FAQ

PRIVACY POLICY

KönyvAtlasz / BookAtlas

Effective: 19 April 2026.

1. Details of the data controller

Data controller: Somogyi Gyula
Registered office: 16 Lágymányosi utca, Budapest 1117, Hungary

Registration number: 59888273

Contact e-mail address: feedback@bookatlas.app
Public URL of the application: https://app.bookatlas.app

If the data controller appoints a data protection officer, the contact details of that officer will be published in this notice. Currently, no separate data protection officer has been appointed.

2. Purpose and scope of this notice

The purpose of this notice is to explain, in a transparent, concise, easily accessible and clear manner, what personal data KönyvAtlasz processes, for what purposes, on what legal basis, for how long, to whom such data may be disclosed, and what rights data subjects have.

This notice applies to processing operations related to the KönyvAtlasz web application, registration, login, library features, image uploads, scanning, AI-based recognition, book metadata searches, payments, invoicing, CRM processes, marketing communications, analytics, the use of cookies and similar technologies, as well as security and abuse-prevention processes. Based on the technical summary, the application consists of a Vite + React client and a Supabase-based backend, and uses several integrations, including Gemini, Stripe, Billingo, GoHighLevel, PostHog, Turnstile and book metadata search code.

3. Main legislation governing data processing

The data processing activities of KönyvAtlasz are primarily governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), as well as Act CXII of 2011 of Hungary (the “Infotv.”).

4. Principles of data processing

KönyvAtlasz processes personal data lawfully, fairly and transparently; collects such data only for specified, explicit and lawful purposes; processes only data that are necessary for those purposes; seeks to keep them accurate; does not retain them longer than necessary; and protects them through appropriate technical and organisational measures.

5. Legal bases for data processing

The data processing activities of KönyvAtlasz may rely on the following legal bases: the data subject’s consent; performance of a contract with the data subject or taking steps at the data subject’s request prior to entering into a contract; compliance with a legal obligation applicable to the data controller; and the legitimate interests of the data controller or of a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

6. Detailed description of the processing activities

6.1. Registration, login and authentication

KönyvAtlasz processes your e-mail address, authentication data related to your password, the name you provide, as well as technical data related to the session and authentication. In the case of Google sign-in, profile data received from the login provider may also be processed. The purpose of the processing is account creation, login, identification, account security and the provision of the service. The legal basis is the performance of a contract. Providing the data is necessary; without them, the account cannot be created and the service cannot be used.

6.2. Profile data and user account

KönyvAtlasz processes the data you provide in your profile, or that the system stores for the operation of the service, including in particular name fields, user identifiers, credit and Pro status, marketing settings, and identifiers and timestamps related to CRM synchronisation. The purpose is account management, personalised operation of the service, keeping records of entitlements, and service administration. The legal basis is mainly the performance of a contract and, in certain administrative and security cases, legitimate interest.

6.3. Library management, reading log and lending features

KönyvAtlasz processes the records stored in your library, book titles and other book metadata, reading log data, read sessions, lending records, quotations, notes, ratings and other content recorded by you. The purpose is to operate the core features of the service: building and organising your library, searching, tracking reading and managing lending. The legal basis is the performance of a contract. The source of the data is typically you, while certain metadata may originate from an external book source.

6.4. Image uploads, cover images and temporary image processing

KönyvAtlasz processes the images and cover images you upload, together with related technical data. Images may be stored partly as saved covers and partly as temporary processing files. The purpose is to provide the scanning function, cover recognition, book identification and visual management of your library. The legal basis is the performance of a contract. Saved images form part of your library; permanently retaining images uploaded solely for processing purposes and not saved is not an objective, but temporary technical storage may be necessary for the operation of the feature.

6.5. AI-based image and text processing (Google Gemini API)

For scanning and recognition functions, KönyvAtlasz may transmit images and related text data to the Google Gemini API through a server-side proxy. According to the technical documentation, the client does not call Google directly; the API key remains on the server side, and the permitted tasks include shelf analysis, book identification, cover recognition and ISBN extraction. The purpose is to provide the AI features used by the user. Providing the data is necessary for these features; if you do not upload the image, the feature cannot be used. KönyvAtlasz does not use your uploads to train its own AI models.

