Last updated: September 2026 · This privacy policy fulfils the information obligations under Art. 13 and Art. 14 GDPR.
The controller responsible for data processing within the meaning of the GDPR is:
KI-Kochhilfe UG (haftungsbeschränkt)
Hauptstraße 209
79365 Rheinhausen, Germany
Phone: +49 (0) 7643 / 9490620
Email: support@ki-kochhilfe.de
Authorized representative: Danyi György (sole power of representation / einzelvertretungsberechtigt)
We have not appointed a data protection officer, as the statutory requirements for doing so (Art. 37 GDPR, § 38 BDSG) are not met. If you have questions about data protection, please contact the address given in § 1 directly.
We take the protection of your personal data very seriously. Personal data is any data by which you can be personally identified (Art. 4(1) GDPR).
All data transmitted between your device and our servers is encrypted in transit (TLS 1.2 or higher). Your browser indicates this with a lock symbol.
Please note: data transmission over the internet (e.g. when communicating by email) may have security gaps; complete protection against access by third parties is not possible.
When you visit our website, the following data is stored in server logs to ensure functionality and IT security:
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical provision, stability and security of the website, including defense against attacks).
Storage period: server logs are automatically deleted after a maximum of 14 days (log rotation), unless a specific security-relevant incident makes longer retention necessary in an individual case.
Technical error monitoring (Sentry): To detect and fix technical errors, we use the service Sentry (Functional Software, Inc., EU region in Frankfurt am Main, Germany). In the event of an application error, technical information (error message, stack trace, anonymized URL, user agent, anonymized IP address) as well as a masked session replay (all text and media are pixelated before transmission; input into form fields is not captured) is transmitted to Sentry. No profiling takes place; the data serves exclusively for error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability, security and error correction of the application).
Storage period: error events are retained at Sentry for 30 days by default, session replays for 30 days, and are then automatically deleted. For details see § 13 (processors).
We use technically necessary cookies and browser storage that are required for sign-in and session management. In addition, we use after your express consent Google Analytics 4 for reach and usage analytics (see below). Other marketing or tracking cookies (e.g. Meta Pixel, Hotjar, TikTok Pixel) are not used.
In detail:
sb-vhqqydhchixdycwrmomq-auth-token (cookie)
Authentication cookie after successful login. Contains a session token (JWT) and refresh token.
Provider: Supabase / KI-Kochhilfe · Lifetime: until sign-out or up to 7 days
Legal basis: § 25 Abs. 2 Nr. 2 TTDSG (technically required) · Art. 6(1)(b) GDPR
cookie_consent (LocalStorage)
Stores your confirmation of the cookie notice so the banner does not appear again.
Lifetime: 12 months · Legal basis: § 25 Abs. 2 Nr. 2 TTDSG, Art. 6(1)(f) GDPR
onboarding_done, checkout_complete, ki_referral_code (LocalStorage)
Functional UX markers so that the onboarding modal and the checkout success banner do not appear repeatedly and an entered invitation code is preserved until payment.
Lifetime: permanent in the browser, until you delete it there.
Legal basis: § 25 Abs. 2 Nr. 2 TTDSG (technically required for the function requested by the user).
You can delete cookies in your browser at any time or block them from being set. If the necessary cookies are blocked, signing in to the service is technically not possible.
Reach analytics with Google Analytics 4 (only with consent):
_ga, _ga_* (cookies, set by Google Analytics)
If you choose “Accept all” („Alle akzeptieren“) in the cookie banner, we load Google Analytics 4 (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; sub-processing Google LLC, USA) to analyze the use of the website anonymously (page views, time on site, approximate region). IP addresses are truncated before analysis (anonymize_ip = true); no linking with other personal data takes place.
Lifetime: up to 24 months · Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25 Abs. 1 TTDSG (consent); processing on our behalf pursuant to Art. 28 GDPR; USA third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework.
