AI recipe generator and data privacy: what really happens to your data?

A legitimate concern

In 2026, AI is everywhere — and with every new AI application comes the same question: what actually happens to my data?

With a recipe generator, you enter:

• Ingredients in your fridge (which says something about your lifestyle)
• Allergies and intolerances (sensitive health data!)
• Dietary preferences (vegan, low-carb…)
• Family composition (how many people, possibly with different diets)
• Indirectly, income indicators too (premium ingredients vs. basics)
• Buying behaviour (how often you cook, what you like, what you hate)

That is not trivial. In the hands of an ad-funded provider, this data potentially ends up with:

• Food manufacturers for targeted ads
• Insurers (risky eating patterns?)
• Data brokers who sell profiles

For a simple question like “what shall I cook today?”, that is absurd. But that is simply the business model of many free platforms: if you're not paying, you are the product.

How our model works

At KI-Kochhilfe, users pay directly. That means we are not dependent on advertising revenue and have no need to monetise your data.

We process data only to:

1. Deliver better recipes to you (personalisation within your account)
2. Keep the platform working technically (login, billing)
3. Meet legal obligations (accounting, GDPR access-request obligations)

Full stop. No data sales, no ad targeting, no profile-building for external third parties.

What we actually store

Here is the honest list — including the things you would normally only find in the privacy policy, if you read it.

Mandatory data (for the account)

• Email address — for login and invoicing
• Name (optional) — for a personal greeting in emails
• Stripe customer ID — the billing details are stored at Stripe, not with us. We only hold the ID reference.
• Account status (Basis/Standard/Premium, subscription status)

Stored for functionality (in your account)

• Your generated recipes (quota of 30/65/90 per month depending on plan — they stay in your account until you delete it)
• Your saved favourite recipes (Basis: up to 10, unlimited from Standard)
• Allergies & exclusions (entered from Standard; automatic allergen detection is included in every plan) — Art. 9 GDPR (“special categories of personal data”)
• Family profiles with names + diets (from Standard, also in the free trial account)
• Weekly menus (Premium)

Technically essential

• Cookie: login session (Secure, SameSite) — no login possible without it
• Cookie: identifier for the 2 trial recipes without an account (12 months, together with an IP hash against abuse) — the same identifier unlocks the 2 free gallery recipes
• Browser storage (LocalStorage): cookie notice confirmed, onboarding marker (have we welcomed you before?), checkout success shown, entered referral code

Without consent, but without tracking (legitimate interest)

• Umami — reach measurement, self-hosted on our own server, cookie-free, stores no IP addresses, shares no data with third parties
• Sentry — error reports for bug fixes (EU region; IP address is truncated, session recordings only on errors and with masked text, form input is never captured)

Optional (only with your consent)

• Google Analytics 4 — reach measurement (stores no IP addresses)

If you decline in the cookie banner: GA4 is not set. The site still works 100%.

What we definitely do NOT do

Just as important as what we do — what we don't do:

• ❌ No advertising
• ❌ No ad-targeting cookies (Facebook pixel, TikTok pixel etc.)
• ❌ No data sold to third parties
• ❌ No “retargeting” — we don't follow you around the web
• ❌ No advertising newsletter
• ❌ No unsolicited promo emails — you can unsubscribe from recipe suggestions by email at any time
• ❌ No data to health insurers, insurance companies, banks
• ❌ No storage of your credit card details (Stripe handles that — we never see them)
• ❌ No access to your contacts / address book / location

Where is data stored?

What	Where	Provider
Main data (recipes, account)	Ireland (AWS eu-west-1), EU	Supabase
Payment processing	Ireland (sub-processing in the USA)	Stripe Payments Europe Ltd.
Transactional emails	USA (SCC + Data Privacy Framework)	Resend, Inc.
Server logs (technical)	Frankfurt am Main, DE	Hostinger (DE location)
Reach measurement (Umami)	Frankfurt am Main, DE	self-hosted
Error monitoring: Sentry	Frankfurt am Main, DE	Sentry (EU region)
Optional: GA4	EU + USA	Google (DPF safeguard, no IP storage)

Important: all main data stays in the EU. The only things that go to the USA are transactional emails (Resend) and — if you have consented — GA4 usage data, both safeguarded by the Data Privacy Framework (DPF) or EU standard contractual clauses.

How does the AI work in detail?

When you enter ingredients and click “Generate recipe”, this is what happens:

1. Your input is sent to our own servers in Frankfurt.
2. The server formulates a request to OpenAI (the AI model running in the background).
3. This request contains:
   • Your ingredients
   • Your preferences (diet, allergies, AirFryer yes/no, servings)
   • The titles of your recent recipes (so nothing repeats) and — if you have set them up — the first names of your family profiles
   • NOT included: your name, your email, your account ID, payment details. Instead of your name, the request carries a pseudonym (“Koch”) and an internal request number.
4. OpenAI generates the recipe and sends it back; for the recipe photo a second request follows (gpt-image-2), which only describes the dish
5. We store it in your account and display it to you

Important: OpenAI receives pseudonymised requests. They don't know who you are, they can't contact you, they see no payment details. All they see is: “someone wants a recipe with chicken, broccoli and rice, gluten-free, 2 servings.”

