PRIVACY POLICY

Effective: 11 May 2026 · Replaces all previous versions, including the Privacy Notice dated 25 April 2024.

1. Who we are

Chefadora is operated by Chefadora Pty Ltd (ABN 35 665 254 133), a company incorporated in South Australia, Australia. Our registered address is Unit 11, 1057 South Road, Melrose Park SA 5039, Australia.

For privacy matters, we act as the data controller (or, where applicable, data fiduciary) for personal information processed through our services.

Contact us about privacy: privacy@chefadora.com

2. Information we collect

2.1 Information you provide

You provide information directly when you create an account, use Chefadora's features, communicate with us, or complete forms on the platform. This may include:

1. Account information— your name, email address, username, password, profile photo, contact preferences, and any social media account links you choose to add
2. Recipe content— recipes, photos, videos, descriptions, and other content you publish or import
3. Communications— messages you send to us, comments and ratings you leave on recipes, and content you share through Chefadora's features
4. Subscription and payment information — billing details required to process Chefadora Premium or Lifetime Access purchases. Payment card details are not stored by Chefadora; they are processed directly by our payment processors (see clause 5.1)
5. Creator information— for participants in the Creator Program, additional information including bank account details for payouts, tax information, identity verification documents (where required), and social media bio links used for verification

2.2 Information collected automatically

When you visit or use Chefadora, we automatically collect certain information about your device and how you interact with our services. This includes:

1. Device and technical information — IP address (typically truncated for non-essential purposes), device type, operating system, browser type and version, screen size, language preferences, mobile device identifiers, and similar technical data
2. Usage information— pages and recipes you view, searches you perform, time spent on the platform, features you use, content you save or interact with, and the date and time of your activity
3. Approximate location — derived from your IP address (typically country and region level). If you grant location permission in our mobile app, we may also collect more precise location to provide location-relevant features
4. Crash and performance data — diagnostic information when our services experience errors, including the type of error and the action you were taking when it occurred

2.3 Personalisation Preferences (including allergies and intolerances)

During onboarding, and at any time afterwards through Account Settings, you can optionally provide:

1. Dietary preferences (such as vegetarian, vegan, halal)
2. Allergies and intolerances
3. Foods you dislike or want to avoid

Providing this information is entirely optional. You can skip during onboarding and add or update later. You can clear or change your preferences at any time.

Allergies and intolerances are health-related information and are treated as a special category of personal data under the European Union General Data Protection Regulation (Article 9), the United Kingdom GDPR, India's Digital Personal Data Protection Act 2023, and equivalent laws in other jurisdictions. We collect and process this information only with your explicit consent, given by proceeding past the screen on which you provide allergy or intolerance information. The consent is specific to the purposes described in clause 3 and may be withdrawn at any time by clearing your Personalisation Preferences in Account Settings or by contacting privacy@chefadora.com.

2.4 Information from third-party sign-in providers

If you choose to register or sign in using Google, Apple, or Facebook (a "Third-Party Account"), we receive information from that provider as authorised by you. This typically includes your name, email address, profile photo, and a unique identifier from the provider. We use this information only to create or authenticate your Chefadora account and to populate your profile.

Information processed by Google, Apple, or Facebook in connection with your use of those accounts is governed by their respective privacy policies, not by this Privacy Policy.

2.5 Information about minors

Chefadora's minimum age requirements are described in clause 14. We do not knowingly collect personal information from anyone below the applicable minimum age. If we discover we have done so, we will delete that information promptly.

3. How we use your information

We use the information described in clause 2 for the following purposes.

3.1 To provide and operate Chefadora

We use your information to create and manage your account, authenticate you when you sign in, deliver Chefadora's features (including recipe browsing, publishing, importing, saving, meal planning, and shopping lists), respond to your queries, and provide customer support.

3.2 To process payments and manage subscriptions

If you subscribe to Chefadora Premium or purchase Lifetime Access, we use your information to process the purchase, manage your subscription, send you billing-related communications (such as renewal reminders and payment failure notifications), and process refunds where applicable. Payment card details are processed by our payment processors (see clause 5.1) and are not stored by Chefadora.

3.3 To deliver Chefadora AI

Chefadora AI is our cooking assistant. To provide AI responses to your queries and to support features like meal plan generation, ingredient substitution, and recipe discovery, we send your inputs and relevant context to third-party AI infrastructure providers (see clauses 5.1 and 6 for details).

Chefadora AI may also access information already associated with your account — such as your Personalisation Preferences, saved and viewed recipes, meal plans, shopping lists, privately imported recipes (when you reference them), and your approximate location — to tailor its responses to you. The AI may retain conversation history across sessions to provide continuity.

