Privacy Policy

Last updated: 2 July 2026

1. Who we are

[Company legal name] (reg. no. [HE-number]), [registered address], Cyprus ("ChefsLab Pro", "we") operates the ChefsLab Pro kitchen-management service at chefslab.pro. We are the data controller for account data, and the data processor for the kitchen data your organisation stores in the service. Contact: [email protected].

2. Data we process

Account data — your name, email address, password (stored hashed), and login/security events (as data controller).
Kitchen data you enter — recipes, ingredient prices, suppliers, orders, stock counts, HACCP records, rotas and staff-roster records (which may include your employees' names, contact details, dates of birth and pay information). Your organisation is the controller of this data; we process it only to provide the service.
Billing data — subscription status and invoices, handled by Stripe. We never see or store full card numbers.
Technical data — server logs (IP address, request path, timestamp) kept for security and debugging, and rotated.

3. Why we process it (legal bases)

To provide the service you signed up for (contract, GDPR Art. 6(1)(b)).
To secure the service — login throttling, audit trails (legitimate interest, Art. 6(1)(f)).
To bill subscriptions and keep tax records (legal obligation, Art. 6(1)(c)).
To send service emails: verification, password reset, invites, trial and billing notices. We do not send marketing email without separate consent.

4. Where it lives and who touches it

Data is hosted in the European Union. Subprocessors we use to run the service:

[Hosting provider — e.g. Hetzner Online GmbH, Germany] — servers and database
Cloudflare — network/edge delivery
Stripe — subscription payments
[Email provider — e.g. Postmark] — transactional email
AI providers — only when your organisation uses an optional AI feature (see section 4a): [confirm the providers currently enabled for your deployment] OpenAI (USA), Google / Gemini (USA & EU), Anthropic (USA), and/or DeepSeek (China).

We never sell your data, and we never use your kitchen data for anything except running the service for you.

4a. Optional AI features and international transfers

Some features are AI-assisted and are off unless your organisation turns them on or uses them — the AI waste advisor, invoice-photo scanning (OCR), and the in-app assistant. When you use one of these, only the input that feature needs is sent to the configured AI provider to generate the result — for example your recent waste entries, the invoice image you upload, or the recipe/menu text in question. We do not send your whole database, and we do not send anything to an AI provider unless you use an AI feature.

Which provider processes that input depends on the model configured for your organisation. Depending on that choice it may be one of: OpenAI (OpenAI, L.L.C., United States), Google (Gemini — Google Ireland Ltd / United States), Anthropic (Anthropic PBC, United States), or DeepSeek (Hangzhou DeepSeek, China). Providers process the input to return a result under their own terms.

International transfers. Using a US provider transfers data outside the EEA under the relevant safeguards [EU Standard Contractual Clauses / provider DPA — confirm]. DeepSeek is based in China, which is not covered by an EU adequacy decision; if your organisation selects a DeepSeek model, your input is transferred to China. Your organisation controls whether AI features are enabled and which model is used, and is responsible for deciding whether such a transfer is appropriate for its data. [Owner/legal: confirm the safeguards relied on for each provider, and whether DeepSeek should be offered to EU customers at all.]

5. Cookies

We use only essential cookies: a session cookie (keeps you logged in) and a CSRF cookie (security). Your theme preference is stored in your browser's local storage. We set no analytics or advertising cookies, so there is no cookie banner to click.

6. Retention

Your kitchen data is kept while your organisation's account is active. If you close your account, data is deleted within 30 days, except records we must keep longer by law (billing/tax records). HACCP and staff records retention within the service is controlled by your organisation — food-safety law may require your organisation to retain records for a statutory period.

7. Your rights

You can access, correct, export or delete your data (GDPR Arts. 15–20). Owners and admins can export the organisation's full data as JSON from Settings › Data & privacy; for deletion or any other request — including account deletion — email [email protected] and we will act within 30 days. If an organisation stores your data as an employee (e.g. on its staff roster), your employer is the controller — we will assist them with your request. You may complain to the Cyprus Commissioner for Personal Data Protection.

8. Changes

We will announce material changes to this policy by email and in the app before they apply.