Platform

Privacy Policy

What personal data ChefSphere collects, why, how long we keep it, who we share it with, and the rights you have under GDPR, UK GDPR, and CCPA.

v1.9.0 · Effective: June 18, 2026 · 27 minute read

1. Controller and contact

ChefSphere OÜ (Estonian registry code 17470129, entered at the Tartu County Court Registration Department, business register card No. 1), with service address c/o E-Residency Hub OÜ, Ahtri tn 12, 10151 Tallinn, Harju maakond, Estonia, is the controller of all personal data processed under this Policy.

Privacy team: [email protected]
Data Protection Officer: [email protected]
Postal: ChefSphere OÜ, c/o E-Residency Hub OÜ, Ahtri tn 12, 10151 Tallinn, Harju maakond, Estonia

This Policy applies to the ChefSphere mobile apps on iOS and Android, the chefsphere.app website, the Ebook Marketplace, the Tools Marketplace, and any related channel we operate (together, the "Service"). The Terms of Service and this Policy together govern your use of the Service.

2. Categories of personal data we process

We only process data we actually need to run the Service. The categories below list what the Service can collect; not every feature collects every category — what is collected depends on how you use the Service.

Account data

Email address, password hash (bcrypt), display name, language preference, time zone, age band
Authentication identifiers from Google, Facebook, or Apple sign-in, where you choose those options
Verification status, two-factor authentication settings, and device sessions

Profile photo and bio, dietary preferences, cooking skill level, allergies and intolerances
Household composition (individual, couple, family, friends group), partner/family/friend connections, follow graph
Posts, recipes, prices, comments, likes, reactions, shares, and reports you create

Meal planning and cooking data

Meal plans you generate, recipes you swipe, like, super-like, save, cook, or extract from external URLs
Grocery lists, custom ingredients, and store/price records
Cook mode progress and recipe ratings and reviews

Nutrition targets and intake, water, sleep, and workout entries, goals, and achievements
Any health data you connect or enter manually

We treat this category under the strictest internal access controls. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), given when you first enable a health feature. You can withdraw consent at any time in the app; past processing remains lawful until withdrawal.

Payment, billing, and identity-verification data

Subscription tier, renewal dates, payment method last-4, currency, tax jurisdiction, VAT where applicable
Invoice history and receipts
For marketplace sellers and ebook authors: identity verification results returned by our identity-verification partner (we do not store the raw ID document; we store only a pass/fail result and reference ID)

Full card details never touch our servers — they are entered in the payment processor's secure iframe, tokenised, and returned to us only as a payment-method reference.

Marketplace data

Listings you create, orders you place, rental requests, messages between buyer and seller/renter, reviews, and reports
Shipping address when buying a physical tool; carrier and tracking details for shipped orders
Ebook files you own, reading progress, bookmarks, and highlights

Live streaming data (Chef Lives)

Session metadata, audience counts, chat messages, reactions, Q&A entries, recordings made available for replay, and moderation actions
Audio and video streams are routed through our live-streaming provider; we store metadata and post-show artefacts as described above

AI usage data

Messages you send to AI Chef and the AI's replies, images you submit for analysis, AI quotas and usage counts
For a limited time we may retain AI prompts and outputs to investigate abuse, improve safety classifiers, and satisfy legal obligations

Referral and affiliate data

Referral code, referral status, and the identity of the referring and referred users
For fraud prevention: one-way SHA-256 hashes of your IP address and a device fingerprint derived from browser or device signals (screen size, time zone, WebGL renderer). We do not store raw IP addresses or reversible device identifiers.
Fraud score computed from IP patterns, device reuse, and timing signals
For Creators (affiliates): display name, bio, website, social-media links, business name, tax ID, Stripe Connect account identifier, commission and payout history, tier level, and balance data

Device and technical data

Device model and OS version, app version, crash and performance diagnostics
IP address, coarse network information (e.g. carrier or ASN), approximate location derived from IP for security, DSA statistics, and language defaults
Precise location only when you explicitly enable geo-search in the Tools Marketplace to find nearby tools
Push notification tokens, when you opt in
Cookies and similar technologies on the website — see the Cookie Policy

