Privacy policy
Effective date: 9 November 2026. Last updated: 9 November 2026.
1. Controller
Peter Balog e.v., 5600 Békéscsaba, Szőlő u. 93/3., Hungary. EU VAT ID HU67571659. Tabernio is a service of Peter Balog e.v.
Privacy contact: legal@contentpeter.com
We are the controller for the personal data in sections 3 and 4. For personal data on our customers' websites, such as messages from their visitors, we act as processor on the customer's instructions. See section 7.
We have not appointed a Data Protection Officer, as we are not required to. Privacy questions go to the address above.
2. Scope
This policy covers tabernio.com, the Tabernio editor at app.tabernio.com, the websites we host for our customers (on tabernio.page addresses and on customers' own domains), and our email and support channels. It does not cover sites we link to, or booking tools, videos and social networks that a customer adds to their website. Their own policies apply.
3. Data we collect about our customers
3.1 Account data. Email address, name, editor language and role. We do not use passwords. You log in with a one-time link that we send to your email. Source: you, or the Tabernio team when we set up your site.
3.2 Website content. Everything you or we put into your website: business name, address, phone, opening hours, menus and prices, texts, photos, logo, domain settings and every published version.
3.3 Setup files. The photos, menus, price lists, logos, screenshots and notes you send us so that we can build the first version of your website (see section 6).
3.4 Billing data. If you buy an add-on: business name, billing address, email, VAT ID and its check result, the items you bought, invoice amounts and payment status. We do not see or store full card numbers.
3.5 Technical data. When you use the editor: IP address, browser and device type, time of requests and error logs. We use them to run the service, keep it secure and fix problems. To stop abuse, such as too many login emails, we keep a hashed and shortened form of the IP address for a short time.
3.6 Communications. Emails and support messages you send us, and the email address you leave on tabernio.com when you ask for a website.
4. Visitors of tabernio.com
tabernio.com sets no cookies and uses no analytics or advertising tools. Fonts and images come from our own server. Our hosting provider, Cloudflare, processes your IP address to deliver the pages and to protect them from attacks.
When you choose a language, your browser remembers your choice in local storage (key `tabernio.lang`). It stays on your device. We do not receive it.
If you leave your email address in the form, we use it only to answer you.
5. Visitors of our customers' websites
Our customers' websites collect very little:
- Contact form: name, email, phone (optional), the message and the page it was sent from. It goes to the business owner's inbox in the editor and to their email.
- Live chat (add-on): the messages, and a name and email if the visitor gives them. A random key in session storage connects the visitor's browser tab to the chat. The browser removes it when the tab closes.
- Visitor statistics (add-on): day, page, the website the visitor came from, and phone or computer. No cookies, no IP address, no visitor ID. These are counts, not profiles.
- Technical data: Cloudflare processes the visitor's IP address to deliver the site and to stop attacks. To stop spam in the contact form and chat, we keep a hashed and shortened form of the IP address for a short time.
Published websites set no cookies. Their fonts come from Bunny Fonts, an EU provider. If the owner adds a booking tool or a video, that service applies its own policy when the visitor uses it.
For this data the business owner is the controller and we are the processor (section 7).
6. AI setup
To set up a new website, the Tabernio team can send the setup files (section 3.3) to an AI model, Claude by Anthropic, through our own automation server. The model suggests a style, pages and texts. We save the result as a draft. Nothing is published until a person checks it and presses Publish.
- We do not use your content to train AI models. Our API terms with Anthropic exclude your data from their model training.
- Anthropic may keep inputs for a short time for abuse monitoring, under its own terms.
- The AI suggests website content. It makes no decisions about people. There is no automated decision-making with legal or similarly significant effects under GDPR Article 22.
- Do not put special-category data (health, religion, political opinions and similar), card numbers or passwords into setup files.
Only the Tabernio team can start an AI setup. Business owners do not use AI in the editor.
7. Your website: we act as processor
For personal data on your website and in your inbox (section 5), you, the business owner, are the controller. We are your processor under GDPR Article 28. We process this data only to host your website and deliver your messages, and only on your documented instructions. This section, section 9 and our Terms of Service are our processing agreement with you. For a separately signed Data Processing Addendum, write to legal@contentpeter.com.
You are responsible for having a lawful basis for the data you collect on your website, for telling your visitors how you use it, and for answering their requests about it. We help you when you ask.
8. Why we process data, and our legal basis (GDPR Article 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account and your website | 3.1, 3.2 | Contract, Article 6(1)(b) |
| Build the first version of your website | 3.3 | Contract |
| Issue invoices, report them to NAV, keep accounting records | 3.4 | Legal obligation, Article 6(1)(c) |
| Service emails: login links, new messages, payment problems, security, changes to terms | 3.1, 3.4 | Contract |
| Support and troubleshooting | 3.1, 3.2, 3.5, 3.6 | Contract; legitimate interests |
| Security, spam and abuse prevention | 3.5; technical data in section 5 | Legitimate interests, Article 6(1)(f): keeping the service safe |
| Answer a website request from tabernio.com | 3.6 | Steps before a contract, Article 6(1)(b) |
| Marketing emails | 3.1, 3.6 | Consent, or legitimate interests for existing customers about similar services (soft opt-in). Unsubscribe in any email |
| Establish, exercise or defend legal claims | Any | Legitimate interests; legal obligation |
We do not sell personal data. We do not share it with third parties for their own marketing.