3.4 To personalise your experience and provide recommendations

We use your Personalisation Preferences, your activity on the platform (such as saved and viewed recipes), and your approximate location to recommend recipes, generate meal plan suggestions, filter search results, and tailor the content we show you.

3.5 To send communications

We use your contact information to send you:

1. Service-related messages — such as account confirmations, security alerts, billing notifications, ToS updates, and responses to your enquiries. These are necessary for the operation of your account and you cannot opt out while you have an active account
2. Marketing emails— where you have opted in to receive them. You can unsubscribe at any time using the link in any marketing email or by contacting privacy@chefadora.com. See clause 7 for details
3. Push notifications— where you grant permission. See clause 13 for details

3.6 To understand and improve Chefadora

We use information about how you and other users interact with Chefadora to understand which features are working well, identify problems, and improve the service. Most of this analysis is performed on aggregated or anonymised data.

3.7 To protect Chefadora and others

We use your information to detect, prevent, and respond to fraud, abuse, security incidents, and breaches of our Terms of Service or Community Guidelines. This includes using automated systems to identify spam, copyright infringement signals, AI-generated visual content posing as authentic, and other policy violations.

3.8 Profiling and personalisation — your right to know

Chefadora's recommendation features, AI personalisation, and meal plan generation use information about you to tailor what we show you. Under privacy laws in some jurisdictions (including the EU/UK GDPR, Article 22), you have a right to be informed of this and to request human review of any decision that produces a legal or similarly significant effect on you.

To be clear: Chefadora's personalisation and AI features do not produce decisions with legal or similarly significant effects. They influence what recipes and recommendations we show you, not your access to credit, employment, services, or any legal status. If you have any concerns, contact privacy@chefadora.com.

4. Legal bases (EU/UK GDPR)

If you are located in the European Union, the United Kingdom, or another jurisdiction whose laws require us to identify a legal basis for processing your personal information, we rely on the following bases:

1. Performance of a contract (GDPR Art. 6(1)(b)) — to provide Chefadora's core features, manage your account, process subscriptions, and respond to your requests
2. Your consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)) — for processing of allergies and intolerances (Art. 9 health data), for marketing emails, for push notifications, and for non-essential cookies. You can withdraw consent at any time
3. Our legitimate interests (GDPR Art. 6(1)(f)) — to operate, secure, and improve Chefadora; to detect and prevent fraud and abuse; to perform analytics on aggregated or anonymised data; and to administer our business. These interests are balanced against your rights and freedoms
4. Compliance with legal obligations (GDPR Art. 6(1)(c)) — to comply with tax, accounting, anti-money laundering, court orders, and other legal requirements
5. Protection of vital interests (GDPR Art. 6(1)(d)) — in rare circumstances where processing is necessary to protect the vital interests of you or another person

5. Sharing your information

We share your information only as described below. We do not sell your personal information.

5.1 Service providers (sub-processors)

We use the following third-party service providers to operate Chefadora. We have data processing agreements in place with each provider that limit how they may use your information.

This list may be updated from time to time as we add or change service providers. We will notify you of material changes (such as adding a new sub-processor that processes a new category of personal information) in accordance with clause 15.

5.2 Other Chefadora users

Some of your information is visible to other Chefadora users by design:

1. Recipes and other content you publish are visible to other users (and to anyone with internet access — Chefadora recipe pages can be viewed without an account)
2. Your username, profile photo, and public profile are visible to other users when you publish content or interact with other users' content
3. Comments and ratings you leave on other users' recipes are visible to those users and to anyone viewing the recipe
4. Meal plans and shopping lists you choose to share with specific collaborators are visible to those collaborators
5. Privately imported recipes are not visible to other users unless you choose to share them through Chefadora's share feature, in which case the source URL is shown to recipients but your identity as the importer is not

5.3 Legal and safety

We may disclose your information to comply with applicable law, regulation, court order, government request, or legal process; to enforce our Terms of Service or Community Guidelines; to protect Chefadora's rights, property, or safety, or those of our users or others; and to investigate, prevent, or address fraud, abuse, or security issues.

5.4 Business transfers

If Chefadora is involved in a merger, acquisition, financing, or sale of all or a portion of our business or assets, your information may be transferred as part of that transaction. We will notify you of any such transfer that materially affects how your information is processed.

6. Chefadora AI — additional details

Because Chefadora AI is a significant feature involving multiple third parties, this section provides additional detail beyond clauses 3.3 and 5.1.

6.1 Providers and infrastructure

Chefadora AI is powered by AI models developed by OpenAI and Anthropic, accessed through enterprise cloud infrastructure provided by Microsoft Azure (Azure OpenAI Service) and Amazon Web Services (Amazon Bedrock). We use enterprise tiers of these services that contractually prohibit our providers from using your inputs or outputs to train their AI models.

6.2 What data Chefadora AI processes

When you interact with Chefadora AI, the AI may process:

1. The text of your queries and prompts
2. Your Personalisation Preferences (including allergies and intolerances, where you have provided them)
3. Your saved and viewed recipes, meal plans, and shopping lists
4. Privately imported recipes (when you reference them or when relevant to a personalised recommendation)
5. Your approximate location, where you have granted location access
6. The current context within the app (such as the recipe page you are viewing)
7. Previous chat history with Chefadora AI to provide continuity

6.3 Retention of AI inputs and outputs

Your inputs to Chefadora AI and the AI's outputs are retained for as long as reasonably necessary to provide and improve the AI service, maintain conversation continuity, and comply with legal obligations. A subset of inputs and outputs may be reviewed by trained human moderators for quality assurance and policy enforcement.

You can clear your Chefadora AI chat history at any time through Account Settings or by contacting privacy@chefadora.com. Once cleared, the conversation history is removed from the active service. Limited retention may continue in our backups for the period described in clause 10.

6.4 Web search performed by Chefadora AI

Chefadora AI can perform web searches at your direction to find recipes that match a specific request. When this happens, Chefadora's systems perform the underlying web fetch on your behalf. The search query is processed by our AI providers and the search infrastructure we use. If you choose to import a recipe found through this process into your private library, the import is governed by clause 8 of our Terms of Service.

7. Marketing communications

We may send you marketing emails about new features, cooking content, product updates, and special offers.

Opt-in: If you create a Chefadora account on or after the effective date of this Privacy Policy, you will see a separate, optional checkbox at signup to opt in to receive marketing emails. We will not send you marketing emails unless you tick this box.

Opt-out — at any time: You can unsubscribe from marketing emails at any time by clicking the unsubscribe link at the bottom of any marketing email, by changing your communication preferences in Account Settings, or by contacting privacy@chefadora.com. Opting out of marketing emails does not affect service-related communications, which we are required to send for the administration of your account.

8. Cookies and tracking

Chefadora uses cookies and similar technologies (such as web beacons, pixels, and local storage) to operate the platform, remember your preferences, understand how you use the service, and (where you have consented) to display personalised content and advertising.

You can control cookies through your browser settings and through Chefadora's cookie banner where applicable. Detailed information about the specific cookies we use, their purposes, and how to control them is set out in our Cookie Policy.

9. International data transfers

Chefadora's primary infrastructure is hosted in Sydney, Australia. Some of our service providers (listed in clause 5.1) are located in, or process data through, the United States, the European Union, and other countries.

Where personal information is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognised as providing adequate protection by the relevant authorities, we rely on appropriate safeguards required by law, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Agreement, supplemented by additional measures where necessary.

If you would like more information about the safeguards we use for a specific transfer, contact privacy@chefadora.com.

10. How long we keep your information

We keep your personal information for as long as necessary to provide the services and for the purposes described in clause3, unless a longer period is required or permitted by law. The table below sets out our typical retention periods.

When the retention period for a category of personal information ends, we will delete or anonymise that information. Where deletion from active systems is not technically possible (for example, because the data is held in backups), we will isolate the information from further processing until deletion becomes possible.

11. Security

We implement appropriate technical and organisational measures to protect your personal information, including encryption in transit (TLS) and at rest, access controls, regular security reviews, and contractual safeguards with our service providers.

Despite these measures, no method of internet transmission or electronic storage is fully secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will notify you and any relevant supervisory authority in accordance with applicable law.

12. Your rights — by region

12.1 Rights for everyone

Regardless of where you live, you can:

1. Access and update most of your account information directly through Account Settings
2. Clear your Personalisation Preferences and Chefadora AI chat history through Account Settings
3. Delete your Chefadora account at any time through Account Settings or by contacting privacy@chefadora.com
4. Unsubscribe from marketing emails at any time
5. Contact us with any privacy question at privacy@chefadora.com

12.2 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR / FADP)

If you are located in the EEA, the UK, or Switzerland, you have the following rights under applicable data protection law:

1. Right of access— to request a copy of the personal information we hold about you
2. Right to rectification — to request correction of inaccurate or incomplete personal information
3. Right to erasure ("right to be forgotten") — to request deletion of your personal information in certain circumstances
4. Right to restrict processing — to limit how we use your personal information in certain circumstances
5. Right to data portability — to receive your personal information in a structured, commonly used, machine-readable format
6. Right to object— to object to processing based on legitimate interests, including for direct marketing
7. Right to withdraw consent — where we rely on your consent (such as for allergies and intolerances or marketing emails), you may withdraw it at any time
8. Right not to be subject to a decision based solely on automated processing — Chefadora does not make automated decisions producing legal or similarly significant effects on you
9. Right to lodge a complaint with a supervisory authority — your local data protection authority. A list of EEA authorities is available at edpb.europa.eu/about-edpb/board/members_en. UK residents may contact the Information Commissioner's Office at ico.org.uk. Swiss residents may contact the Federal Data Protection and Information Commissioner at edoeb.admin.ch

For consumer disputes that we cannot resolve directly, you may contact the dispute resolution body in your country — the European Commission maintains a list at consumer-redress.ec.europa.eu/dispute-resolution-bodies. Our single point of contact for matters under the EU Digital Services Act is legal@chefadora.com.