Communications data

Emails, in-app messages, and support tickets you send us, and our replies

3. Why we process your data, and on which legal basis

Purpose	Categories of data	Legal basis (GDPR Art. 6 / 9)
Create your account, authenticate you, and keep the Service secure	Account, device, communications	Contract (Art. 6(1)(b)), legitimate interest in security (6(1)(f))
Provide core features: swipe, meal plan, grocery list, cook mode, community feed, follow graph	Profile, meal, social	Contract (6(1)(b))
Provide health-tracking features	Health (Art. 9)	Your explicit consent (9(2)(a)), withdrawable at any time
Provide AI Chef, fridge-vision, preference matching, meal-plan generation, recipe extraction	AI usage, profile	Contract (6(1)(b)); details in the AI Disclosure
Process subscriptions and store purchases and keep accounting records	Payment, billing	Contract (6(1)(b)), legal obligation (6(1)(c) — Estonian accounting law, ten-year retention)
Operate the Tools Marketplace and Ebook Marketplace including listing, ordering, messaging, rating, and KYC where required	Marketplace, identity-verification result	Contract (6(1)(b)), legal obligation for KYC/AML (6(1)(c))
Run Chef Lives, real-time chat, notifications	Live, profile	Contract (6(1)(b))
Operate the Referral Program and Creator Program: track referrals, prevent fraud, compute rewards, process affiliate commissions and payouts	Referral, device, payment	Contract (6(1)(b)) for programme participation, legitimate interest in fraud prevention (6(1)(f)); see Referral Program Terms and Creator Program Terms
Moderate user content, investigate abuse, enforce the Acceptable Use Policy, and comply with the EU Digital Services Act and other applicable laws	All relevant categories	Legal obligation (6(1)(c)), legitimate interest in a safe Service (6(1)(f))
Send transactional emails (receipts, password resets, security alerts)	Account, communications	Contract (6(1)(b)), legal obligation (6(1)(c))
Send optional marketing emails, newsletters, and product updates	Account, device	Your consent (6(1)(a)), withdrawable at any time
Crash reporting and analytics used to fix bugs and improve usability	Device, coarse usage events	Legitimate interest (6(1)(f)), balanced against your reasonable expectations
Respond to legal requests, exercise or defend legal claims	All relevant categories	Legal obligation (6(1)(c)), legitimate interest (6(1)(f))

We do not make solely automated decisions that produce legal or similarly significant effects about you within the meaning of Art. 22 GDPR. Automated content-moderation decisions that result in action on your content or account are subject to human review on request — see the Acceptable Use Policy and the EU DSA Notice.

4. Where your data comes from

Most data is data you give us directly (when you create an account, fill a profile, upload a recipe, make a purchase, or message someone). Some data is generated automatically as you use the Service (device, usage, crash reports). Some data is received from third parties — for example authentication providers confirming a sign-in, the App Store and Google Play confirming a purchase, payment processors confirming a charge, or your partner/family inviting you into a shared plan.

We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent needed for the listed purposes.

Cloud hosting and object storage providers — to host the Service and store files you upload
Content delivery and edge-security providers — to serve media fast and to block attacks
Payment processors and subscription-billing providers — to charge you for subscriptions and addon packs bought on the web
App Store and Google Play billing — when you buy a subscription or addon inside the iOS or Android app
Marketplace payment and identity-verification providers — to pay out ebook authors and tool sellers and to meet KYC/AML rules
Transactional email delivery providers — to send you receipts, password resets, and security notices
Push notification gateways — to deliver in-app and system notifications
Real-time messaging and WebSocket providers — to power chats, live reactions, and presence
Live video and audio streaming providers — to run Chef Lives
AI / machine-learning model providers (text, image, vision) — to power AI features described in the AI Disclosure
Automated text- and image-content moderation providers — to detect illegal, harmful, or prohibited content before publication and reactively after publication
Shipping, logistics, and parcel-tracking providers — only for shipped orders on the Tools Marketplace
Error monitoring, performance, and observability providers — to detect, investigate, and fix bugs

Every recipient listed above is engaged as a processor under a written data-processing agreement that requires confidentiality, security, purpose limitation, sub-processor controls, assistance with data subject rights, and deletion or return of data at the end of the service. Where a recipient is joint controller (for example App Store and Google Play billing for in-app purchases) we allocate responsibilities in line with the store's published terms, and you can ask us for a plain-English summary.