Withdrawal: You can withdraw your consent at any time via the cookie-banner reset link at the bottom of the page (“Cookie-Einstellungen” / cookie settings). Upon withdrawal, GA cookies are immediately no longer set, and you can delete existing GA cookies in your browser.
Reach analytics with Umami (self-hosted, without cookies):
In addition, we use Umami – an open-source reach analytics tool operated by ourselves on our own server (Hostinger VPS, see § 13). Umami works without cookies and transmits no data to third parties. Only aggregated, anonymous usage data is collected (page views, approximate region at country level, browser/device type, referring page). No cookies are set and no full IP addresses or personal data are stored; the IP address is merely used temporarily to create an anonymous, daily-changing identifier and is not stored. Identification of individual persons is not possible.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a privacy-friendly reach measurement). Since no cookies or comparable technologies are used and no personal data is stored, no consent is required for this (§ 25 Abs. 2 Nr. 2 TTDSG); the analytics is therefore active even without consent in the cookie banner. You can object to the reach measurement at any time (contact see § 1).
We additionally offer our service as a native app for iOS and Android. The app is a technical access channel (WebView wrapper) to the same platform; all other sections of this privacy policy apply accordingly. The following processing operations take place exclusively in the app:
(a) Push notifications.
If you grant the app the permission to send notifications, your device registers with the push service and receives a device-specific push token. We store this token – linked to your account ID – in our database (table push_tokens) in order to be able to deliver notifications (e.g. notes about new recipes or account events) to you. Delivery takes place via Firebase Cloud Messaging (Google) – on iOS technically via the Apple Push Notification service (APNs). No notification content with special personal reference beyond the token and the delivery information is transmitted to third parties.
Legal basis: Art. 6(1)(a) GDPR (consent via the system prompt) in conjunction with § 25 Abs. 1 TTDSG.
Withdrawal: at any time via the notification settings of your device; after sign-out or withdrawal the token is deactivated.
Storage period: until sign-out, until withdrawal of the permission, or until the token is reported back as invalid by the push service. For recipients see § 13 (Firebase Cloud Messaging, Apple).
(b) Biometric sign-in (Face ID / Touch ID / fingerprint).
You can optionally set the app so that it is locked via biometrics when opened and so that, after signing out, you can sign in again without entering a password. The biometric check is performed entirely locally by the operating system (Apple/Google) in the secured area of the device (Secure Enclave or Keystore). We do not collect, store or transmit any biometric data; the operating system merely informs us of the result “successful/cancelled”. Therefore, no processing of biometric data within the meaning of Art. 9 GDPR takes place on our part.
If you additionally activate biometric re-sign-in, your sign-in credentials (email and password) are stored exclusively in the hardware-encrypted key store of the device (iOS Keychain / Android Keystore) and protected biometrically; they leave the device only as an ordinary sign-in to our service (as with manual entry). An opt-in flag is set locally (ki_biometric_enabled). When you deactivate the function, the stored credentials are deleted from the device.
Legal basis: Art. 6(1)(a) GDPR (consent by activation) or Art. 6(1)(b) GDPR (performance of the contract – convenient sign-in).
Upon registration, we collect and process the following data: salutation, first name, last name, email address, password (stored encrypted), optionally company name. To verify your email address, we send a six-digit confirmation code (valid for 10 minutes), which we store temporarily in your profile and delete again after successful entry.
Purpose: identification, contract processing, prevention of fraud and multiple registrations.
Legal basis: Art. 6(1)(b) GDPR (initiation/performance of the contract).
Storage period: until deletion of the account plus statutory retention obligations (in particular 10 years under § 147 AO for invoice- and tax-relevant data).
Automatic deletion after the end of the contract: If your paid subscription ends (cancellation), your account and your saved recipes initially remain available in read-only mode. Three (3) months after the end of the paid billing period, your account and all associated personal data (including saved recipes) are automatically and permanently deleted, unless you reactivate your subscription beforehand (principle of storage limitation, Art. 5(1)(e) GDPR; erasure pursuant to Art. 17 GDPR). We will inform you by email in good time before the deletion. Pausing the subscription does not trigger this deletion period. Statutory retention obligations (see above) remain unaffected.