9. Sub-processors and recipients
We use the following providers. This list is current on the date at the top of this policy. We give notice of material changes.
| Provider | Purpose | Location and transfer safeguard |
|---|---|---|
| Cloudflare | Hosting of tabernio.com, the editor and all customer websites; database and file storage; DNS; security | Database and files stored in the EU (EU jurisdiction). Global network for delivery. Standard Contractual Clauses |
| MailerSend | Login emails and message notifications | EEA, Lithuania. No transfer |
| Anthropic | AI suggestions for the website setup (section 6) | US. Standard Contractual Clauses |
| Hetzner Online GmbH | Server for our automation tool (n8n), which runs the AI setup | EEA, Germany. No transfer |
| Bunny Fonts (BunnyWay d.o.o.) | Fonts on customer websites | EEA, Slovenia. No transfer |
| Billingo Technologies Zrt. | Hungarian VAT invoices and reporting to NAV | EEA, Hungary. No transfer |
| Stripe Payments Europe, Ltd. | Card payments, when you pay by card | EEA, Ireland. Onward transfer to Stripe, Inc. (US) under the EU-US Data Privacy Framework and Standard Contractual Clauses |
We also disclose data where the law requires it, including invoice data to the Hungarian Tax Authority (NAV), and to professional advisers or a buyer of the business in a corporate transaction, on notice to you.
10. International transfers
Some providers are outside the EEA, mainly in the United States. When personal data goes outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified), with supplementary measures where appropriate. Copies of the safeguards are available at legal@contentpeter.com.
11. Retention
| Data | How long we keep it |
|---|---|
| Account data | While your account exists, then 30 days |
| Website content and published versions | While the website exists. When a website is closed, we delete it at once, with its photos, messages and statistics. Database backups roll over within 30 days |
| Setup files | While the website exists, or until a new setup replaces them |
| Contact form messages and chats | While the website exists. Deleted with the website |
| Visitor statistics | While the website exists. They contain no personal data |
| Login links | 20 minutes, single use |
| Login sessions | 30 days, or until you log out |
| Hashed IP addresses for abuse limits | Up to two days |
| Technical logs | Up to 30 days |
| Invoices and billing records | 8 years, under Hungarian accounting law (Act C of 2000) |
| Support emails | 24 months from the last contact |
| Website requests from tabernio.com that did not lead to a contract | 12 months |
| Marketing contacts | Until you unsubscribe, or 24 months without engagement |
12. Security
Encryption in transit (TLS) and at rest. No passwords to steal: login links work once and expire after 20 minutes, and we store only a hash of each link and session. Every request in the editor checks that you may open that website. Least-privilege access for our team. Regular updates. Card payments are handled only by Stripe, which is certified to PCI DSS Level 1.
No system is perfectly secure. If a breach is likely to put your rights at risk, we notify the Hungarian supervisory authority within 72 hours, and we tell you without undue delay when the risk is high.
13. Your rights
Under the GDPR you have the right to access your data, correct it, erase it, restrict its processing, receive it in a portable format, object to processing based on legitimate interests, object to direct marketing at any time, and withdraw consent at any time without affecting earlier processing.
We cannot erase invoices and billing records before the end of the period the law requires us to keep them.
Write to legal@contentpeter.com. We answer within one month. For complex requests we can extend this by two months. It is free unless a request is manifestly unfounded or excessive.
If you visited one of our customers' websites, the business is the controller. Contact the business first. If you write to us, we pass your request to the business and help them answer.
You may complain to your local supervisory authority. Ours is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, naih.hu.
14. Cookies and browser storage
- tabernio.com: no cookies. Local storage only for your language choice.
- Editor (app.tabernio.com): one essential cookie, `tb_session`, keeps you logged in for 30 days. Local storage remembers light or dark mode. No other cookies.
- Customer websites: no cookies. Live chat uses session storage in the visitor's tab while the chat is open.
We set no analytics or marketing cookies, so we show no cookie banner. If this changes, we ask for your consent first.
15. Children
Tabernio is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child gave us data, write to legal@contentpeter.com and we delete it.
16. Changes
We may update this policy. We tell you about material changes by email or in the editor at least 30 days before they take effect. The "Last updated" date at the top always shows the current version.
17. Contact
Peter Balog e.v.
5600 Békéscsaba, Szőlő u. 93/3., Hungary
legal@contentpeter.com
tabernio.com