Apple App Tracking Transparency (ATT) and Android equivalents. The ChefSphere iOS app does not engage in "tracking" as that term is defined in Apple's App Tracking Transparency framework — we do not link personal data collected from our app with third-party data for targeted advertising or advertising measurement, and we do not share device identifiers (IDFA / AAID / Firebase Instance ID) with data brokers or advertising networks. The ATT prompt is therefore not shown in-app. The Android app makes the equivalent negative declaration in the Google Play Data Safety section — no cross-app tracking, no collection of advertising identifiers for targeting, no sharing with ad networks. If either posture ever changes we will add the ATT prompt on iOS, update the Data Safety declaration on Android, and amend this Policy in advance.

We may also share data with public authorities, courts, or regulators when we are required to do so by law, or where necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of ChefSphere, our users, or the public.

If ChefSphere is part of a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred to the receiving entity, subject to the protections of this Policy and applicable law. Affected users will be informed in advance where feasible.

6. International transfers

Some processors operate outside the EEA (for example in the United Kingdom, United States, or other regions). When we transfer personal data outside the EEA we rely, in this order:

Adequacy decisions of the European Commission. For the United Kingdom we rely on Decision (EU) 2021/1772 (UK GDPR adequacy). For the United States we rely on the EU–US Data Privacy Framework (DPF), Implementing Decision (EU) 2023/1795, where the US processor is self-certified to the DPF and the transfer falls within the scope of its certification. The list of DPF-certified ChefSphere processors is available on request at [email protected].
Standard Contractual Clauses (SCCs). Where no adequacy decision covers the destination country or the specific flow, we rely on the SCCs adopted by the Commission in Decision (EU) 2021/914 (modules 2 and 3 for controller-to-processor and processor-to-processor transfers), supplemented — where necessary — by a Transfer Impact Assessment ("TIA") performed under EDPB Recommendations 01/2020. The TIA documents the third-country law affecting the transfer, the technical measures (encryption in transit and at rest, minimisation, pseudonymisation), the organisational measures (access controls, incident response), and any additional contractual commitment from the importer (notably a commitment to challenge disproportionate government access requests under FISA §702 or similar foreign-intelligence frameworks).
Chapter V derogations. Only in the narrow cases permitted by Art. 49 GDPR (e.g. explicit informed consent for a specific transfer, performance of a contract requested by the data subject).

You can request a copy of the adequacy decision reference, the SCC addendum, or the TIA summary for any specific flow by writing to [email protected]. ChefSphere does not rely on transfers to countries subject to comprehensive EU sanctions.

7. How long we keep data

We keep personal data only as long as we need it for the purposes we collected it for, plus any additional period required by law or by our legitimate defence against claims.

Active account data: while your account exists and for up to 12 months after closure, to handle disputes and reversals. Read-receipts on messages and basic social-graph data are deleted sooner on account closure.
Health data (Art. 9 GDPR): kept while you keep the feature enabled; deleted within 30 days of withdrawal of consent, except where we must retain an anonymised aggregate to avoid re-introducing deleted content (for example from backups, which roll off within 30 days).
Transactional records (invoices, tax documents, payment audit trails): ten (10) years from the end of the financial year, as required by the Estonian Accounting Act.
KYC / identity-verification results: five (5) years after the last transaction, as required by EU AML rules; then deleted.
Moderation and trust-and-safety records: up to two (2) years for regular cases; longer where needed to meet DSA transparency duties or to prevent repeat offences.
Marketing consent records: until you withdraw consent, plus three (3) years to evidence that consent was properly obtained.
Backups: rolling backups are overwritten within 30 days of deletion from production systems.