OpenAI also provides an API data-privacy guarantee: API requests are not used to train new models (unlike ChatGPT requests in the web interface). Source: OpenAI's privacy notes for the API (linked in our privacy policy).

Your rights (GDPR)

In the EU you have certain rights, which we actively implement:

Right of access (Art. 15)

On the account page, under “Export my data”, you can download a JSON file with all the data stored about you at any time — instantly. If you ask by email at support@ki-kochhilfe.de, we reply within one month.

Right to erasure (Art. 17)

You can delete your account at any time — the “Delete account” button is available directly on the account page. All your data is removed immediately and irrevocably (database backups: 7 days).

Exceptions: we must retain invoice data for the statutory retention periods (§ 147 AO, § 257 HGB — up to 10 years). This data is, however, no longer actively usable.

Right to rectification (Art. 16)

You can change your email address, name and preferences yourself at any time.

Right to data portability (Art. 20)

The GDPR export is in machine-readable JSON — you can take everything with you.

Right to object (Art. 21) and to withdraw consent (Art. 7(3))

You can unsubscribe from recipe suggestions by email at any time (link in every email). You can withdraw your cookie consent at any time (footer link “Cookie-Einstellungen” / cookie settings).

Right to lodge a complaint

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the competent supervisory authority. For us, that is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, seat: Stuttgart).

What would happen in the event of a data breach

We hope it never happens. But if it does:

1. Within 72 hours, notification to the supervisory authority (Art. 33 GDPR)
2. Direct notification of affected users if sensitive data is involved
3. Transparent communication about scope and measures
4. Post-mortem publication on our website and by email to those affected

We have described an incident response plan in our privacy policy.

How can you check this yourself?

We believe in transparency through verifiability, not just words. You can:

1. Open your browser's DevTools (F12) → “Network” tab → load a page. Look at which external URLs are called. You will see:

   • Our own domain (ki-kochhilfe.de, incl. analytics.ki-kochhilfe.de for Umami)
   • Stripe (only at checkout)
   • Supabase (auth, DB, recipe images)
   • Sentry (error monitoring, EU)
   • Optional: Google Analytics (only if enabled)

2. Use tracker-scanner tools such as Privacy Badger or uBlock Origin. You'll see: no ad trackers, no pixels.

3. Check the open-source libraries in the HTML source. We use Next.js, Tailwind CSS and the Supabase client SDK — all documented and open source.

Comparison: us vs. typical free recipe portals

Aspect	Us	Typical free recipe site
Advertising	Never	Everywhere
Ad trackers	None	20–50 trackers per page
Facebook pixel	No	Yes
TikTok pixel	No	Often yes
Data to manufacturers	Never	Possible (often hidden in the T&Cs)
Advertising newsletter	Never (recipe suggestions can be unsubscribed at any time)	Common, often without a real opt-in
Server location	EU (Frankfurt + Ireland)	Often USA
AI requests identifiable	No (pseudonymised)	– (no AI)

Frequently asked questions

Do you store my IP address?

Server logs (Nginx) store IPs for 14 days to defend against attacks. After that they are deleted automatically. They are not linked to your account.

What if I want to use it anonymously?

You can generate 2 recipes without an account (for this we set a cookie and store a hash of your IP address — purely to prevent abuse). For more you need an account, because otherwise no personalisation is possible.

Do you use my data to train the AI?

No. We don't train our own models and we don't send user data to OpenAI for their training. The OpenAI API (which we use) stores requests for 30 days for abuse detection and then deletes them.

Can I enable a non-personalised mode?

If you don't enter any allergies/diets/family profiles, generation is preference-free — apart from the titles of your recent recipes, so nothing repeats. You enter only ingredients and get a neutral recipe.

What happens after I close my account?

Immediately: all active data deleted. 7 days: database backups overwritten. Up to 10 years: invoice data archived (statutory retention periods), but no longer actively usable.

Conclusion

Data privacy in AI applications is not a “nice extra” — it is the foundation of trust. We made that choice from the very start:

• ✓ EU servers
• ✓ No ad tracking
• ✓ No data sales
• ✓ Pseudonymised AI requests
• ✓ Full GDPR rights
• ✓ Transparent documentation

If you want to use AI in the kitchen without the contents of your fridge becoming a marketing database: give us a try.

→ Try 2 recipes for free — no trackers, no spam

---

Full details: privacy policy and terms and conditions. Questions: support@ki-kochhilfe.de.