Sign-in data about your session (device mode “browser” or “PWA”, platform “ios/android/desktop”) is processed to adapt the display and for internal usage statistics (aggregated) (Art. 6(1)(f) GDPR – legitimate interest in optimizing the platform).
Optionally, instead of using email and password, you can also register and sign in via your existing Google account (“Continue with Google” / „Mit Google fortfahren“, OAuth 2.0 procedure).
Data transmitted: When you use this function, we receive from Google the email address linked to your Google account, your displayed name and a unique Google account identifier. Your Google password is never transmitted to us.
Purpose: creation of or sign-in to your user account without a separate password.
Legal basis: Art. 6(1)(b) GDPR (initiation/performance of the contract) and Art. 6(1)(a) GDPR (consent by actively selecting the Google sign-in).
Recipients / third-country transfer: When signing in, a connection to Google is established. The provider is Google Ireland Ltd. (Ireland) or Google LLC (USA); the third-country transfer is safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR) and the EU-US Data Privacy Framework (see § 13).
Voluntariness: Signing in with Google is voluntary; registration with email address and password is available at any time as an alternative. Further information about data processing by Google can be found in Google’s privacy policy (policies.google.com/privacy).
To create the recipes and images you request, your inputs (prompts, selected options such as AirFryer mode, allergens, dietary preferences) are transmitted to our AI processor OpenAI and processed there.
Data processed: your input texts, the salutation “Koch” (pseudonym), an internal request number. No link to your email address or your real name is established in the transmission process.
Purpose: performance of the contract for AI generation.
Legal basis: Art. 6(1)(b) GDPR.
Third-country transfer: OpenAI processes data in the USA, among other places. The transfer takes place on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and OpenAI’s certification under the EU-US Data Privacy Framework.
Note “no model training”: According to its own assurance, OpenAI does not use API data to train or improve its models. We nevertheless recommend not including sensitive personal data of third parties (e.g. real names, addresses, health information) in your inputs.
The generated recipes and images are stored in our Supabase database (EU) and in the storage and assigned to your account.
If you specify allergies, intolerances or medically motivated diets (e.g. diabetic diet, gluten-free due to celiac disease) in your profile or when creating a family member, this constitutes so-called “special categories of personal data” within the meaning of Art. 9(1) GDPR (health data).
Legal basis: Art. 9(2)(a) GDPR — explicit consent. You grant this via the separate checkbox during registration (“Optional: processing of allergy and diet data as a special category of data”) or by entering an allergy in the account area for the first time.
Purpose: personalization of the recipe suggestions — the AI automatically takes these details into account so that no incompatible recipes are suggested to you.
Withdrawal: You can withdraw your consent at any time without giving reasons by clearing the corresponding fields in the account area or by using the “Delete account” function. The withdrawal does not affect the lawfulness of past processing.
Family members (Standard and above): If you enter allergies for a family member, you affirm that you have obtained the express consent of the family member concerned (or, in the case of minors, of their legal guardians).
Transmission to OpenAI: Allergy/diet details are transmitted to OpenAI as part of the prompt (see § 7 and § 14). They are not used there for training and are automatically deleted after a maximum of 30 days. The transmission is safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.
In the recipe generator (and on the trial page) you can dictate your ingredients and wishes instead of typing them. The feature starts only when you tap the microphone iconand stops when you tap it again or automatically at the end of your input. The microphone is never activated without your action. The icon only appears in browsers that offer speech recognition.
Processing by your browser: the conversion of speech to text is performed by the speech recognition of your own browser or operating system (Web Speech API) – depending on your browser, the service of Apple (Safari), Google (Chrome) or Microsoft (Edge), partly directly on the device. The privacy policy of the respective browser vendor applies to this processing; we have no influence on it and receive no audio data. The recognition language follows the recipe language you selected; with “Automatic” (or if your browser does not support that language) it follows your browser language.
