Privacy policy

1. Who is responsible

The controller is [OWNER: legal name, address, contact email]. Write to that address for anything in this policy.

For the supplier contact details a chef stores (a phone number or an email address of a supplier), the chef decides what is stored and SousChef keeps it on the chef’s behalf. [OWNER: confirm the controller and processor roles and whether a data processing agreement is offered to business customers.]

2. What data we keep

Account:

• your email address, which is also how you sign in. The account is created when you ask for a sign-in code, so an address that never signs in is stored too; see section 9 for when it is deleted;
• if you sign in with Google, the name Google gives us and your Google account ID (SousChef does not receive your Google password);
• your settings: language, light or dark theme, target food cost, whether prices include VAT, your answer on ordering from suppliers, and the progress of the setup checklist;
• a count of how many AI imports you ran this month.

Kitchen data, which you type in or import:

• recipes, ingredients, menus, allergen facts, prices and price history;
• recipe photos you upload;
• stock counts and par levels, the cook plan;
• suppliers, including the contact details you enter (name, phone, email, delivery days, notes);
• orders and the message text of each order, and the delivery you ticked off;
• a log of your imports (the name of the file, never the file itself) and of your AI jobs (kind, status, token counts, the proposed draft).

SousChef does not use your data for advertising, does not sell it, and does not profile you. There are no third-party trackers and no analytics on the app or on this website.

3. Why we use it, and the legal basis

We use your data only to provide SousChef to you: to sign you in, to show and calculate your recipes, stock and orders, to send you the sign-in code, to run an import you ask for, to answer ChatGPT or Claude when you have connected them, to keep the service secure and to back it up.

The legal basis is the contract for the service (Article 6(1)(b) GDPR). For logs and rate limits, which keep the service secure and working, it is our legitimate interest (Article 6(1)(f)). [OWNER: confirm the legal bases.]

4. ChatGPT and Claude (connected apps)

You can connect ChatGPT (OpenAI) or Claude (Anthropic) to your kitchen. Nothing happens unless you do it: you sign in to SousChef and press Allow on the SousChef consent screen.

• When you ask a question in ChatGPT or Claude, the answer from your kitchen (for example the cost of a dish or what to order) is sent to OpenAI or Anthropic as part of your conversation. That happens under your own account with them and their terms and privacy policies. SousChef sends nothing to them on its own.
• ChatGPT and Claude can read your kitchen, and can record a price, a stock count, a cook-plan entry, a delivery or a recipe draft. Each change is shown as a preview and is saved only after you confirm in the chat. Nothing is ever sent to your suppliers from the chat.
• SousChef keeps one record per connected app: its name and address, what you allowed, when you connected it and when it was last used. The access and refresh codes are random values, and only a one-way hash (SHA-256) of each is stored. An access code lasts one hour and a refresh code 60 days. Your account is limited to 60 tool calls a minute.
• You see the list in Settings → Connected apps and can press Disconnect at any time. Access stops at once and the record is deleted after a day. Deleting your account deletes it too.

5. Who else handles the data

We use these providers (processors) to run SousChef:

• Hosting: the SousChef server runs at Hetzner [OWNER: confirm the datacentre location]. The database and uploaded files are stored there.
• Cloudflare: DNS and the network in front of the app and the API (it sees the traffic and your IP address), hosting of the app and this website (Cloudflare Pages), sending the sign-in emails (Cloudflare Email Sending) and the storage of the encrypted backups (Cloudflare R2). Cloudflare also asks browsers to send network-error reports to a.nel.cloudflare.com (the NEL and Report-To headers).
• Google: only if you choose Google sign-in. Google then handles that sign-in under its own privacy policy, and tells us your email address, name and account ID.
• DeepSeek, only when you run an AI import (see below).