8. Security

We apply technical and organisational measures proportionate to the risk, aligned with ISO/IEC 27001 and SOC 2 control families and with the security-of-processing principles of Art. 32 GDPR:

Encryption in transit — TLS 1.2+ (TLS 1.3 preferred) on every public endpoint, with HSTS on the web front-end and certificate pinning on sensitive mobile flows.
Encryption at rest — AES-256 for object storage; per-column encryption for sensitive database fields; envelope encryption for secrets.
Access control — role-based access control with principle-of-least-privilege, time-bound break-glass elevation, and mandatory two-factor authentication for all privileged access.
Network segmentation — separation of development, staging, and production environments; managed WAF, DDoS, and bot-mitigation at the edge.
Audit and detection — centralised, tamper-evident audit logging; anomaly detection and alerting on privileged actions and authentication events.
Vulnerability management — continuous dependency scanning, scheduled infrastructure scans, and an annual independent penetration test; critical findings are remediated under the SLAs in the Vulnerability Disclosure Policy.
Responsible disclosure — a published Vulnerability Disclosure Policy with a safe-harbor statement and defined response SLAs.
Incident response — a documented internal incident-response procedure that meets the 72-hour GDPR notification deadline (Art. 33) and the separate notification obligations owed to affected data subjects (Art. 34) where applicable.
Backups and continuity — encrypted rolling backups with restore testing and a documented business-continuity / disaster-recovery plan.
Personnel — confidentiality obligations in every employment and contractor agreement; onboarding security training; periodic awareness refreshers; mandatory AI-literacy training for staff operating AI features (AI Act Art. 4).

No system is perfectly secure. We ask you to use a strong, unique password, enable two-factor authentication where available, and report suspected account compromise without delay to [email protected] or suspected platform vulnerabilities under the Vulnerability Disclosure Policy.

8.1 Breach notification to you

If we become aware of a personal-data breach that is likely to result in a high risk to your rights and freedoms, we notify you directly without undue delay under Art. 34 GDPR, in clear and plain language, describing the nature of the breach, the likely consequences, and the measures we have taken or propose to take. The same commitment applies under equivalent US state-law rules (e.g. Cal. Civ. Code §§1798.82 et seq., WA RCW 19.255, NY Gen. Bus. Law §899-aa, and similar state breach-notice statutes) and under the 72-hour authority-notification obligation owed to the Estonian Data Protection Inspectorate under Art. 33 GDPR.

For processing activities likely to result in a high risk to data subjects — specifically health-feature activation (Art. 9 GDPR), large-scale AI-assisted moderation, processing of minors' data with parental-consent flows, and live-streaming of community content — we maintain a Data Protection Impact Assessment reviewed at least annually and on every material change to the feature. DPIA summaries are available to competent Data Protection Authorities on reasoned request at [email protected]. Where a DPIA identifies a residual high risk that cannot be mitigated, we engage in prior consultation with the supervisory authority under Art. 36 GDPR before the processing begins.

9. Your rights

If your personal data is processed by ChefSphere, you have the right to:

Access — obtain confirmation of processing and a copy of your data (GDPR Art. 15)
Rectification — correct inaccurate or incomplete data (Art. 16)
Erasure / "right to be forgotten" — request deletion where a legal basis no longer applies (Art. 17)
Restriction — limit our processing in specified situations (Art. 18)
Data portability — receive your data in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller (Art. 20)
Object — object to processing based on legitimate interest, including profiling (Art. 21)
Withdraw consent — for any processing based on consent, without affecting past processing (Art. 7(3))
Not be subject to a solely automated decision producing legal or similarly significant effects (Art. 22)
Lodge a complaint — with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee) or with the data-protection authority in the EU/EEA country where you live, work, or where the alleged infringement took place

9.1 How to exercise your rights (DSAR channels)

You can exercise any of the rights above through one of the following channels — all of them trigger the same one-month response clock under Art. 12(3) GDPR:

