Version: homezium.legal.hu.2026-09-27.v1. Market: Hungary. Effective: 27 September 2026. This notice explains processing by the Homezium operator; it is information, not a request for blanket consent.
1. Controller and contact
ADD INVEST Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (ADD INVEST Kft.), 4400 Nyíregyháza, Kiss Ernő utca 48. fszt. 1., Hungary, registration 15-09-071280, tax 13900742-2-15, is the controller for its account, platform, security and customer-service processing. Contact privacy@homezium.com or write to the registered office. This contact is not a representation that a formally appointed data protection officer has been registered. A host, seller, landlord, agency or experience provider may separately control data needed for its own contract and legal duties; its identity and notice should be available with its offer. Stripe and connected social or identity providers may also act independently for their own purposes.
2. Data and sources
We receive information you enter, upload or communicate; transaction and permission events generated by your use; information from an organisation to which you belong; and limited results from payment, identity, sign-in, delivery and connected-service providers. This can include name, email, profile and role, password hash and MFA security records, language, account/session identifiers, listings and media, messages, booking and viewing details, attendance evidence, accepted policy versions, billing details, funding/credit ledger entries, support correspondence, device/push identifiers, IP and security events, preferences and authorised location. We do not request full card details in an ordinary support message. Hosted provider verification may involve identity documents supplied directly to that provider; a verification status is distinct from our holding the document itself.
Public listings, reviews and deliberately published media are visible to their intended audience. Private conversations, account documents, preference context and precise location are not made public merely by using the platform. Information about another person must be necessary and lawfully supplied. Avoid health, political, religious, biometric or other sensitive information in free text unless the specific service lawfully requires and explains it. We do not solicit children's accounts.
3. Purposes, basis and necessity
| Processing | Data and purpose | Basis and effect of not providing it |
|---|---|---|
| Account and requested service | Identity/contact, role, authentication, listings, messages and bookings needed to create and operate your chosen service | Contract or pre-contract request; required fields are needed to provide that service |
| Transactions and settlement | Quote, original tender, provider reference, credit/cash allocation, invoice and refund evidence | Contract and applicable accounting/tax obligations; an unsupported transaction cannot proceed |
| Security and abuse prevention | Session/MFA, access, rate-limit, fraud and moderation evidence | Legitimate interests in protecting users and systems; restrictions are proportionate and reviewable |
| Support and claims | Request, relevant account/transaction evidence and correspondence | Contract, legal duties and legitimate interests in investigating complaints and defending claims |
| Optional preferences and personalisation | Chosen interests, authorised context/history and derived relevance signals | The disclosed choice or consent for optional processing; declining leaves general browsing available |
| Optional marketing and device tracking | Chosen channel, address/device reference and the permitted measurement | Separate consent where required; withdrawal does not end the account |
| Requested location or voice feature | Location, audio/transcript or command context necessary for that feature | The stated service basis and separate permission/consent where required; refusal prevents that optional feature, not unrelated use |
We assess necessity and the impact on people when relying on legitimate interests. Contact us for the applicable balancing information and to object. We do not use a contract checkbox to authorise unrelated advertising, recording or profiling. A legal obligation to keep a financial record is distinct from permission to use it for marketing.
4. AI, profiling, Shadow and Preference Passport
AI Search, Pet, Studio and voice features may process your request and the minimum relevant context to return an answer or generated output. A configured external AI provider receives content only for the enabled request path; a local draft or disabled feature is not evidence of a provider call. Do not submit confidential third-party material without authority. Outputs may be inaccurate and need review. They do not themselves execute a payment, booking or publication.
Shadow and Preference Passport can organise explicit preferences and permitted history into a private context, such as preferred area, dates, price range or travel interests. Relevance signals influence recommendations, not a guaranteed match. Privacy state and revision controls determine whether historical context remains usable. Use the provided pause, disable, clear, export and deletion controls or contact us. Withdrawal or clearing applies to future use and invalidates affected derived context; lawful transaction receipts are retained separately. We do not use sensitive-category profiling for advertising or offer personalisation as a condition for basic access.
We do not authorise solely automated decisions with legal or similarly significant effects merely through these terms. If a security or moderation restriction affects you, request human review, explain your position and challenge incorrect data. We explain a materially different automated decision before introducing it and apply the safeguards required for it. Delegation receipts record scope, approved action, account/session binding and outcome so that an instruction can be audited or revoked; they are not general permission to read all account data.
5. Location, native devices and voice
Location permission is specific to the feature. Approximate discovery, precise position and background/proximity monitoring are different uses and must not be conflated. Device permissions can be changed in iOS/Android settings. Revoking a permission stops future access through that permission; separately retained records follow the applicable retention and deletion rules. Public Aurora and GeoPet are off until activation. Their preparation does not authorise tracking or an advertising audience. Operational proximity events, when enabled and authorised, have a 60-day retention cutoff.
