Privacy Policy

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Application means any software application published or provided by Qutzl LLC, including mobile, desktop, and web applications, and related backend services.
• Business, for the purposes of the CCPA/CPRA and only to the extent that law applies to Qutzl LLC, refers to Qutzl LLC as the entity that determines the purposes and means of processing Consumers' personal information.
• Business Customer means a company or organization that purchases Managed Services, hosting, remote support, or other technology services from Qutzl LLC, together with the employees and other individuals it authorizes to receive those services.
• CCPA and/or CPRA refers to the California Consumer Privacy Act (the "CCPA") as amended by the California Privacy Rights Act of 2020 (the "CPRA").
• Qutzl LLC (also referred to as "the Company", "We", "Us" or "Our" in this Agreement) means Qutzl LLC, PO Box 154, Karthaus, PA 16845, United States of America. Where the GDPR applies, Qutzl LLC is the Data Controller for Personal Data it collects for its own purposes and a Data Processor for data it handles on behalf of Business Customers.
• Consumer, means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in California for other than a temporary or transitory purpose, and (2) every individual who is domiciled in California who is outside California for a temporary or transitory purpose.
• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to Qutzl LLC as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
• Device means any device that can access the Service such as a computer, a cell phone or a digital tablet.
• Do Not Track (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing Internet users to control the tracking of their online activities across websites.
• GDPR refers to the EU General Data Protection Regulation and, where relevant, the UK GDPR.
• Managed Services means the IT support, remote support, server and network management, hosting, email, domain, security, consulting, and similar services Qutzl LLC provides to Business Customers under an agreement, quote, or invoice.
• Personal Data is any information that relates to an identified or identifiable individual. For the purposes of GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity. For the purposes of the CCPA/CPRA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.
• Remote Support Session means a remote-access connection to a Device, started with the Qutzl Support application or otherwise authorized by You or a Business Customer, that lets a Qutzl technician view and control that Device to provide support.
• Service refers to the Website, the Applications, and related products, features, and technology services offered by Qutzl LLC.
• Service Provider means any natural or legal person who processes the data on behalf of Qutzl LLC. It refers to third-party companies or individuals employed by Qutzl LLC to facilitate the Service, to provide the Service on behalf of Qutzl LLC, to perform services related to the Service or to assist Qutzl LLC in analyzing how the Service is used. For the purposes of the GDPR, Service Providers are considered Data Processors. Our current Service Providers are listed on Our Service Providers page.
• Store means an applicable third-party digital distribution platform such as the Apple App Store, Google Play, Amazon Appstore, Samsung Galaxy Store, or similar platforms.
• Third-party Social Media Service refers to any website or any social network website through which a User can log in or create an account to use the Service.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website refers to the websites operated by Qutzl LLC, including qutzl.net, qutzl.com, chefskiss.io, app.chefskiss.io, subdomains of those domains operated by Qutzl LLC (including billing.qutzl.net, connect.qutzl.net, and auth.qutzl.net), and other websites and applications operated by Qutzl LLC.
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under GDPR, You can be referred to as the Data Subject or as the User as you are the individual using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Company name, job title, and billing details when You buy services from Us as or for a Business Customer
• Account credentials, support ticket contents, and other communications You send Us

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device or Application, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, Application version, unique device identifiers, crash logs, performance diagnostics, and other diagnostic data.

We may also collect information that Your browser or Application sends whenever You visit Our Service or when You access the Service by or through a mobile device.

Application Content and Activity Data

When You use an Application, We may collect and process Content and activity You provide or generate while using the Service, which may include:

• Saved content such as recipes, meal plans, notes, documents, preferences, and related materials
• Diet and allergy preferences You choose to enter in Chef's Kiss
• Chat prompts, messages, and other inputs You submit to AI or assistant features, and related outputs needed to provide those features
• Account settings, feature usage events, and similar in-app activity

Some Content may remain stored only on Your Device until You sync, back up, or otherwise transmit it to Our Service. We process Content You send to Us to provide the features You request.

Chef's Kiss

Chef's Kiss, Our recipe and meal-planning Application, has its own Chef's Kiss section below. It describes what the app stores and where, its diet and allergy preferences, how long Chef chat history is kept, public share links and other sharing features, ads, notifications, and what account deletion removes. Diet and allergy preferences can reveal information about Your health or religious beliefs. We use them only to provide the features You request and never for advertising. Our Consumer Health Data Privacy Policy describes Your rights over that information under Washington, Nevada, and similar state laws.

Purchase and Entitlement Information

If You make a purchase or subscribe through a Store, that Store processes Your payment. We do not receive Your full payment card number from the Store. We may receive limited information needed to provide purchased features, such as purchase status, product or subscription identifiers, entitlement or renewal status, and transaction identifiers.

