Privacy Policy - Chefs AI

Effective Date: November 3, 2025 Last Updated: November 3, 2025 Version: 1.0

1. Introduction

Welcome to Chefs AI! We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains:

Who we are:

What Chefs AI does: Chefs AI is a Progressive Web App (PWA) that generates AI-powered recipe recommendations based on your ingredients and dietary preferences. We use Google's Gemini API for AI generation and Firebase for data storage.

2. Legal Framework

This Privacy Policy complies with:

Your rights are the same regardless of where you live. We apply the highest standard (GDPR) to all users globally.

3. What Data We Collect

3.1 Account Information (Google OAuth)

When you sign in with Google, we collect:

Why we collect this: Required for authentication and account management.

Legal basis (GDPR): Necessary for contract performance (Art. 6(1)(b)).

Third-party processor: Google Firebase Authentication (https://firebase.google.com/support/privacy)

3.2 Recipes You Generate

Each recipe you create includes:

Why we collect this: To save and organize your recipes for future access.

Legal basis (GDPR): Necessary for contract performance (Art. 6(1)(b)).

Storage: Firebase Firestore at /users/{userId}/savedRecipes/{recipeId}

3.3 Diner Profiles

If you create diner profiles, we store:

Why we collect this: To personalize recipes for family members or guests.

Legal basis (GDPR): Necessary for contract performance (Art. 6(1)(b)).

Storage: Firebase Firestore at /users/{userId}/profiles/{profileId}

3.4 Pantry Data

If you use the Pantry feature, we store:

Why we collect this: To help you generate recipes from available ingredients.

Legal basis (GDPR): Necessary for contract performance (Art. 6(1)(b)).

Storage: Firebase Firestore at /users/{userId} (pantryItems array)

3.5 Subscription and Usage Data

For all users (free and paid), we track:

Why we collect this: To enforce usage limits, process payments, and prevent fraud.

Legal basis (GDPR):

Storage: Firebase Firestore at /users/{userId} (subscription and usageStats fields)

3.6 AI Generation Requests

When you generate a recipe, we send to Google Gemini API:

Why we collect this: Required to generate AI-powered recipes.

How long Google keeps it:

Legal basis (GDPR): Necessary for contract performance.

Third-party processor: Google Gemini API (https://ai.google.dev/gemini-api/terms)

3.7 Recipe Images

Generated recipe images are stored:

Why we collect this: To provide visual recipe inspiration and improve user experience.

Legal basis (GDPR): Necessary for contract performance.

3.8 Technical Data (Automatic)

Our Progressive Web App (PWA) automatically collects:

Why we collect this: To enable offline functionality and maintain your session.

Legal basis (GDPR): Legitimate interest (improving service performance) and necessary for contract performance.

4. How We Use Your Information

We use your information ONLY for:

  1. Providing the Service

    • Authenticating your account
    • Generating AI-powered recipes
    • Saving and retrieving your recipes
    • Managing your subscription tier
    • Enforcing usage quotas

  2. Service Improvement

    • Fixing bugs and errors
    • Optimizing performance
    • Understanding which features are used

  3. Communication

    • Responding to support requests
    • Sending important service updates (e.g., security issues, policy changes)
    • Subscription-related emails (renewal, cancellation confirmations)

We DO NOT:

5. Data Storage and Security

5.1 Where Your Data is Stored

Primary Storage: Google Firebase (Cloud Firestore, Firebase Authentication, Firebase Storage)

Data Residency: us-central1

Encryption:

5.2 Who Can Access Your Data

You: Full access to all your data

Chefs AI Admins: Limited access for:

Google Firebase: Infrastructure provider (bound by data processing agreement)

Google Gemini API: Processes recipe generation requests (does not store data long-term)

Stripe (paid users only): Processes payment information (we only store customer ID, not payment details)

Nobody Else: We do not share, sell, or rent your data to third parties for marketing.

5.3 Data Isolation

Your data is protected by Firebase security rules:

6. How Long We Keep Your Data

6.1 Active Users

While you use the service:

6.2 Inactive Users

If you stop using Chefs AI:

Future Policy: We may implement automatic deletion of accounts inactive for 2+ years (with advance notice).

6.3 Deleted Accounts

When you delete your account:

7. Your Rights Under Data Protection Laws

You have the following rights under GDPR (EU), CCPA (California), and other privacy laws:

7.1 Right to Access (GDPR Article 15)

What it means: You can see all data we have about you.

How to exercise:

7.2 Right to Portability (GDPR Article 20)

What it means: You can get a copy of your data in a machine-readable format.

How to exercise:

What you'll receive:

7.3 Right to Rectification (GDPR Article 16)

What it means: You can correct inaccurate data.

How to exercise:

7.4 Right to Erasure / "Right to be Forgotten" (GDPR Article 17)

What it means: You can delete your data.

