General Terms
and Conditions

1. Service Provider

3-Star Solutions Kft.
Full legal name: 3-Star Solutions Korlátolt Felelősségű Társaság
Registered office: 1151 Budapest, Harsányi Kálmán utca 85., Hungary
Company registration: 01-09-427651
Tax ID: 32504091-2-42
Email: info@mivir.hu
Website: mivir.hu

The Provider is a company registered at the Budapest-Capital Regional Court as Court of Registration.

2. Definitions

For the purposes of these Terms:

• Provider: 3-Star Solutions Kft. (hereinafter: “Provider”)
• Customer: the legal entity or sole proprietor entering into a contract with the Provider (hereinafter: “Customer”). The Service is not available to consumers.
• User: a natural person authorised by the Customer to use the Service.
• Service: the Mivir financial intelligence platform and its functionalities.
• Dedicated Instance: the application instance, isolated database and AI-gateway instance reserved exclusively for the Customer.
• Individual Contract: the written agreement between the Customer and the Provider setting out the selected package, fees and individual terms.
• AI Feature: a feature of the Service that uses artificial intelligence (a large language model or text embeddings) (Section 12).
• Sub-processor: a third party engaged by the Provider to deliver the Service that accesses Customer data (Art. 28(2) and (4) GDPR).
• Sub-processor List: the dated list published by the Provider: Sub-processor list.
• NAV: the Hungarian National Tax and Customs Administration.

3. Scope and Acceptance

3.1. These Terms govern the general conditions for using the Mivir service provided by the Provider; they apply to the Provider, the Customer and the Users.

3.2. In the event of a conflict between the Individual Contract and these Terms, the Individual Contract prevails.

3.3. Acceptance. The Customer accepts these Terms and their Annexes by signing the Individual Contract. The Individual Contract, after the specific notice required by Section 6:78(2)–(3) of the Hungarian Civil Code, expressly records acceptance of the provisions that depart materially from statutory rules or usual contractual practice: clause 12.3 — exclusion of liability for damage arising from a missed human review of AI suggestions; clause 13.2 — exclusion of liability for lost profit, consequential damage and circumstances beyond the Provider’s control; clause 13.3 — the cap on the Provider’s liability (fees paid or due in the past 12 months, at least HUF 50,000); clause 15.3 — tacit acceptance of non-material amendments. Without that declaration those provisions do not become part of the contract.

3.4. Record. The Provider records the accepted version number of the Terms in the Individual Contract and retains the text of that version unchanged (PDF) in a retrievable form.

3.5. Users. Users use the Service under the Customer’s authorisation. The Customer is responsible for enforcing the provisions concerning Users (in particular 8.2 and 12.5) towards them through its internal policies or instructions.

3.6. Actual use of the Service presupposes that the acceptance under 3.3 has taken place; use without acceptance creates no contractual relationship and the Customer’s access may be suspended in that case. Use of the Service does not in itself constitute acceptance of these Terms.

4. Subject of the Service

4.1. Mivir is an enterprise-grade, single-tenant financial intelligence platform providing the following:

• Dedicated application instance, isolated database and dedicated AI-gateway instance
• AI-powered document processing (invoice and receipt recognition)
• Bank statement import and extraction, automatic matching with invoices
• NAV Online Invoice system integration
• Mivir AI chat assistant (natural-language queries over financial data)
• Financial reports and statements
• Custom development support (depending on package)

4.2. The Service does not constitute accounting, tax advisory or legal services. The Provider is responsible for operating the platform; the Customer is solely responsible for the accuracy of the data entered and its tax compliance.

4.3. Available features depend on the selected package (Starter, Enterprise, Enterprise+). The content of each package is set out in the current price list.

4.4. Classification under the AI Act. In the Provider’s assessment the AI Features of the Service are not high-risk systems under Annex III of Regulation (EU) 2024/1689 (AI Act): they do not perform creditworthiness assessment, do not make decisions with legal or similarly significant effect on natural persons, and only support the internal processing of the Customer’s own financial data with suggestions (12.6). The Provider is a deployer under Article 3(4) of the AI Act and fulfils the transparency obligations of Article 50 accordingly: for interactive AI Features (chat assistant) it informs the User at the start of the interaction that they are communicating with an AI system, and AI-generated content is displayed in a distinguishable way (12.7).

5. Formation of the Contract and Activation

5.1. The contract is concluded when both parties sign the Individual Contract.

5.2. Within 5 business days of concluding the Individual Contract the Provider sets up the Customer’s Dedicated Instance and sends the access credentials.

5.3. The Provider reserves the right to refuse to contract without giving reasons.

6. Fees and Payment Terms

6.1. Service fees are determined by the selected package according to the current price list or the Individual Contract. All prices are net prices, exclusive of VAT.

6.2. Invoicing is monthly, in advance. The first month’s fee is prorated from the activation date.

6.3. Payment deadline: 15 calendar days from invoice issuance, unless otherwise agreed.

6.4. In case of late payment the Provider may charge default interest under Section 6:155 of the Hungarian Civil Code.

6.5. If payment is more than 30 days overdue the Provider may suspend the Service. Suspension does not affect the retention of the Customer’s data during the notice period.

6.6. The Provider may review fees annually and will notify the Customer in writing at least 60 days before a fee change takes effect. The Customer may terminate before the change takes effect.

7. Service Level Agreement (SLA)

7.1. The Provider commits to the following service levels:

7.2. Availability is measured per calendar month, excluding scheduled maintenance windows.

7.3. Scheduled maintenance: the Provider notifies the Customer at least 48 hours in advance. The maintenance window is primarily weekdays 22:00–06:00 CET.

7.4. Response times refer to business hours (Mon–Fri 9:00–17:00 CET), except critical errors under the Enterprise+ package, which have 24/7 response.

8. Customer Obligations

8.1. The Customer shall:

• pay Service fees on time;
• keep access credentials (passwords, tokens) confidential and prevent unauthorised use;
• use the Service only for lawful purposes, in accordance with applicable law;
• ensure the accuracy and lawfulness of data entered into the system;
• notify the Provider immediately of any security incident or unauthorised use of credentials;
• provide the cooperation necessary for the Service’s operation (e.g. creating the NAV technical user, uploading bank statements).

8.2. The Customer is responsible for Users’ actions, must keep User permissions up to date and immediately revoke access for departing personnel.

8.3. The Customer ensures that Users observe the restrictions in clause 12.5 and enter only data necessary for the Customer’s activities.

9. Intellectual Property

9.1. The Service, its source code, design, documentation and related intellectual property rights are the exclusive property of the Provider.

9.2. The Customer receives a non-exclusive, non-transferable right to use the Service for the duration of the contract.

9.3. Data entered by the Customer remains the Customer’s property. The Provider may access such data only to the extent necessary to provide the Service.

9.4. Higher-tier packages give priority to custom development requests. The scope, deadline and any cost of custom developments are agreed case by case.

9.5. The intellectual property status of custom developments made for the Customer is set out in the Individual Contract. Unless otherwise agreed, custom developments remain the Provider’s property.

10. Data Protection and Security

10.1. The Provider stores the Customer’s data within the single-tenant architecture in a fully separated Dedicated Instance and isolated database.

10.2. The Provider stores data in GDPR-compliant data centres located within the European Union.

10.3. Details of personal data processing are set out in the Privacy Notice.

10.4. The Provider performs regular backups, retained for at least 30 days. On termination, backups containing Customer data are irreversibly deleted within 30 days after the data deletion under clause 14.4; the Provider certifies this on request.

10.5. Data processing agreement. For personal data handled in the Service the Customer is the controller and the Provider the processor. Section 12 of these Terms together with Annex A constitutes the data processing agreement under Art. 28(3) GDPR; the Customer accepts it by the acceptance under 3.3. A separate instrument is concluded only at the Customer’s express request. Annex A sets out in particular the instruction right, confidentiality, security measures, sub-processor rules, assistance, deletion and return obligations and auditability (Art. 28(3)(a)–(h) GDPR).

10.6. Sub-processors. The current, dated list of Sub-processors engaged by the Provider is available at Sub-processor list; clause 12.4 governs changes to the list and notices.

10.7. The Provider operates the Service within the European Union. The Privacy Notice describes the residual government-access risk relating to providers that process within the EU but have a non-EU parent company.

11. NAV Online Invoice Integration

11.1. The Service enables connection to the Customer’s NAV Online Invoice system via the public NAV API.

11.2. The Customer is solely responsible for the substantive accuracy and legal compliance of data submitted to NAV. The Provider’s responsibility is limited to the technical transmission of data.

11.3. The Provider is not liable for Service interruptions caused by NAV system outages, changes or API modifications. The Provider carries out the necessary technical adaptation within 10 business days of becoming aware of a NAV API change; interruptions beyond that deadline are governed by the liability rules of Section 13.

11.4. Creating the NAV technical user and configuring its permissions is the Customer’s responsibility. The Provider provides guidance.

11.5. Custody of NAV technical-user credentials. The Customer entrusts the Provider with the credentials of its NAV Online Invoice technical user (user name, password, signing key, exchange key). The Provider stores them encrypted only, uses them solely to access the NAV Online Invoice API on the Customer’s behalf, does not pass them to third parties, and deletes them without delay at the Customer’s request or when the contract ends. The Customer may revoke the technical user in the NAV system at any time. The Customer is responsible for granting the technical user shared with the Provider only the permissions required and permitted under the NAV Online Invoice terms of use.

12. AI-Powered Services and Data Processing

12.1. AI Features

The Service includes the following AI-powered features:

• PDF invoice and receipt recognition and data extraction;
• bank-statement extraction from PDF;
• matching suggestions between bank transactions and invoices;
• partner and categorisation suggestions;
• column-structure proposals for CSV bank statements;
• natural-language chat assistant over the Customer’s own financial data;
• semantic search across invoices, transactions and documents;
• optionally, when separately enabled: transcription and summarisation of meetings (Meetings).

12.2. Nature of AI Output and Possible Errors

AI-generated results are informational and advisory in nature. Due to the nature of large language models the AI may produce incorrect, inaccurate or “hallucinated” (not grounded in source data) responses. The Customer must verify all AI-suggested or AI-recognised data before any decision or accounting action.

12.3. Mandatory Human Oversight

The AI Features require human oversight (human-in-the-loop). The Customer is responsible for:

• verifying all AI-recognised invoice data (amounts, partners, dates);
• confirming all AI-suggested transaction matches;
• fact-checking the AI chat responses.

The Provider is not liable for damage arising from an incorrect AI suggestion where the suggestion was shown in the interface — clearly awaiting acceptance or rejection — and the Customer actively confirmed it. The exclusion does not apply where the suggestion was not reasonably recognisable to the Customer as AI output, or where the confirmation resulted from an interface default rather than the Customer’s conscious decision. (Provision expressly accepted under Section 6:78 Civil Code, 3.3.)

12.4. Sub-processors and International Transfers

For the AI Features and for operations the Provider engages the Sub-processors listed at Sub-processor list; the list states each Sub-processor’s name, seat, activity, processing location and transfer basis. By accepting these Terms the Customer gives general authorisation to engage the Sub-processors on the Sub-processor List (Art. 28(2) GDPR).

Changes. The Provider notifies the Customer by e-mail to the registered address at least 30 days before a new Sub-processor is engaged, an existing one is replaced, its scope is extended or its engagement ends, shows the notice inside the Service as well, and updates the Sub-processor List at the same time. The Customer may object in writing until the effective date; in case of objection the parties consult within 15 days, and failing agreement the Customer may terminate the contract as of the effective date without adverse consequences. Absent an objection by the deadline the change is deemed accepted. Sub-processors performing AI processing do not use transmitted data to train, fine-tune or benchmark their models and do not retain the data beyond processing the request.

12.5. Data Transferred and Data Minimisation

The Provider transmits the following data to Sub-processors, only to the extent necessary for the Service:

• partner names and tax numbers;
• invoice metadata (numbers, amounts, dates, descriptions);
• bank transaction metadata (counterparty, description, amount);
• the text of uploaded documents;
• free-text queries sent by the User to the chat assistant.

The Customer and Users must not enter into the AI Features:

• third-party confidential information or trade secrets;
• special-category personal data (Art. 9 GDPR: health, political, religious, etc.);
• data not necessary for the task.

The Service warns against entering sensitive data at upload and in the chat; the warning does not release the Customer from the prohibition, but its omission may affect the apportionment of liability under the contributory-conduct rules of Section 6:524 of the Civil Code.

12.6. Exclusion of Automated Decision-Making

The AI Features only make suggestions; the final decision always rests with the Customer. The Service does not make decisions concerning natural persons based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). The Customer undertakes not to base decisions concerning natural persons solely on the Service’s AI output.

12.7. Transparency and Right to Explanation

The chat assistant automatically states in text at the start of every interaction that the User is communicating with artificial intelligence (Article 50(1) AI Act). Every AI-generated result — including invoice-recognition extracts, bank-statement extraction, transaction-matching and categorisation suggestions and chat responses — is visually and textually distinguished in the interface and identified as AI output. On request the Provider explains the general logic of the AI processing within 15 business days.

12.8. Legal Basis

The legal basis for personal-data processing within the AI Features is determined by the Customer as controller (Art. 6(1) GDPR); Customers typically rely on performance of the contract (Art. 6(1)(b) GDPR). The Provider, as processor, acts on the Customer’s documented instructions (Art. 28(3)(a) GDPR). The AI Features are an essential part of the Service (document and statement processing, classification, matching, analysis) and cannot be switched off separately; the Customer can confirm, correct or reject every AI suggestion under clause 12.3.

12.9. Accounting Record Retention

Data handled in the Service does not replace the original source documents required by Section 169 of Act C of 2000 on Accounting. The 8-year retention obligation rests with the Customer as controller; the Customer is responsible for exporting the data subject to retention before the contract ends and retaining it in its own systems (14.4). After termination the Provider deletes the Customer’s data within the deadline set in clause 14.4; as processor the Provider is neither obliged nor entitled to retain accounting records.

12.10. Data Protection Impact Assessment

The Provider has carried out a data protection impact assessment for AI-based processing (Art. 35 GDPR) and reviews it at least every two years and whenever the AI Features change materially (new model, new data category, new sub-processor), updating it where necessary.

13. Limitation of Liability

13.1. The Provider exercises due diligence in providing the Service.

13.2. The Provider’s liability does not extend to:

• the content and accuracy of data entered by the Customer;
• damage caused by unauthorised use of the Customer’s credentials;
• damage caused by outages or malfunctions of third-party services (NAV, banks, AI language models), provided the Provider selected its Sub-processors with due care;
• lost profits, indirect or consequential damage;
• damage caused by circumstances beyond the Provider’s control that were unforeseeable at the time of contracting and could not be averted (in particular natural disasters, changes in law, telecommunications network outages) (Section 6:142 Civil Code).

(The exclusions in 13.2 for lost profit, consequential damage and circumstances beyond the Provider’s control are provisions expressly accepted under Section 6:78 Civil Code, 3.3.)

13.3. The Provider’s liability for damages is capped at the subscription fees paid or due by the Customer in the past 12 months, but at least HUF 50,000, except where the damage results from wilful misconduct or where the breach harms human life, physical integrity or health (Section 6:152(1) Civil Code); in those cases liability is unlimited. (Provision expressly accepted under Section 6:78 Civil Code, 3.3.)

13.4. The limitation of liability does not affect liability for breach of contract caused intentionally or harming human life, physical integrity or health (Section 6:152 Civil Code). In case of intentional breach the Customer’s full damage must be compensated under Section 6:143(3); the exclusion of lost profit and consequential damage in 13.2 does not apply in that case.

14. Term and Termination

14.1. The contract runs for the term set out in the Individual Contract, or otherwise for an indefinite term.

14.2. Ordinary termination: either party may terminate with 30 days’ written notice, without cause.

14.3. Immediate termination: either party may terminate with immediate effect if the other party:

• materially breaches its contractual obligations — in particular: is more than 30 days late with a payment, breaches its security and cooperation duties under Section 8, or violates the data-use prohibitions of clause 12.5 — and fails to cure within 15 days after written notice;
• becomes insolvent, or liquidation or bankruptcy proceedings are initiated against it;
• uses the Service for unlawful activities.

14.4. Data after termination. For 60 days after termination the Provider enables the Customer to export its data (CSV, JSON, uploaded documents in their original form). After the 60 days the Provider permanently and irreversibly deletes all Customer data — including copies in backups according to backup rotation, within a further 30 days at most — unless the Provider is required by law to retain it. The Provider as processor has no retention obligation under the Accounting Act; that obligation rests with the Customer (12.9). On request the Provider certifies the deletion.

15. Amendments to the Terms

15.1. The Provider may unilaterally amend these Terms (Section 6:191(4) Civil Code), subject to the procedure and limits set out in 15.2–15.3. The right of amendment does not extend to retroactively narrowing the Customer’s acquired rights.

15.2. The Provider notifies the Customer of amendments by e-mail at least 30 days before they take effect and shows the notice inside the Service as well.

15.3. For non-material amendments, if the Customer does not terminate before the effective date the amendment is deemed accepted (Section 6:4(4) Civil Code; provision expressly accepted, 3.3). Material amendments — in particular introducing or raising fees, limiting the Provider’s liability or narrowing the Customer’s rights — become part of the contract only with the Customer’s express acceptance (recorded in the Service or in writing); failing that, the Customer may terminate under the previous terms until the effective date. If the Customer neither accepts a material amendment nor terminates, the amendment does not apply to the Customer; the relationship continues under the previous terms and the Provider may terminate the contract with 30 days’ ordinary notice.