6.6. Book metadata search, ISBN and external book databases

As part of the book metadata search feature, KönyvAtlasz processes the ISBN, search parameters and related query data, and may transmit them to an external book database provider. The processing of book metadata is not Gemini-based; it operates through separate external API connections. Based on the user’s indication, the ISBNDB API connection is active. The purpose is to retrieve, verify and supplement bibliographic and other metadata of books.

6.7. Payment, subscription, credits and invoicing

KönyvAtlasz processes transaction identifiers, payment status, data relating to purchased packages and credits, Stripe session metadata, and the data required for issuing invoices. Payments are made through Stripe Checkout, and KönyvAtlasz does not store bank card details. The Stripe webhook verifies the signature and ensures that credits and Pro entitlements are credited; the Billingo integration is connected to the webhook. The purpose is to process payments, manage entitlements, issue invoices and comply with accounting and tax obligations. The legal basis is the performance of a contract and compliance with a legal obligation.

6.8. CRM and customer relationship management (GoHighLevel / LeadConnector)

KönyvAtlasz uses the GoHighLevel / LeadConnector service as its CRM system. In this context, the e-mail address, name, the fact of marketing consent, subscription or package status, and certain tags and synchronisation data may be processed. The purpose is customer relationship management, administration, communications related to the service, and keeping records of marketing consents. The legal basis is the performance of a contract and, where applicable, legitimate interest or consent. Processing may also take place in the United States, among other locations.

6.9. Marketing communications

KönyvAtlasz processes the e-mail address, name, the fact and date of marketing consent and, where applicable, the related policy version. The purpose is to send newsletters, promotional e-mails and other marketing communications relating to KönyvAtlasz. The legal basis is the data subject’s consent. Consent may be withdrawn at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

6.10. Product analytics and usage events (PostHog)

KönyvAtlasz may use the PostHog service to measure product analytics events. PostHog is activated only if the user accepts the relevant cookie setting. Such events may include, for example, login, registration, starting a book scan, adding a book, exporting, or other usage events. The purpose is to analyse product usage, identify errors, improve stability and enhance the user experience. The legal basis is consent. If you do not consent, this analytics layer will not start, but the core service will remain usable. The PostHog host may be configured in the EU or the US.

6.11. Security and abuse-prevention processing (Cloudflare Turnstile)

KönyvAtlasz uses Cloudflare Turnstile as an active bot-protection solution. In this context, the system may process technical data necessary for the request, the device, the browser and the security assessment of the connection for the purpose of filtering out bots, automated abuse and unauthorised access attempts. The legal basis is the legitimate interest of the data controller, since processing that is necessary and proportionate to ensure network and information security may be based on legitimate interest under the GDPR framework.

6.12. Contact, customer support and handling of legal claims

If you contact the operator of KönyvAtlasz by e-mail or otherwise, KönyvAtlasz processes the identification and contact data you provide, as well as the content of your message. The purpose is to answer your question, handle your matter, manage support tickets and complaints, and present, enforce or defend legal claims. The legal basis is generally the performance of a contract or the legitimate interest of the data controller.

7. Source of the data

The primary source of personal data is you. Certain data may come from the login provider if you sign in using an external service provider. Certain book metadata may originate from an external book database.

8. Recipients and processors

Personal data may be accessed by the authorised staff members, contractors and processors of the data controller to the extent necessary for the performance of their duties. Based on the current technical operation, the main recipients and processors may include, in particular, the following: Supabase for authentication, database and file storage; Google for Gemini-based recognition; Stripe for payment processing; Billingo for invoicing; GoHighLevel / LeadConnector for CRM processes; PostHog for analytics; Cloudflare Turnstile for bot protection; and external API providers supplying book metadata search, including ISBNDB.