What we receive: only the recognized text, which is inserted into the input field. You can correct it as you like before sending. From the moment you send it, it is treated like typed input (see § 7). We store no recordings and set no cookies for the dictation feature.
Legal basis and note: the feature is provided on the basis of Art. 6(1)(b) GDPR (performance of contract) or, for the trial page, Art. 6(1)(f) GDPR. If you dictate allergies or health-related diets, the rules of § 7a apply unchanged.
Payment processing is carried out exclusively by our payment service provider Stripe. We ourselves do not receive or store any complete credit card or bank data. Stripe processes the payment data under its own responsibility and merely provides us with an anonymized customer and subscription identifier as well as status and invoice data.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Stripe-specific cookies are set exclusively on Stripe’s own domains when the payment page is accessed (checkout.stripe.com). For more information, please refer to Stripe’s privacy policy (see § 13).
We send the following emails:
Legal basis: Art. 6(1)(b) GDPR (transactional emails) or Art. 6(1)(f) GDPR (legitimate interest in customer retention for retention emails).
Two separately unsubscribable marketing categories:
Unsubscribing — separately per category: Each email contains at the end an “…unsubscribe” link that deactivates only that category (internal columns retention_email_opt_out and weekly_digest_opt_out). In addition, all emails contain a List-Unsubscribe header (RFC 2369 / RFC 8058), so many email programs display their own “unsubscribe” button. Alternatively, a short message to support@ki-kochhilfe.de suffices. No costs are incurred. Transactional emails (confirmations, invoices, support replies) are not affected by this, as they are legally required for the performance of the contract.
You can submit reviews on the website (star rating 1-5 + comment). For technical reasons (protection against spam and multiple reviews) we store a SHA-256 hash of your IP address – but not the IP address itself – for a period of 24 hours. Reviews are manually approved before publication. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in spam prevention) and Art. 6(1)(a) GDPR in the case of a voluntary comment.
Authenticity of reviews (§ 5b Abs. 3 UWG): We publish exclusively reviews that originate from registered and signed-in accounts. The authenticity of each review is ensured by the sign-in requirement as well as by the IP hash stored under this provision (prevention of multiple reviews). A review can only be submitted after the respective user has used the service with an active account; a direct technical verification of the specific order reviewed does not take place (comparable to hotel and software review platforms).
Display of reviews: Published reviews are displayed without exception in chronologically descending order (newest first) without algorithmic weighting or paid placement. Negative or critical reviews are not hidden or moved down. Manipulation of reviews (by our own employees, by targeted rewards for positive reviews, or by removing justified criticism) does not take place. A review can only be rejected by the provider if it is obviously unlawful (e.g. insult, false factual claim), devoid of content (spam) or not related to the service; rejectable reviews do not appear in the list at all and are not merely displayed further down.
If you contact us via the support form or by email, we process the data transmitted in the request (name, email, plan, request text) to answer your request. Legal basis: Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR. The data is deleted as soon as it is no longer required for answering the request, at the latest after expiry of the limitation period (regularly 3 years, § 195 BGB).
At /galerie we operate a publicly viewable collection of AI-generated recipes. Publication of your saved recipes takes place exclusively after your express prior consent(opt-in via your account area) and only after an editorial quality check by us.
Published content: recipe name, description, ingredients, preparation steps, tips, where applicable an AI-generated cover image, tags and allergen notes. No personal data (name, email address, pseudonym) of the creator is displayed; publication is completely anonymous.
Legal basis: Art. 6(1)(a) GDPR (consent). The consent can be withdrawn at any time with effect for the future in the account area; recipes already published are removed from the gallery within 7 days of withdrawal.
Storage period: until withdrawal of the consent or until the time of an editorial removal.
