Privacy Policy

1. Introduction

ChefFlow (“we,” “our,” or “us”) operates the ChefFlow platform at cheflowhq.com (the “Service”), a business operations tool designed for private chefs and their clients. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices you have. By using the Service you agree to the practices described here.

2. Information We Collect

Account information

When you create an account we collect your name, email address, and a hashed password. Chefs may also provide a business name, public profile tagline, bio, and profile photo.

Event and client data

Chefs enter information about their events (dates, menus, guest counts, locations) and their clients (names, email addresses, contact details, dietary preferences). This data belongs to the chef who entered it and is processed on their behalf.

Payment information

Payments are processed by Stripe. We do not store full credit card numbers or sensitive payment details on our servers. Stripe provides us with a token and basic transaction metadata (amount, status, last four digits) that we use to display financial records.

Usage data

We collect information about how you interact with the Service, such as pages visited, features used, and actions taken. This helps us understand what is working and what needs improvement.

Inquiry submissions

When a prospective client submits an inquiry through a chef's booking form (either on the chef's own website via our embeddable widget, or through a chef's ChefFlow profile), we collect the information provided in the form. This includes name, email address, phone number, event date, location, guest count, budget, dietary preferences, allergy information, and any free-form notes.

Allergy and dietary restriction information is health-related data. By submitting the inquiry form, you agree to our Terms and this Privacy Policy, which covers the collection and use of this information. This data is used solely to help the chef prepare for your event safely.

After you submit an inquiry, the following actions occur automatically on our platform:

• Your information is stored in our database and made available to the chef you are inquiring with.
• A confirmation email is sent to you via Resend (our email provider) acknowledging receipt of your inquiry.
• A private conversation thread is created between you and the chef to facilitate communication.
• An automated lead-scoring process runs on your inquiry details (event type, guest count, budget) to help the chef prioritize responses. This process does not make any decisions on your behalf.
• Your IP address is logged at the time of submission for spam and fraud prevention.

If you did not initiate this inquiry yourself and believe your information was submitted without your knowledge, please contact us at [email protected] and we will remove your data promptly.

3. How We Use Your Information

• To create and manage your account and authenticate your identity
• To provide, operate, and improve the Service
• To process payments and maintain financial records on your behalf
• To send transactional emails (account confirmation, payment receipts, event notifications)
• To respond to support requests submitted via the contact form
• To detect and prevent fraud or abuse
• To comply with legal obligations

• We do not sell your personal information. We do not rent, license, trade, or broker personal information to advertisers, data brokers, or other third parties.
• We do not use your data for third-party advertising. We do not support cross-context behavioral advertising, remarketing pixels, or enrichment feeds that use ChefFlow data to advertise other products or services.
• We only share personal information with service providers that help operate ChefFlow. Those providers must process data only to deliver the service we request from them, and we limit the data sent to what is necessary for that job.

4. Third-Party Service Providers

We share information with third parties only to the extent necessary to operate the Service:

• Stripe - Payment processing, checkout, and billing records. Payment details are submitted directly to Stripe. ChefFlow receives payment tokens and basic transaction metadata such as amount, status, and the last four digits of a card. Stripe's Privacy Policy.
• Resend - Transactional email delivery. Recipient email addresses and message content needed to send confirmations, receipts, reminders, and other product emails. Resend's Privacy Policy.
• Cloudflare - DNS, traffic delivery, bot protection, DDoS protection, and edge security. Web traffic and request metadata pass through Cloudflare infrastructure as part of serving and protecting ChefFlow. Cloudflare's Privacy Policy.
• PostHog - Consent-based usage analytics and product improvement. Page views, feature usage, and product interaction events used to understand how ChefFlow is performing and what needs improvement. PostHog's Privacy Policy. PostHog is loaded only after the user accepts analytics cookies.
• Sentry - Crash reporting, performance diagnostics, and reliability monitoring. Error metadata and limited diagnostic context. Default PII sending is disabled, cookies and authorization headers are stripped, and masked replay settings are used when diagnostic replay is enabled. Sentry's Privacy Policy.
• Google Maps - Address autocomplete, map rendering, and place selection features. Address search queries, place lookups, and map requests needed to provide location and mapping features. Google Maps's Privacy Policy.

Optional user-enabled integrations

Some integrations are only used when a chef chooses to turn them on. When that happens, ChefFlow sends the minimum data needed to operate the requested integration.

• Google - Optional Gmail and calendar sync when a chef chooses to connect Google services. Mailbox and calendar data required for the specific Google features the chef turns on. Google's Privacy Policy.
• Twilio - Optional SMS, WhatsApp, and calling features, including BYO Twilio setups. Phone numbers, message content, call metadata, and recordings only as needed to run the requested communication feature. Twilio's Privacy Policy.

Data storage and hosting

Your account data, client records, and event information are stored in a PostgreSQL database hosted on infrastructure we own and operate. We do not use third-party cloud database providers. Your data does not leave our servers except when shared with the service providers listed above for their specific purposes.

AI-assisted features

The Service includes an optional AI assistant (Remy) that helps chefs with tasks like drafting messages and organizing information. When you use AI-assisted features, relevant context from your conversation is sent to a cloud-hosted AI processing endpoint to generate responses. This processing happens in real time and conversation content is not stored on the AI provider's servers after the response is generated. AI features that handle private data (client names, dietary restrictions, financials) use a dedicated private AI endpoint separate from third-party AI services. You can use the Service without engaging AI features.

Users may opt into local AI processing by configuring a local AI instance (such as Ollama) in their settings. When local AI is enabled, conversation inference runs entirely on the user's own device and never reaches ChefFlow's servers for AI processing. Context assembly (looking up your business data to build prompts) still requires a server round-trip, but the AI inference itself stays local. If local AI is unavailable, users are prompted before any message is routed through ChefFlow's cloud AI.

Each provider listed above is contractually or operationally required to protect your information and use it only for the purpose of delivering their services to us.

5. Data Retention

We retain your account data for as long as your account is active. If you close your account, your data remains accessible to you for 30 days, after which it may be archived or deleted at our discretion. Event records and financial ledger entries are retained for a minimum of seven years to comply with standard accounting practices. You may request earlier deletion of non-financial personal data (see Section 6).

6. Your Rights and Choices

Depending on where you are located, you may have the following rights regarding your personal information:

• Access - request a copy of the personal data we hold about you
• Correction - request that we correct inaccurate or incomplete information
• Deletion - request deletion of your personal data (subject to legal retention requirements)
• Portability - request your data in a structured, machine-readable format
• Objection - object to processing of your data in certain circumstances

To exercise any of these rights, use our self-serve data request form or email us at [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

7. Cookies and Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. We do not use third-party advertising cookies. Product analytics is loaded only after you accept analytics cookies, and we respect Do Not Track where supported. Session cookies are deleted when you close your browser. Persistent cookies (such as authentication tokens) have a defined expiry and are stored securely. You can configure your browser to reject cookies, but some features of the Service may not function correctly without them.

8. Security

We implement industry-standard security measures including encrypted connections (TLS), hashed passwords, row-level security on our database, and access controls that limit data access to authorized users. No method of transmission or storage is 100% secure. If you become aware of a security issue, please contact us immediately at [email protected].

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will notify you by email or by a prominent notice in the Service. Continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: