Effective from: November 4, 2026.
This notice explains how we process the personal data of visitors and subscribers of kitpebble.com under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR) and Hungarian Act CXII of 2011 on the right to informational self-determination and on freedom of information.
Contents (11 sections)
1. Data controller
- Name: METE ONLINE Korlátolt Felelősségű Társaság (METE ONLINE Kft.)
- Registered office and postal address: 2133 Sződliget, Dunai fasor 49., Hungary
- Company registration number: 13-09-218821 · Tax number: 27773558-2-13
- Email (also for privacy requests): info@mete.hu
We are not required to appoint a data protection officer, so we have not appointed one.
2. In short
- Most tools run entirely in your browser: in that case, we do not upload, see or store your files or the data you enter.
- Every tool can be used without registration. An account is only needed for a subscription.
- We only carry out measurement (our own usage log, Google Analytics, Microsoft Clarity) with your consent, and you can withdraw your consent at any time.
- We do not see your card details: they are handled by Stripe.
- We do not sell personal data or pass it on to third parties for marketing purposes.
3. Files and data entered into the tools
Tools running in the browser. The PDF, image, video, audio, text, calculator, converter, random generator, QR code and template tools process the file or data on your own device. These do not reach us, so we do not process any data in connection with them. Some tools (for example, the resume builder, the invoice maker, the notepad or the typing trainer) save the draft or the result in your browser's local storage so you can continue next time; these also stay on your device only, and you can delete them at any time (see the Cookie Policy).
Exceptions, where the browser contacts the server:
- What is my IP and IP lookup: we read your IP address and the related country and city from the headers of your request and only send them back to you; we do not store them.
- Currency converters: our server downloads the exchange rates from the central bank (Magyar Nemzeti Bank); the amount you enter is not sent to the server.
- Downloaded programs and models (OCR, background removal): on first use, your browser downloads the text recognition program (Tesseract) and its language data, and the background removal model and its runtime (ONNX Runtime, MediaPipe), from public content delivery networks (jsDelivr, unpkg), and saves them in the browser cache. These providers see your IP address, but not your file: processing happens in your browser. The spell checker's dictionary is loaded from our own server; your text does not leave your browser.
- Internet speed test: the test runs between your browser and Cloudflare's test server (speed.cloudflare.com); for this, Cloudflare sees your IP address and the test traffic. We do not receive or store the result.
- Citation generator: if you ask for the details to be filled in from a DOI or ISBN, only this identifier is sent directly from your browser to Crossref, Open Library (Internet Archive) or Google Books; all other data you enter stays in your browser.
- Reverse image search: the buttons open the external search engine you choose (Google Lens, Bing, Yandex, TinEye); the image and data uploaded there are handled by that provider under its own privacy notice.
Currently, no tool uploads your file to our server. If such a tool is launched, we will indicate this in advance on the tool's page and update this notice.
4. Purposes, scope, legal basis and duration of processing
| Purpose | Data processed | Legal basis | Duration |
|---|---|---|---|
| Serving and securing the website (server log) | IP address, time, address of the requested page, browser and operating system details | legitimate interest: operating the service and preventing abuse (GDPR Art. 6(1)(f)) | according to the hosting provider's log retention period, up to 30 days |
| Account creation and sign-in | email address; with Google sign-in, the name, email address and ID provided by Google; time of sign-in; sign-in session cookie | performance of a contract (Art. 6(1)(b)) | until the account is deleted |
| Managing the trial and subscription (start, charges, cancellation, one trial per email address) | email address, Stripe customer and subscription IDs, subscription status, end of the trial and billing period, fact of cancellation, whether a trial has already been used | performance of a contract (Art. 6(1)(b)); for filtering repeated trials, legitimate interest (Art. 6(1)(f)) | 5 years from the end of the contract (civil law limitation period) |
| Recording the source of the order | the tool and design variant where the order started; if you consented to measurement, the visitor ID | legitimate interest: improving the offer and the site (Art. 6(1)(f)) | 13 months in the event log; at Stripe, together with the subscription data (see the previous row) |
| Issuing and keeping invoices | billing name, address, tax number for businesses, amount and date of the fee | legal obligation (Art. 6(1)(c)), Hungarian Act CXXVII of 2007 on VAT and Section 169 of Act C of 2000 on accounting | 8 years from the date of the invoice |
| System messages (sign-in link, trial-ending reminder, invoice, price or Terms changes) | email address, content and time of the message | performance of a contract (Art. 6(1)(b)) | until the account is deleted; the email provider keeps the delivery log for a short time |
| Notification requests (a tool in development or the launch of the subscription) | email address, name of the tool; if you consented to measurement, the visitor ID | consent (Art. 6(1)(a)) | until the notification is sent or consent is withdrawn, up to 13 months |
| Online withdrawal and termination (statement, confirmation, refund) | name, email address, subscription ID, text and time of the statement, reference number, amount to be refunded | legal obligation (Art. 6(1)(c)), Hungarian Government Decree 45/2014 (II. 26.) | 5 years (the limitation period), or 8 years for accounting records |
| Our own usage measurement (CRM event log) | see section 4.1 | consent (Art. 6(1)(a)) | 13 months |
| Google Analytics 4 | cookie ID, pages viewed, tool usage events, browser and device data, country and city estimated from the IP address (Google Analytics does not store the IP address) | consent (Art. 6(1)(a)) | 14 months |
| Microsoft Clarity (if enabled) | cookie ID, clicks, scrolling, mouse movement, a recording of how the page is used with input fields masked, browser and device data | consent (Art. 6(1)(a)) | recordings for 30 days, aggregated data up to 13 months |
| Vercel Web Analytics and Speed Insights | aggregated page views, referring page, country, device type, loading speed; without cookies or persistent identifiers | legitimate interest: measuring site performance (Art. 6(1)(f)) | in aggregated form only; the hash that distinguishes visitors is renewed daily |
| Contacting us, customer service | name, email address, content of the message | legitimate interest: answering the inquiry (Art. 6(1)(f)); for subscribers, performance of a contract (Art. 6(1)(b)) | 1 year from the closing of the matter |
| Handling complaints | name, email address, address, content of the complaint and the response | legal obligation (Art. 6(1)(c)), Section 17/A of Hungarian Act CLV of 1997 on consumer protection | 3 years |
| Ads (planned, see section 4.2) | cookie IDs, IP address, browser and device data | consent (Art. 6(1)(a)) through a certified consent management platform | according to Google's privacy notice |
Where the legal basis is legitimate interest, you can object to the processing at any time (see section 7). Where the legal basis is consent, withdrawing it does not affect the lawfulness of processing before the withdrawal.
Features available only on our Hungarian website (krux.hu), such as the Krux AI assistant and the newsletter, are not offered on kitpebble.com; their data processing is described in the Hungarian privacy notice.
4.1. What does our own usage measurement log, and what does it not log?
If you choose “Accept” in the cookie banner, your browser receives a random visitor ID (krux:vid), and we log the following events with it:
- page view: the path of the page (for example, /pdf/merge-pdf) and the domain of the referring page;
- session start: the landing page, the source (for example, google / organic), the campaign UTM parameters, whether you are a returning visitor, and the landing page and source of your first visit;
- tool usage: the name of the tool and the number of uses that day, reaching the daily limit;
- the limit and subscription window: opening, closing and button clicks;
- on-site search: the term typed into the search box (up to 80 characters);
- for every event, the time and the design variant (which look you saw).
We do not log your files, file names, text, numbers or other data entered into the tools, or the calculated results. We do not store your IP address in the log.
If you sign in, or enter your email address when starting the trial, we link the log to your account so we can see which tool and which source led to the subscription and help you with questions about your subscription. The log is only visible to authorized staff of METE ONLINE Kft.. We do not make automated decisions with legal effects concerning you on this basis.
4.2. Ads
We plan to show Google AdSense ads alongside free use later (not to subscribers). We will only show ads after you have made a choice in a Google-certified consent management platform (CMP) that uses the IAB TCF framework; personalized ads may only be shown with your consent. Before launch, we will update this notice and the Cookie Policy. About Google's data processing: policies.google.com/technologies/ads.