Account deletion: If you delete your account, recipes already published in the gallery are anonymized (your user ID, personal rating, feedback and rating timestamp are removed). The recipe itself (title, ingredients, steps, image) remains accessible under its current slug – but now without any link to your person. This is unobjectionable under data protection law, since the published content was posted anonymously (without name or email) from the outset and, after anonymization, no inference about you is possible anymore. If you also want the recipe content completely removed from the gallery, please withdraw your consent in the account area before the account deletion; the recipes will then be removed from the gallery on request before the account deletion.
Adding a gallery recipe to your own collection (“Save”): Subscribers of all plans (on the Basis plan within the 10-recipe save limit) can add public gallery recipes to their private saved recipes in exchange for the consumption of 1 recipe credit. When saving, we create a complete copy of the gallery recipe in your private recipe list (title, description, ingredients, preparation steps, tips, tags, allergen notes and – if available – the AI cover image). In addition, we internally store the slug of the source recipe (technical field cloned_from_slug) to detect duplicate saves and to display the complete content to you again after saving. No personal dataof the original creator is transferred, as the gallery is operated anonymously anyway (see above). Legal basis: Art. 6(1)(b) GDPR (performance of the contract for the selected plan feature).
Preview before saving: Before saving, only the first two preparation steps of the recipe are delivered to your browser on the gallery detail page; the remaining steps are hidden server-side and are visible neither in the HTML source code nor via the browser developer tools. The complete step-by-step instructions are only loaded into your own collection after successful saving. This measure serves to protect our AI-generated content. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Private copy and grandfathering: A later removal of the source recipe from the gallery (e.g. due to withdrawal of the publication consent of the original creator or an editorial removal) does not affect your already saved private copy. The private copy remains in your own recipe collection until you delete it yourself or close your account. The consumed recipe credit is not refunded, neither upon removal of the source recipe nor upon a deletion of the private copy carried out by yourself (see § 21a of the Terms (AGB)).
As part of the referral program, we store the code assigned to you, its status, the expiry date and, where applicable, the information which user redeemed the code. We do not pass on your real name or your email address to code redeemers. Legal basis: Art. 6(1)(b) GDPR.
We use the following external service providers. Data processing agreements pursuant to Art. 28 GDPR (DPA) are in place with all processors. Third-country transfers are safeguarded by EU Standard Contractual Clauses and – where applicable – by certifications under the EU-US Data Privacy Framework.
Supabase Inc.
Purpose: Authentication, database (profiles, recipes, reviews, support messages), file storage (AI images).
Location: Data residency: AWS eu-west-1 (Ireland, EU). Corporate headquarters: Singapore / USA.
Legal basis / safeguard: Processing on our behalf (Auftragsverarbeitung) pursuant to Art. 28 GDPR; where access occurs from the USA: EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework.
OpenAI Ireland Ltd. / OpenAI, L.L.C.
Purpose: AI inference for recipe and image generation (models gpt-image-2, gpt-5.4-mini, gpt-5.4-nano).
Location: Processing region includes, among others, the USA. Contracting entity for EU customers: OpenAI Ireland Ltd., Dublin.
Legal basis / safeguard: Processing on our behalf pursuant to Art. 28 GDPR; third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework. Under its current terms of service, OpenAI does not use API inputs for model training.
Stripe Payments Europe Ltd. / Stripe, Inc.
Purpose: Payment processing (credit card, SEPA), subscription management, invoicing, fraud prevention.
Location: Primary processing: Stripe Payments Europe Ltd., Dublin (Ireland). Sub-processing in the USA.
Legal basis / safeguard: Necessity for the performance of the contract (Art. 6(1)(b) GDPR); third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework.
Resend, Inc.
Purpose: Sending of transactional emails (verification codes, referral codes, support confirmations, retention emails).
Location: USA.
Legal basis / safeguard: Processing on our behalf pursuant to Art. 28 GDPR; third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework.
