CEKIVA Privacy Policy
We inform you about what personal data the CEKIVA platform handles, for what purpose and legal basis, as well as what your data subject rights are.
In force: 1 January 2026 | Last modified: 23 October 2026
Privacy statement
Effective: January 1, 2026 | CEKIVA
The CEKIVA (hereinafter: Data Controller) hereby declares that it fully complies with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.). With the entry into force of the GDPR (May 25, 2018), the previous NAIH data protection registration obligation ceased; the legality of the data controllers is ensured by the internal register (GDPR Article 30) and the information provided to data subjects.
Purpose limitation
We process personal data only for specified, explicit and legitimate purposes. We do not process data in a way incompatible with those purposes.
Data minimization
We only collect and store data that is essential to achieve the purpose. We do not request unnecessary data.
Accuracy
We strive to keep the processed data up-to-date and accurate. Inaccurate data will be deleted or corrected immediately.
Storage limitation
Personal data is stored only for the time necessary to achieve the purpose, then deleted or anonymized.
Integrity and confidentiality
We protect data against unauthorized access, loss and destruction with technical and organizational measures.
Accountability
We document our data processing activities (GDPR Article 30) and, upon request, can demonstrate compliance with the principles.
The Data Controller undertakes that, in the event of a data protection incident, it will notify the supervisory authority within 72 hours in accordance with Articles 33–34 of the GDPR and, if necessary, also the data subjects. The possibility of exercising data subject rights (access, rectification, erasure, data portability, objection) is continuously provided — detailed below in the "Data subject rights" chapter.
1. Data controller identifier
Name of data controller
Csegény Péter e.v.
Headquarters
1212 Budapest, Telep utca 1A.
info@cekiva.com
Data Protection Contact (DPO)
dpo@cekiva.com
Applicable law
EU Regulation 2016/679 (GDPR) and Infotv.
Internal register (GDPR Article 30)
Maintained — see Chapter 4
2. Scope and legal basis of processed data
The table below summarizes what data we process, on what legal basis and for how long.
| Data category | Examples | Legal basis | Retention |
|---|---|---|---|
| Registration data | Name, email, password (bcrypt hash), role | Contract performance (GDPR Article 6 (1) b) | Until the account is deleted |
| Profile data | Display name, profile picture (optional) | Contract performance | Until the account is deleted |
| Social media account connections | OAuth access/refresh tokens (Facebook, Instagram, LinkedIn, TikTok, YouTube, Pinterest, Threads), App Password (Bluesky) | Express consent (GDPR Article 6 (1) a) | Until disconnected — deleted immediately |
| Financial data | Billing details, Stripe payment history, wallet balance and transactions (card data does NOT reach us) | Legal obligation (accounting) | 8 years (Accounting Act) |
| Generated and scheduled content | AI-generated post texts, images, videos, the topics/instructions you give, the platform and time of publication | Contract performance | Until the account is deleted |
| Log and analytics data | IP address, browser, event log (error, login) | Legitimate interest (security, troubleshooting) | 90 days |
| Referral programme data | Referral code, who referred the account and when, credited commissions; a normalised form of the e-mail address to filter out self-referral | Performance of contract; legitimate interest (abuse prevention) | Until the account is deleted; financial documents behind a commission 8 years |
| Client contacts (agency workspace) | The client's name and e-mail address entered by the user; the log of approval e-mails (recipient, time, sender, number of posts in the e-mail) | On the instructions of the user (controller); CEKIVA is the processor (GDPR Article 28) | Until the workspace is archived; the log is kept without the recipient after archiving |
| Recipients of business outreach | From the company's public business page: company name, contact person's name, business e-mail address, the page's address; the e-mail's subject and text, the operator's note | Legitimate interest (GDPR Art. 6(1)(f)): business contact | 1 year from sending, then only the e-mail address; on a "do not write" request only the e-mail address is kept, at once |
| Security and abuse-prevention data | The IP address at sign-up; a log of suspicious events detected by the system (e.g. many sign-ups from one IP address, the same social page under several accounts, an unusually large number of posts scheduled at once), about which the operator is notified | Legitimate interest (preventing abuse, protecting the service and its connections to the social platforms) | 90 days |
We only share your data to the extent necessary:
- Stripe Inc. — payment processing (bank card data is handled directly by them, we do not see it)
- Billingo Technologies Zrt. — electronic invoice issuance
- Google LLC (Gemini API) — AI text, image and video generation based on the topic/instruction you give
- Meta Platforms, Inc. (Facebook, Instagram, Threads) — publishing your posts on your behalf, through the OAuth connection you approved
- LinkedIn Corporation, TikTok Technology Limited, Google LLC (YouTube), Pinterest, Inc., Bluesky Social PBC — likewise, only for the platforms you actually connect to your account
- MailerSend — delivery of transactional e-mails (activation, password reset, approval-link e-mail)
- Zoho Corporation B.V. (Zoho Mail, EU data centre) — receiving and storing e-mails sent to @cekiva.com addresses (e.g. info@, dpo@), and the operator's individual business e-mails, sent one by one to selected companies
- Cloudflare, Inc. (USA) — DNS, content delivery and attack protection: every request to the website passes through it, so it sees the visitor's IP address and the technical details of the request (browser, page requested)
- HostingBazis Bt. (Hungary) — CEKIVA's server and database: storage within the EU
We do not transfer your data to third parties for direct marketing purposes.