5. Processors and other recipients
The following providers process data on our behalf, under a data processing agreement and only on our instructions:
| Provider | Task | Country, location of the data |
|---|---|---|
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | hosting, running server-side functions, Web Analytics, Speed Insights | USA; server-side functions run in the Frankfurt (EU) region, static content is served by a global network |
| Supabase Inc. | database: accounts, subscription data, event log; sign-in and sign-in emails | USA; the data is in the EU (Frankfurt) |
| Resend (Plus Five Five, Inc.) | sending system messages (emails) | USA |
| Stripe Payments Europe Ltd., Dublin | card payments, managing subscription and billing data | Ireland (EU); Stripe, Inc. (USA) also has access to some data |
| Google Ireland Ltd., Dublin | Google Analytics 4 (with consent) | Ireland (EU); Google LLC (USA) may also have access |
| Microsoft Corporation | Microsoft Clarity (with consent, if enabled) | USA |
Invoicing: when the paid subscription launches, invoices will be issued by an online invoicing program (Számlázz.hu or Billingo), which reports them to the Hungarian tax authority (NAV); we will list the chosen provider in this table before launch.
Independent controllers: Stripe also processes payment data (card details, fraud prevention) under its own responsibility (stripe.com/privacy). With Google sign-in, Google processes your Google account under its own privacy notice. The content delivery networks serving the downloaded programs and models (jsDelivr, unpkg), Cloudflare for the speed test, Crossref, Open Library (Internet Archive) and Google Books for the citation generator, and the respective search engine for external image search act under their own terms.
We only disclose data to authorities (for example, courts, investigating authorities or the tax authority) where required by law, at the authority's request.
6. Transfers outside the EU
Data transfers to providers based in the United States (or to the US parent companies of EU providers) are based on the following safeguards:
- if the provider has joined the EU–U.S. Data Privacy Framework, the European Commission's adequacy decision (EU) 2023/1795 (GDPR Art. 45);
- otherwise, or in addition, the standard contractual clauses adopted by the European Commission (SCC, Decision (EU) 2021/914) (GDPR Art. 46(2)(c)), with supplementary technical measures (encrypted transfer and storage).
You can request a copy of the safeguards at info@mete.hu. Where possible, we have chosen EU data centers (database and server-side functions: Frankfurt).
7. Your rights
Under the GDPR, you have the following rights:
- Access (Art. 15): you can ask what data we process about you and request a copy.
- Rectification (Art. 16): you can ask us to correct inaccurate data. You can also change your billing details yourself in the Stripe customer portal available from your account.
- Erasure (Art. 17): you can ask us to delete your data (for example, your account). We cannot delete data that must be kept by law (for example, invoices) until the end of the retention period.
- Restriction (Art. 18): you can ask us to temporarily only store your data, but not use it.
- Data portability (Art. 20): you can request the data you provided, processed on the basis of a contract or consent, in a machine-readable format.
- Objection (Art. 21): you can object at any time to processing based on legitimate interest.
- Withdrawing consent (Art. 7(3)): you can withdraw your consent to measurement with one click using the “Cookie settings” link in the footer; you can withdraw a notification request by email.
Send your request to info@mete.hu, from the email address you use with us (if you write from another address, we may ask you to verify your identity). We respond within one month at the latest; for complex or numerous requests, this can be extended by a further two months, and we will let you know within the first month. Responding is free of charge.
8. Complaints and remedies
If you feel we have violated your data protection rights, please write to us first at info@mete.hu so we can put it right. You can also lodge a complaint with the supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (Hungarian National Authority for Data Protection and Freedom of Information)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: naih.hu
If your rights are violated, you can also go to court. At your choice, the case can also be brought before the regional court of your place of residence or stay.
9. Data security
We transmit data over an encrypted connection (HTTPS) and store it encrypted. Only authorized staff and systems have access to the database, with row-level access control; you sign in to your account without a password, with a one-time sign-in link or a Google account. In the event of a data breach, we act as required by law, and if the breach is likely to result in a high risk to you, we will notify you.
10. Children
The website's content is available to everyone, but only adults can take out a subscription. Visitors under 16 may only give the consent required for measurement with the approval of their parent or legal guardian.
11. Changes to this notice
We update this notice when the service or the law changes. The current version can always be read on this page; for significant changes, we also notify subscribers by email.