In-app self-service — Settings → Privacy → Privacy Controls on iOS, Android, and web. The Download my data button triggers an Art. 15 / Art. 20 export and delivers a ZIP archive with your profile, meal plans, marketplace activity, and AI prompts in a structured, machine-readable format. The Delete my account button triggers the Art. 17 erasure flow described in the Children & Age Policy and the DSA Notice.
Authenticated API — the same flows are reachable from authenticated API endpoints under /api/v1/compliance/privacy/* (export, erasure, rectification, restriction, objection, consent history). These endpoints are rate-limited, audit-logged, and require a valid session token; they are documented in the ChefSphere developer portal.
Email — write to [email protected] (for data-subject requests) or [email protected] (for questions to the Data Protection Officer).
Paper mail — c/o E-Residency Hub OÜ, Ahtri tn 12, 10151 Tallinn, Harju maakond, Estonia, attn. "Data Protection".

We may need to confirm your identity before acting. Where we have reasonable doubts about the identity of the requester we may ask for additional information strictly necessary for that purpose (Art. 12(6) GDPR); any identification data is used only to process the request and deleted immediately afterwards.

We respond to requests without undue delay and within one (1) month, extendable by two (2) months for complex cases as allowed by Art. 12(3) GDPR. To make a request, write to [email protected] or use the in-app privacy tools. We may need to confirm your identity before acting — the confirmation data is used only for that purpose and deleted afterwards.

10. California residents (CCPA / CPRA)

If you live in California you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), including:

Right to know what personal information we have collected, the categories of sources, the business or commercial purposes, and the categories of third parties with whom we share it.
Right to delete the personal information we have collected from you, subject to the statutory exceptions.
Right to correct inaccurate personal information.
Right to portability — receive your personal information in a portable format.
Right to opt out of "sale" or "sharing" of personal information (for cross-context behavioural advertising).
Right to limit use and disclosure of Sensitive Personal Information to purposes necessary to perform the services or as otherwise permitted by Cal. Civ. Code §1798.121.
Right to non-discrimination for exercising your privacy rights.

"Sale" and "sharing" — our stated position. ChefSphere does not sell personal information, and ChefSphere does not "share" personal information for cross-context behavioural advertising, as those terms are defined by CCPA/CPRA. We have not sold or shared personal information in the preceding twelve (12) months and have no plans to do so. If this ever changes, this Policy will be updated in advance and a visible "Do Not Sell or Share My Personal Information" link will be added to the public footer before any such processing begins.

Sensitive Personal Information (SPI) we process under CPRA. Because some users choose to enable health features, we process the following CPRA categories of SPI: precise geolocation (only when you opt in to Tools Marketplace geo-search), account log-in credentials, contents of mail, email, and text messages other than where we are the intended recipient (limited to in-app DMs and support tickets), and health data (only when you enable health tracking). We use SPI only for the purposes listed in Section 3 above — we do not use or disclose SPI to infer characteristics about you. You may nevertheless exercise your right to limit its use by writing to [email protected]; the limitation applies on a forward-looking basis within 15 business days of the request.

Global Privacy Control (GPC). Our public website at chefsphere.app recognises the Global Privacy Control browser signal (Sec-GPC: 1) as a valid opt-out preference signal under Cal. Code Regs. tit. 11, §7025 for California residents. Because we do not sell or share personal information, the GPC signal has no additional effect on our processing beyond the protections already described; we honour it as a categorical confirmation that the visitor has opted out of any future sale or sharing, should we ever introduce such processing.

How to exercise CCPA/CPRA rights. Use the in-app controls at Settings → Privacy → Privacy Controls or write to [email protected]. We respond to verifiable consumer requests within 45 calendar days, extendable once by 45 days where reasonably necessary, and inform you of the extension before it is taken. We do not charge a fee or require account creation to exercise these rights. An authorised agent may submit a request on your behalf with written permission verifiable by us.

Metrics. Where the statutory thresholds in Cal. Code Regs. tit. 11, §7102 apply, the annual CCPA request metrics for ChefSphere are published as part of our DSA Transparency Report or on request at [email protected].