Push Notifications and Device Tokens

If You enable notifications, We may collect a device push token and related delivery status information so We can send the notifications You turn on, such as reminders or tips and offers You opt in to. You can turn off optional notifications in the Application's settings or Your Device settings.

Billing Portal and Payments

Our client portal at billing.qutzl.net collects the account, contact, company, billing, support ticket, and service details needed to provide and invoice Our services. Card and PayPal payments are processed by Stripe and PayPal under their own privacy policies. We do not store full payment card numbers on Our systems; We receive payment confirmations and the limited details needed to manage Your account, such as the card brand, last four digits, and expiry date.

Remote Support Sessions

Our remote support application, Qutzl Support, is available from connect.qutzl.net. It is built from the open-source RustDesk client using the RDGEN build tool and is configured to connect only to rendezvous and relay servers that Qutzl operates on a dedicated server We rent from OVHcloud. When You take part in a Remote Support Session:

• The standard application shows a session ID that You give to Your technician, and a connection is made only after You accept it on Your screen, every session. On request, We can provide a separately configured application that allows unattended access to a Device. It is installed only with the written authorization of the Device's owner or the Business Customer, and that authorization can be withdrawn at any time by uninstalling it or asking Us to disable access.
• We receive the Device's name, operating system, IP address, session ID, and connection times, and We keep a connection log of which technician connected, when, and for how long.
• During the session the technician can see Your screen and, with the permissions You grant in the application, control the keyboard and mouse, transfer files, and use the clipboard. Anything visible on screen, including documents, messages, or passwords You display, can be seen by the technician.
• Session traffic is encrypted end to end between Your Device and the technician's. Our relay servers forward encrypted traffic and cannot read it.
• We do not make video or audio recordings of sessions. Technicians may record written notes about the work performed in Your support ticket.
• You can end a session at any time by closing the application. Close anything You do not want seen before the session starts.

Managed Services Data

When We provide Managed Services, We may access systems, mailboxes, files, backups, logs, and user directories that contain Personal Data about a Business Customer's employees, customers, and contacts. We access that data only as needed to deliver the services requested and under the Business Customer's instructions, as described in the Business Customers and Managed Services section below.

Contact and Request Forms

Some contact and data-request forms for Our Applications, such as the Chef's Kiss contact form and account deletion request form reached through links.qutzl.net, are hosted on Google Forms. Information You submit through them is stored in Our Google Workspace account and processed by Google under its privacy policy. You can always use Our support desk or contact form instead.

Information from Third-Party Social Media Services

Qutzl LLC allows You to create an account and log in to use the Service through the following Third-party Social Media Services:

• Sign in with Apple
• Sign in with Google

If You decide to register through or otherwise grant us access to a Third-Party Social Media Service, We may collect Personal data that is already associated with Your Third-Party Social Media Service's account, such as Your name and Your email address. If You use Apple's private email relay feature, We receive the relay address Apple provides instead of Your personal email address.

You may also have the option of sharing additional information with Qutzl LLC through Your Third-Party Social Media Service's account. If You choose to provide such information and Personal Data, during registration or otherwise, You are giving Qutzl LLC permission to use, share, and store it in a manner consistent with this Privacy Policy.

Chef's Kiss accounts, including these sign-in options, run on an authentication service that We operate on Our own servers. Clerk provides sign-in for Our administrative tools and some other Qutzl products. Both are described on Our Service Providers page.

Cookies and Similar Technologies

Our public websites (qutzl.net, insights.qutzl.net, connect.qutzl.net, and links.qutzl.net) are static sites that set no first-party cookies and show no cookie banner. Cookies and similar storage are used in the following places:

Emails We send may contain a delivery or open-tracking image from Our email delivery provider; You can block remote images in Your mail client. You can block or delete cookies in Your browser settings, but blocking essential cookies will prevent You from signing in to the client portal or Applications.

Use of Your Personal Data

Qutzl LLC may use Personal Data for the following purposes:

• To provide and maintain our Service: including Application features such as accounts, saved content, planning and organization tools, chat or AI features, and to monitor the usage of our Service.
• To manage Your Account: to manage Your registration as a user of the Service.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased, including verifying Store entitlements.
• To contact You: by email, telephone calls, SMS, push notification, or other equivalent forms of electronic communication about Your Account, services, and support requests. We send marketing text messages only with Your prior express consent.
• To provide You with news and offers: about other goods, services and events similar to those you have already purchased or inquired about. You can opt out of promotional email at any time using the unsubscribe link included in those messages or by contacting Us; transactional and service messages (such as invoices, renewal notices, and security alerts) are not affected.
• To manage Your requests: To attend and manage Your requests to Us.
• To improve the Service: including troubleshooting, analytics, security, and, where applicable, evaluating aggregate usage patterns to improve quality. We do not sell Your Content, and We do not use Your Content to train artificial intelligence models.
• To provide Managed Services: to access, configure, monitor, secure, and repair systems for Business Customers under their instructions.
• To deliver Remote Support Sessions: to connect to a Device You authorize, verify the session, and keep connection records for security and billing.
• For business transfers: We may use Your data to evaluate or conduct a merger, asset sale, or restructuring.
• For other purposes: such as data analysis, identifying usage trends, and security audits.

