ChefGenius ("we") develops the ChefGenius mobile app and its companion website. This Privacy Policy explains what data we collect, how we use it, and what rights you have under the EU General Data Protection Regulation (GDPR, EU 2016/679) and applicable local laws.
1. Data Controller
ChefGenius is the controller of your personal data. You may reach us at hello@chefgenius.app.
2. Data we collect
- Account: email, name, password (bcrypt-hashed) or Google ID if you sign in with Google.
- Preferences: kitchen robots you own, dietary preferences, calorie goal, language.
- User-generated content: recipes, comments, ratings, cooking history.
- Technical usage: anonymous error logs and aggregated usage metrics to improve the service.
- Payments: Stripe processes card data for Premium subscriptions; we only store the customer ID and subscription status.
- Advertising: the Free plan shows ads via Google AdMob (see section 5).
3. Legal basis and purpose
- Contract performance: account management and service provision.
- Consent: personalised advertising, marketing emails and advanced personalisation.
- Legitimate interest: security, fraud prevention, anonymous improvement metrics.
- Legal obligation: invoicing, accounting, tax records (6 years per Spanish Commercial Code).
4. Third-party providers
To deliver the service we share strictly-necessary data with:
- OpenAI, Anthropic, Google (Emergent LLM Key): AI recipe generation. We only send the request prompt.
- Stripe (Ireland / USA): payment processing.
- Google AdMob (USA / Ireland): advertising in the Free plan.
- MongoDB Atlas (Ireland): database storage.
- Sendinblue / Resend: transactional emails.
5. Advertising and consent (EU / EEA)
On the Free plan we serve ads through Google AdMob. On your first open from an EEA country you will see Google's User Messaging Platform (UMP) consent form, letting you:
- Accept personalised ads based on your activity.
- Reject personalisation — you will still see ads, but non-personalised (contextual only).
6. Retention
- Account data: while your account exists.
- Billing data: 6 years after the last invoice.
- Technical logs: 30 days.
- Waitlist: until you withdraw consent or 90 days after launch.
7. Your rights
Under GDPR you have the right to access, rectify, erase, port, object and restrict. Email hello@chefgenius.app from your account address and we will reply within 30 days. You may also file a complaint with your local supervisory authority.
8. Security
We hash passwords with bcrypt, enforce HTTPS/TLS in transit, and apply rate limiting + SSRF protection in the backend.
9. Minors
The service is intended for users aged 16+. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact hello@chefgenius.app and we will delete it.
10. Changes to this policy
We may update this policy; the new version will be posted at this URL and notified by email if the change is material.