Privacy Policy

The controller under the GDPR is 99 Pandas UG (haftungsbeschränkt), Im Holzberg 12, 73732 Esslingen am Neckar. You can reach us for privacy inquiries via email at info@99pandas.de or by post at the address above.

We are not required to appoint a data protection officer under Article 37 GDPR. Data protection requests are handled directly by the management.

Depending on usage, we process in particular the following categories of data:

• Master data such as name, email address, and language
• Content data such as recipes, shopping lists, images, and comments you actively store or share
• Usage data such as logins, device information, feature interactions, and error logs
• Payment and contract data for paid plans (e.g., billing address, billing history)

Key purposes include delivering core functionality, personalized recommendations, support, stability analysis, and legal obligations. Marketing communication only occurs with your explicit consent, which you can withdraw at any time.

If we use AI-driven features, we do so within our infrastructure or with carefully selected processors bound by confidentiality.

We only use our AI features – such as importing recipes from photos, texts and links, recipe suggestions, the fridge analysis, nutritional values and translations – after you have agreed in the app. Only then do we send the content each feature needs to the AI providers named in section 5; the legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings under “AI data processing”, and PandaChef remains usable without AI features. We store when you gave your consent as proof (Art. 7(1) GDPR) until you withdraw it or delete your account. If you use AI features through an AI assistant you have connected to your account yourself, we process the content to fulfil that request (Art. 6(1)(b) GDPR).

If you report AI-generated content as inappropriate or wrong, we store your report with the reason you chose, any details you add and an excerpt of the reported content, linked to your account. We use it to review problematic AI output, to follow up with you if needed and to improve our AI features (legitimate interest, Art. 6(1)(f) GDPR). We do not pass reports on to the AI providers.

Recipes and personal data remain stored until you delete them or close your account. Billing and tax records are kept for up to ten years. Log and security data are typically deleted after 90 days.

After a subscription ends, we anonymize usage data unless statutory retention obligations apply.

To run the service we also record when you last used it, and metadata about each AI request (feature, model, number of tokens processed, time) – never the content itself. This serves cost control and abuse detection (legitimate interest, Art. 6(1)(f) GDPR). We delete this AI usage data after 13 months; if you delete your account, it is anonymized immediately.

We delete reports about AI content after 12 months, and immediately if you delete your account.

Data is shared only when necessary for contract performance or when you have consented. Data processing agreements under Article 28 GDPR are in place with every processor.

Some of these providers are based in the USA. We base those transfers on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR) and, where the providers are certified, on the adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR). Despite these safeguards, access by US authorities cannot be entirely ruled out.

Sharing features let you share recipes with other people. You decide whether content stays private or is shared.

We currently use the following providers:

• Render Services, Inc. (USA) – hosting and operation of the application
• Supabase, Inc. (USA; data stored in the EU, region eu-west-1) – database and file storage (recipe and cookbook images)
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) – payment processing, invoicing and tax data for paid plans
• RevenueCat, Inc. (USA) – management of subscriptions from the mobile app stores and from the web plan; your user id and the subscription id are transmitted, no payment data
• OpenAI Ireland Ltd. (Ireland) or OpenAI, L.L.C. (USA) and, depending on the model in use, Google Ireland Ltd. (Ireland) or Google LLC (USA) – AI features such as recipe import, suggestions, image and text recognition, and translations. Only the content needed for this is transmitted, never payment data.
• Umami Software, Inc. (USA; data stored in the EU) – cookie-free audience measurement without personal profiles; query parameters and fragments of visited addresses are not collected
• one.com Group AB (Sweden) – sending verification, order, cancellation and invitation emails via our mail server hosted there
• Bring! Labs AG (Switzerland) – handing your shopping list to the Bring! app when you use that feature. We publish the list at an unguessable address that Bring! retrieves.
• Google Ireland Ltd. or Apple Distribution International Ltd. if you choose to sign in with a Google or Apple account

You can exercise your rights through account settings or by emailing info@99pandas.de. We respond within one month. If we have doubts about your identity, we may request additional information.

Withdrawing consent does not affect the lawfulness of processing up to that point. You may also lodge a complaint with any data protection authority.

Measures include encrypted connections (TLS), encrypted database storage, role-based access, automated backups, and not storing full payment details on our servers. Access is limited to the people who need it to operate the service.

We report security incidents to the competent authority without undue delay per Art. 33 GDPR and, where required, to you.

We will notify you of material changes via email or in-app notice. The current version is always available on this page.

If you have questions about data processing, contact us at info@99pandas.de anytime.