Sharing Your Personal Information

We may share Your personal information in the following situations:

• With Service Providers: to host infrastructure, provide AI inference, process payments, deliver email, analyze use of our Service, report crashes, or otherwise help Us operate the Service. Our current providers are listed on Our Service Providers page.
• With payment processors: Stripe and PayPal, to take and refund payments on Our client portal and to prevent fraud.
• With Business Customers: if You use the Service as an employee, contractor, or end user of a Business Customer, with that customer and its administrators, including support ticket history and Remote Support Session records for its Devices.
• With Stores: as needed to validate purchases, subscriptions, and entitlements.
• For business transfers: in connection with, or during negotiations of, any merger or sale of Qutzl LLC assets.
• With Affiliates, if any: in which case we will require those affiliates to honor this Privacy Policy.
• With other users: in public areas where information is distributed publicly.
• With Your consent: We may disclose Your personal information for any other purpose.

Service Providers We Use

We rely on third-party companies to run Our websites, Applications, and services. They may process Personal Data only to provide their service to Us and under contracts that restrict other uses. The main categories and providers as of the Last updated date are:

• Websites, content delivery, DNS, and file storage: Cloudflare, which serves qutzl.net, insights.qutzl.net, connect.qutzl.net, and links.qutzl.net, sits in front of Our client portal at billing.qutzl.net and the customer websites We host, provides DNS and security for those domains, stores the remote support downloads and article images, and runs the Chef's Kiss website, web companion, and API; and QUIC.cloud, which provides content delivery and optimization for websites We host.
• Servers and cloud infrastructure: NameHero, which hosts Our client portal at billing.qutzl.net and Our cPanel web and email hosting; OVHcloud, whose dedicated server runs Our remote support rendezvous and relay servers and other Qutzl-managed virtual machines; and Vultr, Amazon Web Services, Google Cloud, and Microsoft Azure for additional servers, storage, backups (including Amazon S3 Glacier long-term archives), and AI platform services.
• Application backend and tooling: Convex, which provides the database and backend for Our Applications; UploadThing, from T3 Tools, which stores images; RevenueCat, which keeps in-app purchase and subscription records; and Expo, which builds Our mobile Applications, delivers push notifications, and monitors app performance and errors.
• AI inference for Application features: Anthropic, OpenAI, Google (through the Gemini API), and xAI (Grok), reached directly or through OpenRouter, plus open-weight models that We run on Our own infrastructure. OpenRouter routes a request to one of these providers or to another model provider We have selected; Our OpenRouter account is set not to store prompts and to use only providers that do not train on inputs. We send each provider only the content needed to fulfil Your request, and under Our agreements with them Your prompts and Content are not used to train their models. Recipe cover images are generated with image models from Google and ByteDance, reached through OpenRouter, which receive only a recipe's title and ingredient names.
• Development, source control, and monitoring: Cursor and T3 Code, together with the model providers above, for writing and maintaining Our software; GitHub and a self-hosted GitLab for source code; and Uptime Kuma (self-hosted) and HetrixTools for checking that Our sites and the systems We manage are reachable. These tools process Our source code, configuration, hostnames, and availability data, not Your Content or Account data, apart from log excerpts We may share while diagnosing a problem.
• Payments: Stripe and PayPal for client portal invoices, and the Apple, Google, Amazon, and Samsung Stores for Application purchases.
• Email and productivity: Mailgun, which delivers account, notification, and support email, and Google Workspace, which hosts Our mailboxes and forms.
• Sign-in and account security: an authentication service We operate on Our own servers for Chef's Kiss accounts; Clerk, for sign-in to Our administrative tools and some other Qutzl products; and Apple and Google for the optional social sign-in options.
• Remote support: the open-source RustDesk client, built for Us with RDGEN and configured to connect only to servers We operate. The RustDesk project does not receive Your session data.
• Advertising and analytics: Google AdSense on public pages of chefskiss.io and for site verification on Our other websites, Google AdMob in ad-supported Applications, and, where enabled in an Application, Google Analytics or PostHog.

The full list, including each provider's role, the data involved, and a link to its privacy policy, is maintained on Our Service Providers page. We review that page at least quarterly and update it when a provider changes.

