affect the draft under strict deterministic conditions, otherwise the line is flagged “ellenőrizendő” (to be checked); no amount changes, no line is deleted automatically, and the kinds of data transferred do not expand (sections 3, 4, 5, 7.3, 8 and 10); (2) per-quote quality-assurance evidence is recorded in production in the production database and the Azure Evidence Store (EU, Poland Central), without the end customer's structured contact details, with a retention of 90 days and with deletion, access and exclusion options (sections 3, 4, 7.7, 8 and 10); (3) Session Replay is active (sections 3, 7.6, 8 and 10). In production, the operation described in (1) and (2) can be activated by a separate software release or switch after this version is published. Its other parts are unchanged.

Version mondigo-privacy-2026-09-29-v2.9-decision-model supplemented version mondigo-privacy-2026-09-27-v2.8-azure-ai-route with the measurement-only shadow data flow of the TypeSafe AI, Inc. decision model, its hosting in the United States, the transfer under SCC Module 3 and the retention of Mondigo's shadow log until the tenant is deleted; its other parts are unchanged.

Version mondigo-privacy-2026-09-27-v2.8-azure-ai-route neutralises the wording of version mondigo-privacy-2026-09-27-v2.7-azure-hosting about the AI routes (it names neither of the two EU AI routes as the default, because the active route is selected by the production configuration), and in section 7.3 discloses the in-memory prompt cache of the Microsoft Azure AI Foundry route; its other parts are unchanged.

Version mondigo-privacy-2026-09-27-v2.7-azure-hosting updates version mondigo-privacy-2026-09-26-v2.6-azure-ai-alternative with the move of hosting to Microsoft Azure (section 7.1, section 8, backup retention) and the disclosure of the Oracle Cloud Infrastructure repair environment for bug reports; its other parts are unchanged.

Version mondigo-privacy-2026-09-26-v2.6-azure-ai-alternative supplements version mondigo-privacy-2026-09-26-v2.5-session-replay-pilot with the disclosure of the alternative Microsoft Azure AI Foundry AI route; its other parts, including those concerning Session Replay, are unchanged. The parts concerning Session Replay only apply once the separate legal/data protection approval and the technical activation conditions are met.