Hostinger International Ltd.
Purpose: VPS server hosting (Next.js application, Nginx web server), sending of support replies via SMTP.
Location: Data center in Germany (Frankfurt am Main). Corporate headquarters: Cyprus (EU).
Legal basis / safeguard: Processing on our behalf pursuant to Art. 28 GDPR. Processing within the EU.
Functional Software, Inc. d/b/a Sentry
Purpose: Error and performance monitoring (aggregation of technical error logs, stack traces, anonymized session replays in case of errors). Serves the stability and security of the application; no profiling.
Location: EU region: Sentry GmbH or Sentry data center in Germany (Frankfurt). Corporate headquarters: USA.
Legal basis / safeguard: Legitimate interest in ensuring error-free operation (Art. 6(1)(f) GDPR); processing on our behalf pursuant to Art. 28 GDPR. Storage and processing of the raw events exclusively in the EU; session replays are recorded with masked text and media.
Google Ireland Ltd. / Google LLC (Google Analytics 4)
Purpose: Anonymous reach and usage analytics (page views, time on site, approximate region). Activated exclusively after consent via the cookie banner. IP addresses are truncated before analysis (anonymize_ip = true).
Location: Contracting entity for EU customers: Google Ireland Ltd., Dublin. Sub-processing in the USA by Google LLC.
Legal basis / safeguard: User consent (Art. 6(1)(a) GDPR in conjunction with § 25 Abs. 1 TTDSG); processing on our behalf pursuant to Art. 28 GDPR; USA third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework. Consent can be withdrawn at any time via the cookie banner.
Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging)
Purpose: Delivery of push notifications to the native app on Android AND iOS devices (on iOS technically via the Apple Push Notification service). Only the device-specific push token is processed; only in the app, only after consent.
Location: Contracting entity for EU customers: Google Ireland Ltd., Dublin. Sub-processing in the USA by Google LLC.
Legal basis / safeguard: User consent (Art. 6(1)(a) GDPR in conjunction with § 25 Abs. 1 TTDSG for placing the token on the device); processing on our behalf pursuant to Art. 28 GDPR; USA third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework.
Google Ireland Ltd. / Google LLC (Sign in with Google / OAuth)
Purpose: Optional registration and sign-in via a Google account (single sign-on). The data processed are the email address linked to the Google account, the display name and a unique Google account identifier – exclusively when the user actively selects this sign-in method. The Google password is not transmitted.
Location: Contracting entity for EU customers: Google Ireland Ltd., Dublin. Sub-processing in the USA by Google LLC.
Legal basis / safeguard: Art. 6(1)(b) GDPR (initiation/performance of the contract) and Art. 6(1)(a) GDPR (consent); USA third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework.
Apple Distribution International Ltd.
Purpose: Provision of the iOS app via the Apple App Store as well as technical transport of push notifications via the Apple Push Notification service (APNs). Apple processes App Store-related data (e.g. downloads, crash reports) under its own responsibility according to its own policies.
Location: Apple Distribution International Ltd., Cork (Ireland, EU). Corporate headquarters: USA.
Legal basis / safeguard: Necessity for the provision of the app (Art. 6(1)(b) GDPR) or legitimate interest (Art. 6(1)(f) GDPR); for the App Store's own processing, Apple is an independent controller. Third-country transfer safeguarded by SCC and the EU-US Data Privacy Framework.
Where data is transferred to recipients outside the European Economic Area (EEA) (in particular to OpenAI, Resend and, where applicable, Stripe in the USA), this only takes place if an adequate level of data protection within the meaning of Art. 44 et seq. GDPR is guaranteed. Specifically, we rely on:
You can request a copy of the safeguards via the contact address given in § 1.