Business Customers and Managed Services

When We provide Managed Services or remote support to a Business Customer, We act as a service provider (a "processor" under the GDPR) for Personal Data in that customer's systems, such as its employee directory, mailboxes, files, backups, and customer records. In that role:

• We access and use that data only as needed to deliver the services the Business Customer requested and under its instructions, Our agreement with it, and this Privacy Policy.
• The Business Customer is responsible for having the right to give Us access, for notifying its own users as its laws require, and for approving Remote Support Sessions on its Devices.
• We do not use Business Customer data for advertising, do not sell it, and do not disclose it except to Service Providers that help Us deliver the service or as required by law.
• If You are an employee or end user of a Business Customer and want to exercise privacy rights over data in that customer's systems, please contact the Business Customer. We will support its response.
• When an engagement ends, We return or delete the Business Customer's data and remove Our access and credentials, except for backup copies, which expire within 90 days, or within 180 days where held in long-term archive storage, and records We must keep by law.

Business Customers that need a written data processing agreement, or a list of the Service Providers involved in their services, can request one through the contact methods below.

Chef's Kiss

This section explains how Chef's Kiss, Our recipe and meal-planning Application, handles Your information in the iOS and Android apps, the web companion at app.chefskiss.io, and the chefskiss.io website. The rest of this Privacy Policy also applies to Chef's Kiss; where this section is more specific about Chef's Kiss, this section controls.

Chef's Kiss lets You record diet and allergy preferences, which can reveal information about Your health. If You live in Washington, Nevada, or another state with a consumer health data law, Our Consumer Health Data Privacy Policy also applies to You. Questions and requests about Chef's Kiss can be sent by any method in the Contact Us section below or through the Chef's Kiss contact form linked from the app.

Accounts and Guest Use

• Guest use. You can use the mobile app without an Account. Your recipes and pantry stay on Your Device. Guest Chef requests carry a random device identifier that We use for usage limits and abuse prevention.
• Accounts. You can create an Account with an email address and password, an emailed sign-in code, Sign in with Apple, or Sign in with Google. Accounts run on an authentication service that We operate on Our own servers. Passwords are stored only as salted hashes.
• Names. You can set a first name that Chef uses to greet You, which is not shown to anyone else, and a name that people on Your shared shopping lists and libraries see. If You leave that name blank, they see a short code instead.
• Age confirmation. Before You sign up or sign in, You confirm that You meet the age requirement in Our Terms and Conditions. The app stores only that confirmation and when You gave it. We do not collect Your birth date.
• Account email. Sign-in codes and verification, password recovery, and account deletion messages are sent through Mailgun with open and click tracking turned off.

What Chef's Kiss Stores

• Your library: recipes You import, create, or save from Discover, with their folders, tags, favorites, notes, version history, and cover images.
• Your kitchen: pantry items and their expiry dates, meal plans, shopping lists, events, and Kitchen Level progress.
• Your settings: diet and allergy preferences, appearance, language, notification and ad preferences, usage limits, and referral details.

When You are signed in, Your library, pantry, diet and allergy preferences, and Chef history sync to Our backend, which runs on Convex. Meal plans and shopping lists sync only on plans that include sync; otherwise they stay on Your Device or in Your browser. On Local Unlock, Your library stays on Your Device. We cannot see or recover anything that is stored only on Your Device, so deleting the app or clearing Your browser storage deletes it.

Importing Recipes

• Links and YouTube. When You import a link, Our servers fetch that page or the video's description and captions and send the text to an AI model to build the recipe card. The source link is saved with the recipe.
• Photos. In the mobile apps, a photo You take or choose is sent to an AI model to read the recipe. We do not keep the photo after the recipe card is created.
• Pantry barcodes. When You look up a pantry product by barcode, Our servers send only the barcode to Open Food Facts, a free public food database, to find the product's name and picture.

Import requests can include Your diet and allergy preferences so the result fits Your kitchen.

Diet and Allergy Preferences

You can choose a diet style, common or custom allergies, and free-text notes about foods You prefer or avoid. Some diet styles, such as Diabetic, GERD, Low FODMAP, Gluten-free, Low sodium, DASH, and Heart-healthy, and any allergies You enter can reveal information about Your health. Kosher and Halal can reveal religious beliefs. We treat all of these preferences as sensitive information:

• They are optional, and Chef's Kiss works without them.
• We use them only to tailor the Import and Chef results You ask for. They are sent as context with those requests to Our AI provider, which may not use them to train its models.
• We never sell them, never use them for advertising or ad targeting, never send them to Google AdMob or AdSense, and never show them to other users.
• When You are signed in they are stored with Your Account and sync between Your devices. As a guest, they stay on Your Device.
• You can change or clear them at any time in Settings under Diet & Allergies on mobile or Dietary preferences on the web. They are deleted when You delete Your Account.