10.1 Other US state privacy rights

ChefSphere applies the protections described in this Section 10 — access, correction, deletion, portability, opt-out of sale/sharing, SPI use-limitation, non-discrimination, and the universal opt-out signal — to residents of every US state with a comprehensive consumer privacy law in force, including: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa (ICDPA), Montana (MCDPA), Texas (TDPSA), Oregon (OCPA), Delaware (DPDPA), New Hampshire (NHPA), New Jersey (NJDPA), Kentucky (KCDPA), Maryland (MODPA), Minnesota (MCDPA), Rhode Island (RIDTPPA), Tennessee (TIPA), and Indiana (ICDPA). To exercise rights under the law of the state where you reside, write to [email protected] and identify your state; our response timeline is the longer of the timeline required by your state law or 45 days. You may appeal an adverse decision by writing to [email protected]; we respond to appeals within 60 days and inform you of the independent appeal channel available in your state (typically the state Attorney General).

10.2 Consumer-health-data rights (Washington MHMDA + Nevada SB 370)

If you are a resident of Washington state, the My Health My Data Act (RCW 19.373) gives you specific rights over the health-adjacent data we process — nutrition targets and intake, water, sleep, and workout entries; any health data you connect; and any data that could indicate an attempt to seek, obtain, or receive health-care services. ChefSphere treats all of those as "consumer health data" under MHMDA.

We maintain a written Consumer Health Data Privacy Policy — this Section 10.2, read together with Sections 2 (categories), 3 (purposes), 5 (sharing), and 7 (retention), constitutes that Policy.
We do not sell your consumer health data within the meaning of RCW 19.373.040, and we will not do so without the separate valid authorisation required by that provision.
We do not geofence medical, mental-health, or reproductive-health facilities (RCW 19.373.080).
You have the right to confirm whether we process your consumer health data, to access a copy, to delete it (we pass the deletion request through to any processor that received it), and to withdraw consent for any future processing by writing to [email protected] or using the in-app Settings → Privacy → Privacy Controls.
The processing is based on your explicit opt-in consent given when you first enable a health feature, per §3 above and Art. 9(2)(a) GDPR.

Nevada residents have comparable rights under SB 370 (codified at NRS 603A.300 et seq.), which applies to consumer health data effective 31 March 2024. Nevada residents may exercise those rights through the same channels as Washington residents; we respond within 45 calendar days.

Complaints may be addressed to the Washington State Attorney General (Consumer Protection Division) or the Nevada Attorney General respectively.

10.3 Automated Decision-Making Technology (California ADMT — effective 1 January 2026)

The California Privacy Protection Agency's ADMT regulations (Cal. Code Regs. tit. 11 §§7200–7221, effective 1 January 2026) apply a pre-use notice, opt-out, and access-rights framework to any automated decision-making technology used to make a significant decision affecting a California resident. ChefSphere's ADMT footprint is deliberately narrow, and this Section 10.3 is published to meet the pre-use notice duty of §7220 regardless of whether any specific feature rises to the statutory "significant decision" threshold.

ADMT we operate.

Pre-publication content classifiers (text and image) that screen uploads for the severe categories described in the Acceptable Use Policy and the AI Disclosure. These are not "significant decisions" as defined in §7200(c) — they affect the availability of an individual content item, not employment, housing, financial services, education, health-care services, essential goods or services, or any other §7200(c) domain — and they fall within the §7221(b) safety exception (necessary to ensure the safety of the Service's physical or information-security integrity).
Recommender systems for swipe discovery, community feed ordering, ebook and tools marketplace sort, and meal-plan generation. These rank items for presentation; they do not make significant decisions under §7200(c), so the opt-out right under §7221(d) does not apply. You can still influence ranking indirectly through the in-app filters, content categories, and explicit feedback (like / dislike / report) on each recommender surface; the top parameters of each recommender are documented in the EU DSA Notice §14.
AI features (AI Chef, fridge-vision, preference matching, recipe URL extraction) described in the AI Disclosure. They produce informational output and do not make decisions about you.

ADMT we do not operate. ChefSphere does not use automated decision-making to approve, deny, price, rank, or otherwise significantly affect a user's access to employment, credit, housing, insurance, education, health-care services, essential government services, or essential public services. We do not use ADMT for public-surveillance purposes, for the inference of protected characteristics, or for profiling of minors.