12.3 California, USA (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

1. Right to know— what categories of personal information we collect, the sources and purposes, and the categories of third parties with whom we share it
2. Right to access— a copy of the specific personal information we have collected about you
3. Right to delete— request deletion of your personal information, subject to legal exceptions
4. Right to correct— inaccurate personal information
5. Right to opt out of "sale" or "sharing" of personal information — Chefadora does not sell or share personal information as those terms are defined under California law
6. Right to limit use of sensitive personal information — including the allergy and intolerance information described in clause 2.3
7. Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

Categories of personal information we collect about California residents in the past 12 months: identifiers (name, email, IP address, account identifiers); customer records (subscription details); commercial information (subscription transactions); internet activity (browsing and usage data); geolocation (approximate, derived from IP); inferences (personalisation preferences derived from your activity); and sensitive personal information (allergy and intolerance information you provide). We use and share these categories for the purposes described in clauses 3 and 5.

To exercise your rights, contact privacy@chefadora.com. We may need to verify your identity before fulfilling your request.

12.4 Other US states

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another US state with a comprehensive consumer privacy law, you have similar rights to those described in clause 12.3, including the right to access, correct, delete, and opt out of certain processing of your personal information. To exercise your rights, contact privacy@chefadora.com.

12.5 Canada (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act, including the right to access and correct your personal information, to withdraw consent, and to lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

12.6 Australia (Privacy Act 1988 and Australian Privacy Principles)

If you are an Australian resident, you have rights under the Privacy Act 1988 and the Australian Privacy Principles, including the right to access and correct your personal information. If you have a concern about how we handle your personal information, contact privacy@chefadora.com. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

12.7 India (Digital Personal Data Protection Act 2023)

If you are a resident of India, your personal data is processed in accordance with the Digital Personal Data Protection Act 2023. You have the right to access, correct, and erase your personal data, to nominate a person to exercise your rights in the event of your death or incapacity, to grievance redressal, and to withdraw consent.

Chefadora Pty Ltd is the Data Fiduciary for the purposes of the DPDP Act. To exercise your rights, contact our Data Fiduciary representative at privacy@chefadora.com. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is operational.

13. Push notifications

Chefadora may send push notifications to your mobile device about your account, recipes you have saved, meal plan reminders, new features, and other content. Push notifications are delivered through Apple Push Notification Service (for iOS) and Firebase Cloud Messaging (for Android), as part of the operating system on your device.

Push notifications require your explicit permission. The first time Chefadora wants to send you a push notification, your device's operating system will prompt you to allow or deny permission. You can change your decision at any time in your device's notification settings.

Where you have granted push notification permission, Chefadora may send notifications categorised as service-related (such as account or billing alerts) or marketing/engagement (such as new features, recipe suggestions, or promotional offers). You can manage your in-app notification preferences in Account Settings.

14. Children's privacy

Chefadora is intended for users who meet our minimum age requirements:

1. If you are a resident of a country in the European Union or European Economic Area, you must be at least 16 years old, or have verifiable consent from a parent or legal guardian
2. In all other countries, you must be at least 13 years old

We do not knowingly collect personal information from anyone below the applicable minimum age. If you are a parent or guardian and you believe a minor has provided us with personal information without appropriate consent, contact privacy@chefadora.com and we will delete that information promptly.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we make changes, we will update the effective date at the top of this policy. Where the changes are material — for example, where we add a new category of personal information collected, change the purposes for which we use your information, or add a new sub-processor that processes a new category of data — we will notify you by email and in-app notification with reasonable advance notice before the changes take effect.

Changes required to comply with law or to address security or fraud may take effect immediately.

16. How to contact us

1. Privacy enquiries: privacy@chefadora.com
2. Data Fiduciary representative (India): privacy@chefadora.com
3. DSA single point of contact (EU): legal@chefadora.com
4. General enquiries: hello@chefadora.com
5. Postal address: Chefadora Pty Ltd, Unit 11, 1057 South Road, Melrose Park SA 5039, Australia

Effective date: 11 May 2026

This document supersedes the Privacy Notice dated 25 April 2024.