Entering these preferences is Your choice. By entering them You consent to Our using them as described here, and You can withdraw that consent at any time by clearing them. Where the GDPR applies, this is the explicit consent on which We rely for this information.

Chef

Chef is the AI assistant in Chef's Kiss. When You chat with Chef, We send Your messages, any image or text file You attach, the recipe You opened Chef from, and Your diet and allergy preferences to Our AI provider to generate the reply. The current providers are listed in the Chef's Kiss section of Our Service Providers page, and none of them may use Your conversations to train their models.

• History on Our servers. For signed-in users, Chef history is kept for about 30 days on Free and about 1 year on Plus and Pro, then deleted automatically.
• History on Your Device. The app shows about 7 days of history on Free and for guests, and about 1 year on Plus and Pro.
• Guest chats. We keep a truncated copy of each guest question and reply, with any recipe Chef generated, for 30 days to prevent abuse. Those copies are not linked to an Account.
• Reports. If You report a reply, We receive up to 2,000 characters of the conversation You flagged, any note You add, and Your Account or device identifier, so Our team can review it. Reports stay in a review queue that holds only the 200 most recent reports, and they are not removed when You delete Your Account.
• Usage limits. We count Chef and import requests per Account or device to apply Your plan's limits.

Sharing and Community Features

• Public share links. When You create a share link, We store a copy of that recipe, and anyone with the link can read it on chefskiss.io without signing in. You can keep the copy updated as You edit the recipe, and You can revoke the link at any time in the app.
• Shared libraries and shopping lists. Members of a shared library or shopping list can see what is shared there and the name You chose for shared lists.
• Discover. Discover recipes are published only by Our team. Saving a Discover recipe copies it into Your library. Your own recipes are never published to Discover.
• Referrals. When a friend applies Your referral code, We record the referral so You both receive bonus recipe slots. Requests for a custom code are reviewed by Our team. If either account is deleted, We remove the identifying link between the two accounts, and the other person keeps the bonus.
• Cover images. Cover images that We generate are stored with UploadThing in a shared image library and can be reused as covers for other users' recipes. Photos You upload are also stored with UploadThing. When You delete Your Account, We remove the link between Your Account and Your images, but the image files are not deleted. If You uploaded a photo of Your own and want the file deleted, contact Us and We will delete it.

Purchases and Plans

Plus, Pro, and Local Unlock are purchased through the App Store or Google Play, which process the payment. We never receive Your payment card details. RevenueCat keeps the record that connects a store purchase to Your Account, including an Account identifier, product and transaction identifiers, and purchase and renewal dates. The web companion reads Your plan but does not take payments. Purchase records held by the stores and RevenueCat are kept as needed for accounting, tax, refunds, and fraud prevention, and are not deleted when You delete Your Account. Deleting Your Account does not cancel a subscription; cancel it in Your store account.

Ads

• In the apps. Free and Local Unlock show banner ads served by Google AdMob, and You can choose to watch a rewarded ad for an extra Chef message. Plus and Pro show no ads.
• Your consent. In the European Economic Area, the United Kingdom, Switzerland, and other places where it is required, Google's consent message asks before personalized ads are shown. On iOS, We also ask through App Tracking Transparency. If You decline either one, You see non-personalized ads, which still use device information and IP address to deliver ads, limit how often they repeat, and prevent fraud.
• Your settings. You can turn off Rewarded Ad Offers in Settings under Ads, and You can change Your tracking choice in Your iOS settings or reset Your Android advertising ID.
• On chefskiss.io. Public pages of the website may show Google AdSense ads, and Google may set advertising cookies there. The help wiki is ad-free.

Your recipes, Chef conversations, and diet and allergy preferences are never used for ad targeting.

Notifications

• Pantry expiry reminders and cook timers are scheduled on Your Device, and nothing about them is sent to Us.
• Promo & Tips is off until You turn it on. When You turn it on while signed in, We register Your device's push token so We can send occasional tips and offers through Expo and Apple's or Google's notification service. You can turn it off at any time in Settings under Notifications. We delete the token when You delete Your Account.

Diagnostics, Security, and Abuse Prevention

• App monitoring. Expo receives performance timings and error reports from the mobile apps, with device model, operating system, and app version. They do not include Your recipes or conversations.
• Server logs. Our Chef's Kiss API runs on Cloudflare. It logs a sample of requests, which Cloudflare keeps for up to 7 days, and records usage events linked to an Account or device identifier, which are kept for about 3 months. Records of failed or blocked requests are kept for 30 days.
• Abuse prevention. We use Account, device, and IP address identifiers to enforce usage limits and stop abuse. A block on a device or IP address can remain after the related Account is deleted until We review and lift it.
• Analytics. As of the Last updated date, Chef's Kiss uses no third-party analytics or session-recording tools beyond the ad services described above. If We add one, such as Google Analytics or PostHog, We will name it on Our Service Providers page and update this section before turning it on, and Your diet and allergy preferences will not be sent to it.