Google (Gemini API) and most social media partners (Meta, LinkedIn, TikTok, Pinterest, Bluesky) operate in the United States. Data is transferred on the basis of the EU–US Data Privacy Framework or appropriate contractual guarantees (SCC). We will inform you about the guarantee applied upon request.
Cloudflare, Inc. (USA) handles the website's traffic. Visitors from the EU are usually served by its European servers, but logging and security analysis may also take place in the United States; this is also covered by the Data Privacy Framework and Cloudflare's data processing agreement (SCC).
The operator writes to a few companies of their own choosing about CEKIVA, one by one and personally. This is not a newsletter, and there is no bulk sending.
The data comes from the company's public business page (e.g. website, Facebook page). Data processed: company name, the contact person's name (if shown), business e-mail address, the address of the public page, the subject and text of the e-mail, and the operator's note. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), business contact. The e-mail is sent through Zoho Mail's EU server.
The text of a sent e-mail and the other data are deleted automatically one year after sending; after that only the e-mail address and the fact that we wrote are kept, so that we never write to the same address again. If the recipient asks us not to write again, we keep only their e-mail address, at once and solely so that they receive no further e-mails. A draft that was never sent is deleted after one year. Objections or deletion requests can be sent at any time to dpo@cekiva.com.
What data do we collect? When you connect a social media account (Facebook, Instagram, LinkedIn, TikTok, YouTube, Pinterest, Threads or Bluesky) to CEKIVA, we gain access to your basic profile data (display name, avatar) and permission to publish content on your behalf through the platform's official API (e.g. the TikTok Content Posting API). For your posts published on Facebook, Instagram and Bluesky through CEKIVA, we read the number of likes, comments and shares 1, 3, 7 and 30 days after posting so that we can show you the results. We do not read the text of comments or any data about the people who comment.
How do we use this data? We use the data exclusively to show the connection status on your interface and to automatically publish your AI-generated or own posts at the scheduled time on the connected channel. We do not use it for any other purpose.
Do we share this data? No. We do not share the data of your social media accounts with any third party — we use it only for publishing to the platform concerned (e.g. TikTok).
How long do we retain this data? We store the access tokens only as long as the integration is active. If you disconnect your account or delete your CEKIVA profile, the tokens and related data are immediately and permanently deleted from our servers.
How can you request deletion of your data? You can disconnect any integration at any time in the platform connections settings, which immediately deletes the tokens from our system. You can request full data deletion at dpo@cekiva.com or by permanently deleting your CEKIVA account in the profile settings. If you remove the CEKIVA app in the Facebook, Instagram or Threads settings, we delete the connection automatically; if you request data deletion there, we also delete the data read from the platform for your posts (post ids, links, engagement counts), and you receive a confirmation through Meta.
When you use CEKIVA Shield, the text, image or video of a post that is about to go out is compared with the platforms' rules (on your request or under your subscription). The text is evaluated by our own system; for image and video checks the media is sent for analysis to our AI provider (Google LLC, Gemini API). We log the fact of the check (account, platform, content type, video length, credits charged, a short description of the problems found). Legal basis: performance of the contract. Retention: until the account is deleted.
3. Built-in data protection (Privacy by Design)
Based on Article 25 of the GDPR, we have designed the platform to protect privacy by default.
Cookie management
The platform automatically uses necessary (functional) cookies — for session management (JWT httpOnly cookie) and CSRF protection. In addition, only with your explicit consent given in the Cookie Banner shown on your first visit, we also collect anonymized visitor statistics (Google Analytics). We do not use marketing or advertising cookies (e.g. Meta Pixel).
Data minimization
For registration, we only ask for data essential for the operation of the platform (name, e-mail, password). We connect a social media account only when you start it yourself. We do not store financial data directly — card data is handled by Stripe in accordance with the PCI DSS standard.
Security measures
- HTTPS encryption (Let's Encrypt TLS 1.2/1.3) for all traffic
- Passwords stored with bcrypt hash (version 4.0.1, cost factor 12)
- JWT tokens as httpOnly, Secure, SameSite=Lax cookies
- Regular database backup
- Role-based access control (creator, admin)
- Compliance with the 72-hour NAIH notification obligation in the event of a data protection incident
Data Protection Officer (DPO)
The platform does not handle large amounts of special data (health, criminal law, etc.), so there is no mandatory appointment of a DPO based on Article 37 of the GDPR. In matters of data protection, we have appointed a contact person on a voluntary basis:
dpo@cekiva.comImpact assessment (DPIA)
The AI features (generating post text, images and video from the topic you give) do not constitute profiling of natural persons or automated decision-making — the AI only prepares marketing material from your own content instructions, which you approve before publication. This is not "high-risk" processing (GDPR Article 35), so a mandatory DPIA is not currently necessary. We will review it when the situation changes.