Your ADMT rights in California.

Pre-use notice. You receive the notice required by §7220 at sign-up, on the first use of every AI surface (per the AI Disclosure §4), and through this Policy.
Access — meaningful information about the logic. Plain-language explanations of every AI feature's logic are published at AI Disclosure. Plain-language explanations of every recommender system's main parameters are exposed through /api/v1/legal/tools/ranking and /api/v1/legal/ebooks/ranking, and in-context via the "How this list is ranked" link next to every sort control.
Opt-out / human review. For any automated moderation action restricting your content or account, you may request human review under the Acceptable Use Policy and the EU DSA Notice §7. For recommender systems, as explained above, the §7221(d) opt-out does not engage because ranking is not a significant decision under §7200(c); our commitment to non-discrimination under Cal. Civ. Code §1798.125 still applies — no account-level disadvantage is imposed based on how you interact with or constrain our recommenders through the in-app filters, content categories, and feedback controls.
No Art. 22 GDPR / §7200(c) ADMT decisions are performed about you — the same position stated in §3 above, restated here for California-specific clarity.

CCPA cybersecurity audit. Where the CPPA's annual cybersecurity-audit thresholds apply (Cal. Code Regs. tit. 11 §§7120–7125, effective 1 January 2026), ChefSphere conducts the audit on the schedule required by the rule and retains the audit certification for the statutory period. The audit report is available to the CPPA on request.

11. Children

The Service is not directed at children under 13. In the European Economic Area and the United Kingdom we require users aged 13 to 16 minus one to have verifiable consent from a parent or legal guardian before we process their personal data. Full details are in the Children & Age Policy.

For users connecting from the United Kingdom, we apply the fifteen standards of the UK Age-Appropriate Design Code issued by the Information Commissioner's Office — including data minimisation, high-privacy defaults, transparency tailored to the child's age, no nudging towards weaker privacy, no use of children's data in ways that are detrimental to their wellbeing, and a Data Protection Impact Assessment before any material change to a feature likely to be accessed by children.

For users in the United States under 13 we comply with the Children's Online Privacy Protection Act (COPPA, 16 C.F.R. Part 312), including the 2025 FTC amendments with full compliance from 22 April 2026: separate verifiable parental consent for third-party disclosure (not just collection); a written Children's Privacy Program and a written Information Security Program (published at /legal/security and summarised in §8 above); data-minimisation and explicit retention limits (published at /legal/data-retention); updated direct- and online-notice requirements; and the expanded definition of "personal information" (biometric and government identifiers are now in scope by default — we do not collect either from minors). Our baseline is to not accept users under 13 and, on confirmed report of an under-age account, to delete it without undue delay.

For US minors aged 13–17 we additionally apply the New York Child Data Protection Act (Gen. Bus. Law §899-ee, effective 20 June 2025), which prohibits the collection, use, sharing, or sale of minors' data for targeted advertising, and the Connecticut Data Privacy Act's minor-specific overlays (Public Act 24-27, effective 1 October 2024), which require opt-in consent for any processing outside the core service. ChefSphere does not run third-party behavioural advertising at all and processes minors' data only for the strictly-necessary service purposes listed in §3 — both rules are satisfied by design. Where a state or federal App Store Accountability Act informs us that a user is a minor, we also apply the developer obligations described in the Children & Age Policy §11.

12. Cookies and similar technologies

The website uses a minimal set of cookies and similar technologies. The Cookie Policy explains each one, how to withdraw consent, and how to manage preferences.

13. Changes to this Policy

We may update this Policy when our Service, the law, or our processors change. If a change is material — for example adding a new category of data or a new purpose — we will notify you in-app or by email at least 30 days before it takes effect, except where a shorter period is required by law. Past versions are available on request.

14. How to contact us

Privacy: [email protected]
Data Protection Officer: [email protected]
Legal: [email protected]
Postal: ChefSphere OÜ, c/o E-Residency Hub OÜ, Ahtri tn 12, 10151 Tallinn, Harju maakond, Estonia