How Long We Keep Chef's Kiss Data

• Library, pantry, planning data, and diet and allergy preferences: until You delete them or Your Account.
• Chef history: about 30 days on Free and about 1 year on Plus and Pro. Guest chat copies are kept for 30 days.
• Reports: in the review queue described above.
• Server logs and usage events: up to 7 days for request logs, about 3 months for usage events, and 30 days for failed or blocked requests.
• Plan status: Our cached copy of Your plan status expires within 45 days after it last changed. Store and RevenueCat purchase records are kept as described under Purchases and Plans.
• Deleted Accounts: We keep a permanent record of the deleted Account's identifier, with no name, email address, or content, so that an old session or delayed request cannot recreate deleted data.
• Backups: copies in backups expire as described in the Retention of Your Personal Data section below.

Deleting Your Chef's Kiss Account

You can delete Your Account in the app under Settings, then Account, on mobile or the web. If You cannot sign in, use the account deletion request form linked from the app, or contact Us. Deletion starts immediately and cannot be undone. It removes Your library, pantry, planning data, diet and allergy preferences, Chef history, shared links, push tokens, and sign-in details. It normally finishes the same day and always within 30 days.

What remains is described above: reports You submitted, shared cover images, purchase records held by the stores and RevenueCat, short-lived logs, the deleted-Account record, and copies in backups until they expire. Deleting the app from Your Device does not delete Your Account. Data stored only on a Device is not affected by Account deletion and is removed when You delete the app.

Analytics and Advertising

Our Qutzl websites (qutzl.net, insights.qutzl.net, connect.qutzl.net, and links.qutzl.net) may load Google AdSense for site verification and advertising. As of the Last updated date they carry only the AdSense site-verification tag, show no third-party ad units, and load no analytics service. Public pages of chefskiss.io show Google AdSense ads. The other providers below apply to Our Applications where enabled, and may be used on Our websites in the future; the providers in use are listed on Our Service Providers page. Each provider processes data under its own privacy policy in addition to this one.

Google AdSense (Website Advertising)

Public pages of chefskiss.io, and Our other websites if We enable ads on them, use Google AdSense to serve and measure advertisements. AdSense and its advertising partners may use cookies, device identifiers, IP address, and browsing activity on Our sites to personalize and measure ads. You can manage ad personalization through Google Ads Settings. For more information, see how Google uses information from sites or apps that use Google services.

Google Analytics

Some of Our Applications may use Google Analytics to understand how the Application is used. Google uses the data collected to track and monitor use of those Applications. You can opt out of Google Analytics in Your browser by installing the Google Analytics opt-out browser add-on. For more information on Google's privacy practices, see the Google Privacy Policy.

Google AdMob (In-App Advertising)

Some of Our Applications are ad-supported and display advertising served by Google AdMob and its advertising partners. Ad services may collect and use device advertising identifiers, IP address, and app usage information to serve and measure ads. In the European Economic Area, the United Kingdom, Switzerland, and other places where it is required, Google's consent message asks before personalized ads are shown, and on iOS We also ask through App Tracking Transparency. If You decline, You see non-personalized ads. You can also limit the use of Your advertising identifier through Your device settings:

• iOS / iPadOS: Settings > Privacy & Security > Tracking (App Tracking Transparency), where You can decline tracking requests per app or turn off "Allow Apps to Request to Track" entirely.
• Android: Settings > Privacy > Ads, where You can reset or delete Your advertising ID.

For more information, see how Google uses information from ads.

Product Analytics

Some Applications may use a product analytics service, such as PostHog, to collect feature usage events and session information so We can understand how the Application is used and improve it. Product analytics are not used on Our websites. Where a provider is in use, it is named on Our Service Providers page; see the PostHog Privacy Policy for that provider's practices.

What We Never Use for Ads or Analytics

Your Content, AI chat conversations, diet and allergy preferences, client portal records, and Remote Support Session data are never used for ad targeting or shared with advertising providers. Diet and allergy preferences are also never sent to analytics providers.