Subject to the respective statutory requirements, you have the following rights:
Please address requests to exercise your rights tosupport@ki-kochhilfe.de. We generally process your request within one month (Art. 12(3) GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Lautenschlagerstraße 20, 70173 Stuttgart
Phone: +49 (0) 711 / 615541-0 · Email: poststelle@lfdi.bwl.de
Web: www.baden-wuerttemberg.datenschutz.de
The provision of your personal data is neither legally nor contractually mandatory. You are not obliged to make your data available. However, using the service is technically not possible without the mandatory details required in the ordering process (in particular email address, password, salutation, name), as these are necessary for the performance of the contract.
We do not use automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The AI-supported generation of recipes is a substantive service delivery and not a personal evaluation of you.
We take appropriate technical and organizational measures, in particular:
Data breaches (Art. 33 GDPR): In the event of a personal data breach, we maintain an internal incident response plan governing immediate containment, risk assessment and notification of the competent supervisory authority within 72 hours. If there is a high risk to your rights and freedoms (Art. 34 GDPR), we will inform you personally without delay – by email to the address stored in your account.
Personalized watermark on recipes: During your signed-in session, we overlay a subtle, diagonally running watermark over every recipe display (both for your own generated and saved recipes and on the detail pages of the public recipe gallery at /galerie). It contains exclusively your own first name and the last eight characters of your internal account ID — that is, data that you can see in your account anyway. The watermark is not transmitted to third parties and not stored separately; it becomes visible exclusively when the page is rendered in your browser. For visitors of the public gallery who are not signed in, a neutral watermark without personal data is displayed (“ki-kochhilfe.de · Galerie”). The purpose is traceability in the event of an unlawful redistribution of recipe content pursuant to § 18 of our Terms (AGB). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the protection of our AI-generated content and in contractual fidelity).
(1) On our website, up to two recipes can be created without registration. To limit this free quota, we store a cookie with a random identifier (lifetime: 12 months) as well as a cryptographically hashed value of your IP address (the IP address itself is not stored). For statistical purposes, the language of the created recipe is also recorded as a mere language code (e.g. “de”) — but not the content of your request. The legal basis is our legitimate interest in abuse and cost control (Art. 6(1)(f) GDPR) as well as § 25 Abs. 2 Nr. 2 TDDDG (strictly necessary cookie for the provision of the service expressly requested).
(2) If you voluntarily specify allergens in the trial form, these details (health data within the meaning of Art. 9 GDPR) are transmitted to our AI service provider exclusively for the creation of the respective recipe and are not stored by us. The processing takes place only after your express consent via the checkbox at the input field (Art. 9(2)(a) GDPR); without consent, the recipe is created without taking allergens into account.
(3) If you register later, the trial quota already used is attributed to your account on the basis of the cookie or IP hash (prevention of double use of the free quota).
(4) To improve the service, we store the title of the generated recipe and its language as a day-level statistic without any link to a person — no IP address, no cookie identifier and no time of day. Your input itself (including any allergen details) is not stored in the process; attribution to a person is impossible.
(5) After a trial recipe, you can share your opinion with us via a voluntary feedback form. The submission is anonymous: neither the IP address nor the cookie identifier is transmitted or stored with the feedback. Please do not include any personal data in the free text. The legal basis is our legitimate interest in improving our offering (Art. 6(1)(f) GDPR).
(6) In addition, up to two recipes from the public recipe gallery can be viewed in full without registration (a separate quota). To limit this, we store the same cookie identifier and hashed IP value as in para. 1, together with the short name (slug) of the unlocked recipe. The legal basis and the crediting to a later account correspond to paras. 1 and 3.
(7) The recipe generated during the trial (title, ingredients, preparation steps, image) may be published anonymously in our public recipe gallery after editorial review; the trial form points this out. Publication happens without any personal reference — without your input, without the IP address and without the cookie identifier. Trial recipes for which allergen details were provided are never published.
This privacy policy is currently valid and is dated July 2026. Due to the further development of our service and legal requirements, it may become necessary to amend this privacy policy. The current version can be accessed at any time at www.ki-kochhilfe.de/datenschutz.