Privacy Policy

Last updated: 2 July 2026

1. Who we are

[Company legal name] (reg. no. [HE-number]), [registered address], Cyprus ("ChefsLab Pro", "we") operates the ChefsLab Pro kitchen-management service at chefslab.pro. We are the data controller for account data, and the data processor for the kitchen data your organisation stores in the service. Contact: hello@chefslab.pro.

2. Data we process

Account data — your name, email address, password (stored hashed), and login/security events (as data controller).
Kitchen data you enter — recipes, ingredient prices, suppliers, orders, stock counts, HACCP records, rotas and staff-roster records (which may include your employees' names, contact details, dates of birth and pay information). Your organisation is the controller of this data; we process it only to provide the service.
Billing data — subscription status and invoices, handled by Stripe. We never see or store full card numbers.
Technical data — server logs (IP address, request path, timestamp) kept for security and debugging, and rotated.

3. Why we process it (legal bases)

To provide the service you signed up for (contract, GDPR Art. 6(1)(b)).
To secure the service — login throttling, audit trails (legitimate interest, Art. 6(1)(f)).
To bill subscriptions and keep tax records (legal obligation, Art. 6(1)(c)).
To send service emails: verification, password reset, invites, trial and billing notices. We do not send marketing email without separate consent.

4. Where it lives and who touches it

Data is hosted in the European Union. Subprocessors we use to run the service:

[Hosting provider — e.g. Hetzner Online GmbH, Germany] — servers and database
Cloudflare — network/edge delivery
Stripe — subscription payments
[Email provider — e.g. Postmark] — transactional email

We never sell your data, and we never use your kitchen data for anything except running the service for you.

5. Cookies

We use only essential cookies: a session cookie (keeps you logged in) and a CSRF cookie (security). Your theme preference is stored in your browser's local storage. We set no analytics or advertising cookies, so there is no cookie banner to click.

6. Retention

Your kitchen data is kept while your organisation's account is active. If you close your account, data is deleted within 30 days, except records we must keep longer by law (billing/tax records). HACCP and staff records retention within the service is controlled by your organisation — food-safety law may require your organisation to retain records for a statutory period.

7. Your rights

You can access, correct, export or delete your data (GDPR Arts. 15–20). Owners and admins can export the organisation's full data as JSON from Settings › Data & privacy; for deletion or any other request — including account deletion — email hello@chefslab.pro and we will act within 30 days. If an organisation stores your data as an employee (e.g. on its staff roster), your employer is the controller — we will assist them with your request. You may complain to the Cyprus Commissioner for Personal Data Protection.

8. Changes

We will announce material changes to this policy by email and in the app before they apply.