Retention of Your Personal Data

Qutzl LLC retains Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy, and afterwards only to the extent needed to comply with legal obligations, resolve disputes, and enforce Our agreements. Backups and archives are encrypted. Our standard periods are:

• Account and Application Content such as saved recipes, meal plans, notes, documents, preferences, and chat history: kept while Your Account is active, except where an Application keeps it for a shorter period, such as Chef's Kiss chat history, described in the Chef's Kiss section above. After You delete Your Account or ask Us to, We delete or anonymize it within 30 days. Copies in routine backups expire within 90 days after that; copies held in long-term archive storage (Amazon S3 Glacier) have a minimum retention period of 180 days and are deleted when that period ends.
• Client portal records: invoices, payments, contracts, and support tickets are kept for 7 years after the account closes to meet tax, accounting, and legal obligations.
• Remote Support Session records: connection logs (date, time, duration, Device name and identifier, IP address, and technician) are kept for 12 months for security and billing. We do not keep video or audio recordings of sessions.
• Managed Services data: handled according to the Business Customer's agreement and returned or deleted when the engagement ends, except for backup copies, which expire within 90 days, or within 180 days where held in long-term archive storage.
• Usage Data and server logs: kept for no more than 12 months unless needed to investigate a security incident or required by law.

Transfer of Your Personal Data

Qutzl LLC is based in the United States of America, and Our Service Providers operate in the United States of America and other countries. If You access the Service from outside the United States of America, Your information will be transferred to, stored, and processed in the United States of America and in the locations listed on Our Service Providers page, where data protection laws may differ from those of Your jurisdiction.

Where the GDPR or UK data protection law applies, We take the steps those laws require for international transfers, such as relying on Service Providers certified under the EU-U.S. Data Privacy Framework or on standard contractual clauses, and We apply the safeguards described in the Security section regardless of where data is processed. You may request more information about these safeguards through the contact methods below.

Delete Your Personal Data

You have the right to delete, or to ask Us to delete, the Personal Data We have collected about You. You can do this by signing in to Your Account and using the in-app deletion or export controls where available, by opening a ticket at Our support desk or using Our contact form, or, for Chef's Kiss, by using the account deletion request form linked from the Application. We will confirm Your request, verify Your identity where necessary, and complete deletion within 30 days, except for data We must keep to meet legal obligations, resolve disputes, or enforce Our agreements.

Deleting an Application from Your Device does not by itself delete Account data stored on Our systems. Store purchase history remains subject to the applicable Store's records and policies. Data held in a Business Customer's systems is controlled by that customer; please direct requests about it to them.

Disclosure of Your Personal Data

Business Transactions

If Qutzl LLC is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, Qutzl LLC may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Security of Your Personal Data

The security of Your Personal Data is important to Us. We use commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Data, such as encryption of data in transit and at rest, including Our backups and archives, access controls that limit data to the people who need it, and reputable hosting providers. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and We cannot guarantee absolute security.

If We become aware of a breach of security affecting Your Personal Data, We will notify You and the relevant authorities where required by applicable law.

Children's Privacy

Our Service is intended for adults and is not directed to anyone under the age of 18. We do not knowingly collect Personal Data from anyone under 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us through Our support desk. If We become aware that We have collected Personal Data from anyone under 18 without verification of parental consent, We will take steps to delete that information.

GDPR Privacy (Legal Basis & Rights)

Legal Basis for Processing

If You are in the European Economic Area or the United Kingdom, We process Personal Data only when We have a legal basis to do so, which may include: Your consent; performance of a contract with You; compliance with a legal obligation; protection of vital interests; or Our legitimate interests (such as operating, securing, and improving the Service), provided those interests are not overridden by Your rights. Diet and allergy preferences in Chef's Kiss can be special category data about health or religious beliefs, and We process them only with Your explicit consent, as described in the Chef's Kiss section above.

Your Rights under GDPR

Where the GDPR applies to You, You have the right to:

• Request access to the Personal Data We hold about You.
• Request correction of inaccurate or incomplete Personal Data.
• Request erasure of Your Personal Data, subject to legal retention requirements.
• Object to or request restriction of Our processing of Your Personal Data.
• Receive a copy of Your Personal Data in a portable format.
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, use any of the methods in the Contact Us section. We will respond within one month, extendable as the law allows for complex requests, and may need to verify Your identity before acting on a request. You also have the right to lodge a complaint with Your local data protection authority. Where We process Personal Data on behalf of a Business Customer, We will refer Your request to that customer and support its response.

CCPA/CPRA Privacy Notice (California Residents)

This section applies to California residents, to the extent the CCPA/CPRA applies to Qutzl LLC, and supplements the rest of this Privacy Policy. In the preceding twelve months We have collected the following categories of personal information, from You directly, from Your Devices, from Stores and sign-in providers, and from Business Customers: identifiers (such as name, email address, IP address, and account or Device identifiers); customer records (such as billing address, company, and payment confirmation details); commercial information (such as purchases and subscriptions); internet or network activity (such as pages visited and Application usage); approximate location derived from IP address; the Content You provide to Our Applications; and sensitive personal information, namely account login credentials and the Chef's Kiss diet and allergy preferences that may reveal health information or religious beliefs. The sources, purposes, and retention periods are described in the Collecting and Using Your Personal Data, Use of Your Personal Data, Chef's Kiss, and Retention sections above. We use sensitive personal information only to provide the Service You request and to secure Your Account, not to infer characteristics about You, and We do not knowingly sell or share the personal information of consumers under 16 years of age.