How to exercise:

Delete specific items:

Delete everything:

What gets deleted:

What we keep:

7.5 Right to Restriction (GDPR Article 18)

What it means: You can limit how we process your data.

How to exercise:

7.6 Right to Object (GDPR Article 21)

What it means: You can object to certain types of processing.

How to exercise:

7.7 Right to Withdraw Consent (GDPR Article 7)

What it means: You can change your mind about data processing.

How to exercise:

7.8 California Residents (CCPA)

If you're a California resident, you have additional rights:

Right to Know:

Right to Delete:

Right to Opt-Out of Sale:

Right to Non-Discrimination:

How to exercise CCPA rights:

8. Third-Party Services

We use the following third-party services to provide Chefs AI:

8.1 Google Firebase

What it is: Cloud infrastructure for data storage, authentication, and hosting

What we share:

Their role: Data processor (processes data on our behalf)

Their privacy policy: https://firebase.google.com/support/privacy

Data Processing Agreement: Google Cloud Data Processing Addendum applies

Location: us-central1

8.2 Google Gemini API

What it is: Artificial intelligence service for recipe generation

What we share:

Their role: Data processor (AI inference only)

Data retention: Google does NOT store your data long-term (per API terms)

Their privacy policy: https://ai.google.dev/gemini-api/terms

Important: All API calls are made server-side via our Cloud Functions. Your data never goes directly from your browser to Google.

8.3 Stripe (Paid Tiers Only)

What it is: Payment processing service

What we share:

What we store:

Their role: Independent data controller (for payment processing)

Their privacy policy: https://stripe.com/privacy

PCI compliance: Stripe is PCI-DSS Level 1 certified

8.4 GitHub (Deployment Only)

What it is: Code hosting and deployment automation

What we share: Nothing. GitHub only hosts our code and triggers deployments. No user data passes through GitHub.

9. Cookies and Tracking

9.1 What We Use

Chefs AI is a Progressive Web App (PWA) that uses browser storage for functionality:

LocalStorage:

Service Worker Cache:

Session Storage:

9.2 What We DON'T Use

❌ No third-party analytics (no Google Analytics, no Facebook Pixel) ❌ No advertising cookies ❌ No cross-site tracking ❌ No marketing cookies

9.3 How to Clear Storage

Browser settings:

In-app:

10. International Data Transfers

10.1 Where Your Data is Stored

Primary location: us-central1

Backup locations: Google Firebase may replicate data to other Google Cloud regions for redundancy

10.2 Transfers Outside the EU (if applicable)

If you're in the EU and our Firebase project is in the US:

Legal mechanism: Google Cloud's Standard Contractual Clauses (SCCs)

Safeguards:

11. Children's Privacy

Chefs AI is NOT intended for children under 13 (or under 16 in the EU).

We do not knowingly collect data from children. If you believe a child has created an account:

Parents: If you discover your child has created an account, please contact us for immediate deletion.

12. Data Breach Notification

In the unlikely event of a data breach:

Our obligations:

Your actions:

How we'll notify you:

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

How we'll notify you:

Your consent:

Version history: We maintain previous versions at https://github.com/yourusername/chef_ai/docs/legal/archive

14. Legal Basis for Processing (GDPR)

| Data Type | Legal Basis | |-----------|-------------| | Account information | Contract performance (Art. 6(1)(b)) | | Recipe data | Contract performance (Art. 6(1)(b)) | | Diner profiles | Contract performance (Art. 6(1)(b)) | | Pantry data | Contract performance (Art. 6(1)(b)) | | Subscription data | Contract performance (Art. 6(1)(b)) + Legal obligation (Art. 6(1)(c)) for tax records | | Technical data (caching) | Legitimate interest (Art. 6(1)(f)) - improving service performance | | AI processing | Contract performance (Art. 6(1)(b)) |

15. Supervisory Authority (EU Residents)

If you're unhappy with how we handle your data, you have the right to complain to your data protection authority:

Find your authority: https://edpb.europa.eu/about-edpb/board/members_en

Before complaining: Please contact us first at info@chefs-ai.com. We want to resolve any issues directly.

16. Contact Us

Privacy-related questions: Email: info@chefs-ai.com Response time: Within 48 hours (72 hours on weekends)

Data subject access requests: Email: info@chefs-ai.com We'll respond within 30 days (GDPR requirement)

General support: Email: support@chefs-ai.com

17. Definitions

Personal Data: Any information that can identify you (name, email, user ID, etc.)

Data Controller: The entity that decides how personal data is processed (that's us: Chefs AI LLC)

Data Processor: A third party that processes data on our behalf (e.g., Google Firebase, Stripe)

GDPR: General Data Protection Regulation (EU law)

CCPA: California Consumer Privacy Act (California law)

PII: Personally Identifiable Information

This Privacy Policy was last updated: November 3, 2025 Effective date: November 3, 2025 Version: 1.0

Acknowledgment:

By using Chefs AI, you acknowledge that you have read, understood, and agree to this Privacy Policy.