AI imports. When you import a spreadsheet or paste a recipe and start the AI step, the content is sent to DeepSeek (api.deepseek.com, model deepseek-flash), which processes it in China. For a spreadsheet that is the column headings and the first 30 data rows, with each cell cut to 200 characters; for a recipe it is the text you pasted. Nothing is sent unless you run an import, and your email address and the rest of your kitchen are never sent. SousChef keeps the draft that comes back, not the text that was sent. You can use SousChef without ever running an AI import. The AI only proposes a draft: you review it, and prices and quantities in it are read from the cells and checked by SousChef, not by the AI. There is a limit of 30 AI imports a month for each account. Photo import is not used. [OWNER: confirm DeepSeek’s retention and training terms.]

6. Transfers outside the EU

• DeepSeek processes AI imports in China (the People’s Republic of China), which has no EU adequacy decision. The safeguard is the EU Standard Contractual Clauses together with a transfer impact assessment. [OWNER: confirm the SCCs are signed and the assessment is done.]
• Cloudflare (including the R2 backups) and Google are US companies and may process data outside the EEA. [OWNER: safeguard for each, for example the EU-US Data Privacy Framework or standard contractual clauses, and the region of the R2 bucket.]
• OpenAI and Anthropic receive data only when you connect them yourself, under your own account with them and their terms.

7. Logs and rate limits

• The web server in front of the API writes an access log of every request: time, the visitor’s IP address (the real address Cloudflare saw), the full request line including the query string, the response status, the referring page and the browser’s user-agent. The health check is not logged. Errors go to an error log. The logs are rotated daily and kept for 14 days.
• The application keeps its own request log in its database: for every API request the address, method, status, IP address, user-agent and referring page. It is kept for 5 days and is not part of the backups.
• The application also logs errors and warnings, and a failed AI job is logged with its kind only, never with your text. The server container keeps at most about 50 MB of recent log.
• To stop abuse, the server limits how often a sign-in code can be requested (per IP address, per IP address and email address together, and per email address), how many connection and registration requests come from one address, and how many AI imports and tool calls one account makes. These counters live in memory only, keep an email address only as a hash, and are gone when the server restarts.

8. Backups

Every day, around 03:40, the database and the uploaded files are copied, encrypted with restic and sent to storage outside the server (Cloudflare R2). We keep the last 7 daily and the last 4 weekly backups, and delete older ones. Before each update of the app, a copy of the database is also kept on the server; the copies of the last 10 updates are kept, with no time limit, and an older one is removed only when a newer update replaces it.

When you delete your account, your data is removed from the live service at once, and disappears from the backups as they expire, within about 4 to 5 weeks. The copies made before an update can hold it until 10 further updates have been made.

9. How long we keep it

• Account and kitchen data: as long as your account exists, until you delete it. An account that never signed in and has no data is deleted automatically 7 days after it was created. [OWNER: policy for accounts that stay unused for a long time.]
• Connected-app records: until you disconnect, or 60 days after the app was last renewed, then they are purged.
• Sign-in codes: valid for 10 minutes.
• Logs and backups: as in sections 7 and 8.

10. Your rights

You can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Most of this you can do yourself:

• Export: Settings → Your data → “Export everything” gives you a zip with one CSV file per kind of data and one JSON file with everything, including your profile and settings. Uploaded photos are not in the export, only their file names.
• Delete: Settings → “Delete account” deletes your account and all your data after you type your email address.
• Correct: change recipes, prices, suppliers and your settings in the app.
• Disconnect ChatGPT or Claude: Settings → Connected apps.

For anything else write to [OWNER: contact email]. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the authority of your own country.

11. Cookies and local storage

SousChef sets no cookies and has no cookie banner. [OWNER: confirm that Cloudflare sets no cookie on the app, API and website.] The app stores a few things in your browser, only to work:

• your sign-in (a session token and your profile) in local storage, until you sign out or after 30 days;
• your language and your theme choice, in local storage;
• a stock count you have typed but not saved yet (sc.stockDraft.<your account ID>), in local storage, until you save it, sign out or delete your account;
• the page to return to and the temporary values of a Google sign-in, in session storage, until the tab closes;
• the installed-app files (service worker), so the app opens quickly. Your kitchen data is not stored there.

This website stores only your language choice, and only when you click the language switch.

12. Changes

If we change this policy, we change the date at the top. For a change that matters, we also tell you in the app or by email.