16. Force Majeure

16.1. Neither party is liable for failure to perform caused by force majeure, including in particular natural disasters, war, strikes, epidemics, regulatory measures, internet provider outages and cyberattacks.

16.2. The affected party must immediately notify the other party of the force majeure event.

16.3. If the force majeure state persists for more than 90 days either party may terminate with immediate effect.

17. Complaints and Dispute Resolution

17.1. The Customer may submit complaints to info@mivir.hu. The Provider responds substantively within 15 business days.

17.2. In case of dispute the parties primarily seek resolution through negotiation.

17.3. If negotiation does not resolve the dispute within 30 days, the parties submit to the exclusive jurisdiction of the court competent for the Provider’s registered office.

18. Final Provisions

18.1. Matters not regulated by these Terms are governed by Hungarian law, in particular Act V of 2013 on the Civil Code.

18.2. These Terms are drafted in Hungarian and English. In case of discrepancy the Hungarian version prevails.

18.3. If any provision is deemed invalid, the validity of the remaining provisions is unaffected.

18.4. The primary language of communication between the parties is Hungarian. Written notices are validly delivered by e-mail.

Annex A — Data Processing Terms (Art. 28(3) GDPR)

A.1. Subject and nature: storage, processing, AI-based extraction and analysis of data entered by the Customer or obtained on its behalf (NAV, banks) in the course of providing the Service, on the Customer’s instructions. Duration: the term of the contract plus the export and deletion period under 14.4. Purpose: supporting the Customer’s financial and accounting activities.

A.2. Data categories: identification and contact data of the Customer’s partners (name, tax number, address, bank account number); invoice and transaction data; the content of uploaded documents; Users’ identification data and activity logs; questions sent to the chat. Data subjects: the Customer’s Users; natural persons appearing as the Customer’s partners or on its invoices (sole proprietors, contact persons).

A.3. Instructions. The Provider processes personal data only on the Customer’s documented instructions — these Terms and the use of the Service’s features; where the law requires otherwise it informs the Customer in advance unless the law prohibits such information. By accepting these Terms and configuring the Service’s features the Customer gives documented instructions; the Provider logs the configuration. If in the Provider’s view an instruction infringes the GDPR, it informs the Customer without delay and may suspend execution of the instruction until the infringement is remedied.

A.4. Confidentiality. The Provider binds its personnel with access to confidentiality; it accesses Customer data only to the extent needed to provide the Service, resolve faults and fulfil Customer requests, with logging.

A.5. Security. Encrypted transmission (TLS) and storage; Dedicated Instance and isolated database; role-based access; logging; daily backups retained for 30 days; operation within the EU (10.2, 10.7). The Provider maintains a documented incident-management procedure and fulfils the notification duty under A.7 within that framework. Data is deleted permanently and irreversibly using industry-standard methods (following NIST SP 800-88 principles).

A.6. Sub-processors. As per clause 12.4; the Provider binds Sub-processors by contract to obligations equivalent to those under Art. 28(4) GDPR.

A.7. Assistance. The Provider assists the Customer in fulfilling data-subject rights (access, rectification, erasure, portability) through the Service’s features and, on request, technical cooperation. The Provider notifies the Customer of a personal data breach without undue delay after becoming aware of it, and at the latest within 72 hours, in sufficient detail for the Customer to meet its notification duty under Art. 33 GDPR; where all relevant information is not available within 72 hours it is provided in phases. On request the Provider makes available the information needed for the Customer’s obligations under Arts. 32–36 GDPR, in particular data protection impact assessments (Art. 35) and prior consultation (Art. 36).

A.8. Deletion and return. As per clause 14.4.

A.9. Audit. The Customer may verify compliance with this Annex through an audit announced at least 10 business days in advance, conducted during business hours without disrupting operations, primarily on the basis of documentation provided by the Provider (security description, extracts of sub-processor contracts, logs, certificates). Regular audits may take place once a year; in case of a personal data breach, a supervisory-authority procedure or well-founded suspicion the Customer may request an extraordinary audit, which the Provider enables within a reasonably necessary preparation time. The Customer bears the cost of audits except in extraordinary cases.

A.10. Dedicated Instance. The Provider accesses the Customer’s Dedicated Instance solely for operations and fault resolution, with prior notice to the Customer; backups are made and kept by the Provider in the same region as the instance; on termination the Customer receives a full database export, after which the instance and its backups are deleted under 14.4.