4. Internal data processing register (GDPR Article 30)
Based on Article 30 of the GDPR, the data controller is obliged to keep an internal record of its data processing activities. The summary below is a public extract of it.
| Data category | Examples | Legal basis | Retention |
|---|---|---|---|
| Client contacts | Client name, e-mail address, log of approval e-mails | User's instruction (data processing) | Until archiving |
| Business outreach | Company name, contact person, business e-mail address, the e-mail's text | Legitimate interest | 1 year, then only the e-mail address |
| User Accounts | Creator, admin | Contract fulfillment / legal obligation | Until account deletion / 8 years (financial) |
| Social media integrations | OAuth tokens and API keys per platform | Express consent | Until disconnected |
| Generated content | AI text/image/video, scheduled posts | Contract fulfillment | Until the account is deleted |
| Financial documents | Stripe transactions, Billingo invoices | Legal obligation | 8 years |
| Referral programme | Referral code, referral relationship, commission transactions (the referrer sees referred users only anonymously) | Performance of contract / legitimate interest | Until the account is deleted |
| System and AI processing logs | IP address, login attempts, errors, AI-provider calls | Legitimate interest (security) | 90 days |
| Security and abuse-prevention data | The IP address at sign-up; a log of suspicious events detected by the system (e.g. many sign-ups from one IP address, the same social page under several accounts, an unusually large number of posts scheduled at once), about which the operator is notified | Legitimate interest (preventing abuse, protecting the service and its connections to the social platforms) | 90 days |
Mandatory elements of the register (GDPR Article 30(1)):
- The name and contact details of the data controller ✓
- The purposes of the processing ✓
- Description of the categories of data subjects and personal data ✓
- Recipients to whom personal data have been or will be disclosed ✓
- The envisaged time limits for erasure ✓
- Description of technical and organizational security measures ✓
The complete internal register is available upon official request (upon request from NAIH).
5. Summary of retention periods
By deleting your account (Settings → Delete account), we remove all your personal data, except for what we are required by law to retain (e.g. invoices).
6. Cookies and session management
httpOnly, SameSite=Lax, JWT token stored as a Secure cookie. Contains the user ID and role. Expires when the browser is closed (session cookie).
Provides protection against cross-site request forgery. It is set by the server at the beginning of each session.
Stores language preference and other UI preferences. 30-day expiration, in localStorage.
Anonymized visitor statistics used to improve the service. Only loaded if you click "Accept" in the Cookie Banner — your choice is stored in your browser's localStorage and can be changed at any time by clearing your browser data.
Alongside functional cookies, we only collect anonymized visitor statistics (Google Analytics) with your consent. You make this choice in the Cookie Banner shown on your first visit, and you can change it at any time in your browser settings by clearing cookies/localStorage. We do not use marketing or advertising cookies (e.g. Meta Pixel).
7. Data subject rights
Based on Articles 15–22 of the GDPR, you can exercise the following rights in relation to your personal data. We will respond to your requests within 30 days.
You can request that we inform you about what personal data we process about you, where we obtained it, and for what purpose.
If your data is inaccurate or incomplete, you can request its correction or completion.
You can request deletion of your data if the purpose of processing has ceased, you have withdrawn your consent, or the processing was unlawful. Deleting your account automatically removes your profile data.
We can provide the data you have provided and processed automatically in a machine-readable format (JSON or CSV) to you or transmit it to another data controller.
In certain cases (e.g. contesting accuracy, pending evaluation of a deletion request), you can request that the data not be deleted but also not actively used.
You may object to processing based on legitimate interests. You can stop processing for direct marketing at any time.
No significant decision about you (e.g. credit rating) is made solely on the basis of automated decision-making. AI suggestions can be reviewed by the creator.
How can you exercise your rights?
Send your request to dpo@cekiva.com. We will respond within 30 days of receiving the request. In the case of particularly complex requests, the deadline can be extended by a maximum of 60 days, of which we will notify you.
8. Contact and right to complain
Submitting a complaint to a supervisory authority
If you consider that our data management violates the provisions of the GDPR, you can file a complaint with the National Data Protection and Information Freedom Authority (NAIH). The NAIH is only competent to receive complaints — the obligation to report to the data management register ceased with the entry into force of the GDPR (May 25, 2018).
- Web: naih.hu
- E-mail: ugyfelszolgalat@naih.hu
- Address: 1055 Budapest, Falk Miksa utca 9-11.
Please contact us before submitting a complaint — we can resolve most issues directly.