Push tokens support requested notifications and are bound to the relevant account/session and installation. Camera/photo access supports chosen uploads or scanning; microphone access supports the chosen voice action. We do not claim access merely because a permission string exists in the app. Store privacy/Data Safety information must describe the released binary's actual behaviour. Optional advertising choices and OS tracking permission are not interchangeable.
Before a voice session, the interface must identify the processing, any external provider, and whether audio is recorded or transcribed. Do not assume a recording exists. Operational voice events are minimised after 30 days under the retention job; completed-action receipts and support/financial records may remain for their separate lawful purpose. Public PSTN is off pending provider acceptance. A voice tool cannot use caller recognition to bypass current account, MFA, consent or transaction confirmation.
6. Recipients and international processing
Authorised staff and contracted technical suppliers receive only the access needed for hosting, database/storage, security, delivery, payment, AI or support operations. The counterparty receives information necessary to fulfil the confirmed transaction; agency members receive data within their actual permissions. Public content goes to the audience you select. We may disclose necessary records to authorities or advisers when legally required or needed for a lawful claim, with access controls.
Relevant integrated providers include Stripe for enabled payments/Connect and hosted verification; Resend for configured transactional email; Google for optional sign-in and configured speech services; Cloudflare R2 for configured object storage; and OpenAI or xAI for an explicitly enabled AI/voice path. Connected social services receive the content and scopes you authorise for that connection. A provider being integrated does not mean every provider receives every user's data or that an off feature is processing data. We can identify the actual recipients for your request through the privacy contact. Provider privacy information includes https://stripe.com/privacy, https://resend.com/legal/privacy-policy, https://policies.google.com/privacy, https://www.cloudflare.com/privacypolicy/, https://openai.com/policies/privacy-policy/ and https://x.ai/legal/privacy-policy.
Where processing involves a country outside the EEA, the applicable transfer must use an adequacy decision or appropriate safeguards, such as EU standard contractual clauses and necessary supplementary measures. We do not assume that all US providers or all services are covered by an adequacy framework. Ask privacy@homezium.com for the recipient, destination and safeguards relevant to your data, including a copy or explanation subject to legitimate redactions. A new provider or materially different purpose must be assessed and disclosed before use.
7. Retention and recovery
We retain account and requested-service data while needed for the active account and outstanding obligations, then delete or minimise it unless a specific lawful retention applies. Accounting documents and supporting records are kept for the statutory period, generally eight years under Hungarian accounting rules. Claims evidence is restricted to the relevant limitation period and any ongoing proceeding; a legal hold must identify a concrete reason and end when that reason ends. A retained invoice does not justify keeping unrelated conversation or advertising data indefinitely.
The operational voice cutoff is 30 days and native proximity cutoff 60 days. Expired agent transport/replay records are eligible for cleanup after the applicable 24-hour retention window; transaction audit evidence is separate. Search demands use their displayed deadline; saved searches remain until removal, with relevant consent revocation and derived publication withdrawal. Temporary job outputs use the expiry shown for that output. Security and complaint evidence is reviewed according to incident/claim necessity and legal deadlines rather than retained as an unlimited general-purpose profile. Browser/session storage durations are listed in /cookies. Scheduled cleanup and backups can introduce a processing interval after a cutoff; access and consent boundaries apply immediately where implemented, not only after physical deletion.
Backups are restricted to recovery, not ordinary customer profiling. Restores must reapply deletion/revocation records before ordinary use. We explain any specific retention or delayed erasure relevant to your request. A deletion-request acknowledgement is not proof of completed erasure; outstanding service or accounting duties are reviewed without using them to justify unrelated retention.
8. Choices and rights
You can request access and a copy, correction, erasure, restriction and, where applicable, portability; object to processing based on legitimate interests; and withdraw consent for future processing. Withdrawal does not make earlier lawful processing unlawful. Direct marketing objections stop that use. We may need proportionate identity verification, but do not require unnecessary documents or payment to exercise ordinary rights. Requests normally receive a response within one month; if a lawful extension is needed we explain it within that month. Where we cannot grant a request, we explain the reason and available remedies.
Use your privacy/settings controls, /account/delete, privacy@homezium.com or our postal address. Data export and deletion remain available through the privacy contact even without account access. You need not accept optional tracking, new marketing or renewed commercial terms to make a rights request. Required transaction records may remain after closing an account, with purpose and access restricted.
9. Complaints and supervisory authority
You may contact us and may complain directly to the competent supervisory authority or seek a judicial remedy. In Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; email ugyfelszolgalat@naih.hu; telephone +36 1 391 1400; website https://www.naih.hu. You may also use the authority competent for your habitual residence, workplace or the alleged infringement. Contacting us first is not a precondition to those rights.
10. Version and related notices
Material processing changes receive a new dated notice and appropriate advance information. A notice update does not silently renew consent or expand a delegation. Terms are at /terms, storage details at /cookies, and publication identities at /legal. The published version and content hash identify exactly which notice was available; optional consent receipts separately identify purpose, action and time.