9. Transfers of data outside the EEA

Certain processors or sub-processors used by KönyvAtlasz may process personal data or carry out data transfers outside the European Economic Area. This may arise in particular when using the infrastructure of Google, Stripe, GoHighLevel / LeadConnector, PostHog, Cloudflare and certain external API providers. Such transfers may take place subject to appropriate safeguards under the GDPR, in particular on the basis of an adequacy decision of the European Commission, including, where applicable, the EU-US Data Privacy Framework if the recipient appears on the certified list, or on the basis of standard contractual clauses approved by the European Commission.

10. Retention period of personal data

We process account and profile data for as long as the account exists or until a deletion request is fulfilled. Library records, reading log data and saved content are processed until deleted by the user or until the account is terminated. Saved images are stored until they are deleted from the library or until the account is deleted; unsaved temporary processing images are stored only for the period necessary for the operation of the feature. Payment, invoicing and accounting data are retained for the retention period required by applicable law, typically for at least 8 years. Records of marketing consent are kept for as long as the consent remains in force and for as long as it is necessary to prove it. Analytics data are processed for the retention period configured by the provider.

11. Whether providing the data is mandatory

Providing the data necessary for registration, login, payment, invoicing and the core features of the service is a condition for using the service. If you do not provide these data, the account or the relevant feature will not function. Marketing consent, analytics consent and other optional processing activities are not mandatory; in their absence, only the relevant optional feature will not be available.

12. Automated decision-making and profiling

KönyvAtlasz does not carry out decision-making based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. Certain technical or marketing tagging processes may be automated, but these do not constitute decision-making with such legal or similarly significant effects.

13. Cookies and similar technologies

KönyvAtlasz may use cookies, local storage and other similar technologies. Some of these are strictly necessary for the operation of the service, in particular for session management, authentication, security, remembering settings and preventing abuse. These may include Supabase authentication technologies, storage of consent settings, and technical solutions used for security purposes. The legal basis for strictly necessary technologies is the legitimate interest of the data controller and, where necessary, the performance of a contract.

Optional analytics cookies and similar technologies operate only on the basis of consent. If you do not consent, optional analytics will not be activated. Consent may be withdrawn at any time by changing the cookie settings, and cookies may also be deleted in the browser.

14. Data security

KönyvAtlasz applies appropriate technical and organisational measures to prevent unauthorised access, alteration, transmission, disclosure, deletion, destruction, loss or damage. According to the technical summary, the system uses a Supabase-based infrastructure and the database region is in the EU. Supabase performs daily backups of data stored in the database.

15. Rights of the data subject

You have the right to receive information about the processing of your personal data, to access the personal data concerning you, to request rectification, erasure or restriction of processing, to object to processing based on legitimate interest, to request data portability, and to withdraw your consent at any time.

16. Handling of requests

KönyvAtlasz will assess data subject requests without undue delay and no later than within one month, and will inform you of the action taken or of the reasons for not taking action. Where necessary, this period may be extended in view of the complexity of the request and the number of requests. If you submit the request electronically, the response will, where possible, also be provided electronically. The data controller must facilitate the exercise of data subject rights.

17. Complaints and legal remedies

If you believe that the data processing carried out by KönyvAtlasz violates your rights, we recommend that you contact us first. We will investigate your enquiry carefully in every case.

If you are dissatisfied with the outcome of the complaint investigation, you may submit your observations to the Hungarian National Authority for Data Protection and Freedom of Information at the following contact details:

Registered office: 9-11 Falk Miksa utca, Budapest 1055, Hungary

Mailing address: P.O. Box 9, Budapest 1363, Hungary

Registered office: 9-11 Falk Miksa utca, Budapest 1055, Hungary; mailing address: P.O. Box 9, Budapest 1363, Hungary

E-mail: ugyfelszolgalat@naih.hu

18. Amendments to this notice

KönyvAtlasz may amend this notice if there are changes to the service, technical integrations, legal environment or data processing practices. The current version of the amended notice is available in the application.