Selling and Sharing

We do not sell personal information in exchange for money. Where Our websites or Applications use third-party analytics and advertising services (such as Google AdSense, Google Analytics, and Google AdMob), that use may involve the disclosure of identifiers and internet activity information for cross-context behavioral advertising, which the CCPA/CPRA treats as "sharing." You have the right to opt out of that sharing.

Your Rights

As a California resident, You have the right to:

• Know the categories and specific pieces of personal information We have collected about You.
• Request deletion of Your personal information, subject to legal exceptions.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of Your personal information.
• Not receive discriminatory treatment for exercising Your privacy rights.

How to Exercise Your Rights

Submit a request through Our online support desk at https://billing.qutzl.net/submitticket.php, or by any other method in the Contact Us section. We may need to verify Your identity before responding, and You may designate an authorized agent to submit requests on Your behalf. To opt out of sharing for cross-context behavioral advertising, You can also use the device and browser controls described in the Analytics and Advertising section above, and We honor the Global Privacy Control (GPC) signal as an opt-out request where legally required.

Privacy Rights in Other U.S. States

Several other states, including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon, have consumer privacy laws. Whether or not those laws apply to Qutzl LLC, We offer residents of every U.S. state the same rights:

• Confirm whether We process Your personal data, and access it.
• Correct inaccurate personal data.
• Delete personal data You provided or that We hold about You, subject to legal exceptions.
• Obtain a portable copy of Your personal data.
• Opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We do not sell personal data or use it for that kind of profiling.

We process sensitive data, such as Chef's Kiss diet and allergy preferences, only with Your consent or as needed to provide the feature You request. Submit requests by any method in the Contact Us section, and We will respond within 45 days, extendable once by 45 days where the law allows. If We decline Your request, You can appeal by replying to Our decision within 60 days. We will answer the appeal in writing within 60 days, and if You are not satisfied You may contact the attorney general of Your state.

Do Not Track and Global Privacy Control

We do not respond to legacy "Do Not Track" (DNT) browser signals, as no common industry standard for DNT was ever adopted. Where required by applicable law, We honor the Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal information for the browser in which it is enabled.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date at the top. For material changes, We will make reasonable efforts to provide more prominent notice, such as an email or an in-app notice, before the change becomes effective. You are advised to review this Privacy Policy periodically; changes are effective when posted on this page unless the notice states a later date. Each revision is summarized in the Revision History section below.

Contact Us

If You have any questions about this Privacy Policy or wish to exercise any of Your privacy rights, You can contact Us by any of these methods:

• Online Support Desk: https://billing.qutzl.net/submitticket.php
• Contact form: https://billing.qutzl.net/contact.php
• Mail: Qutzl LLC, Attn: Privacy, PO Box 154, Karthaus, PA 16845, United States of America

Revision History

• October 13, 2026: Added the Chef's Kiss section, covering accounts, stored data, imports, diet and allergy preferences, Chef chat history, sharing, purchases, ads, notifications, diagnostics, retention, and account deletion, and linked the new Consumer Health Data Privacy Policy; disclosed diet and allergy preferences as sensitive information, with the consent they rely on under the GDPR and their category under the CCPA; added the Privacy Rights in Other U.S. States section; corrected how Chef's Kiss sign-in works and the definition of a California resident; named UploadThing, RevenueCat, and Expo and the image models used for recipe covers; disclosed AdSense ads on chefskiss.io and the consent requested for personalized in-app ads; and committed that diet and allergy preferences are never sent to advertising or analytics providers.
• October 12, 2026: Added the Billing Portal and Payments, Remote Support Sessions, Managed Services Data, Contact and Request Forms, Service Providers We Use, and Business Customers and Managed Services sections; rewrote the cookie, retention, international transfer, and deletion sections to match current practice; named Our payment processors, AI providers, and infrastructure providers; removed sharing with business partners; added the contact form and postal address as contact methods; and clarified that the GDPR and CCPA sections apply only where those laws apply.
• July 26 to 28, 2026: Rewrote the GDPR and CCPA sections; added the Security, Children's Privacy, Changes, and Do Not Track and Global Privacy Control sections; added Analytics and Advertising disclosures and the Apple and Google sign-in options; named Qutzl LLC and broadened coverage beyond recipe Applications, multiple app stores, AI features, and in-app purchases.
• December 11, 2025: First published version.