Cookler: AI for Chefs mobile application

Effective Date: 19 October 2026

This version replaces the Privacy Policy dated 9 December 2025. Cookler SAS ("Cookler", "we", "our", "us") respects your privacy. This Privacy Policy explains what personal data we collect through the Cookler: AI for Chefs mobile application (the "App"), how we collect it, every purpose for which we use it, who we share it with, and the rights you have. It applies only to the App and should be read together with our Terms of Use.

Summary

• We collect the account details you give us, the content you create in the App (recipes, notes, voice notes, photos, videos), the supplier invoices you scan, and limited technical and usage data.
• When you use an AI feature, the content you submit is sent from Cookler's servers to Google, which runs the Gemini AI models for us through Google's Gemini API. The App always tells you this and asks for your permission before the first time any of your content is sent to Google. You can withdraw that permission at any time.
• We use Google's paid Gemini API. Under the Gemini API terms for paid services, Google does not use your content to improve its products or train its AI models; it processes it only to return the result, apart from limited logging to prevent misuse (section 3.1).
• If you choose to sign in with Facebook, Meta shares your basic profile with us. We use it only to sign you in.
• Food cost and margin figures are calculated by our own deterministic formulas, not by AI.
• We do not sell your data, we do not use it for advertising, and we do not track you across other apps or websites.

1. Data controller

Company: Cookler SAS
SIREN: 913 671 707
VAT: FR94913671707
Address: 4 Passage Germinal, 93200 Saint-Denis, France
Email: [email protected]

Cookler SAS is the data controller responsible for processing your personal data.

2. Data we collect and how we collect it

2.1 Account and profile data (provided by you)

• Required: email address and password (the password is stored only in hashed form by Firebase Authentication).
• Optional: full name, phone number, business or postal address, profile picture.
• Sign in with Facebook (optional): if you choose to sign in with Facebook, Meta sends us your Facebook user identifier and, depending on what you authorise on the Facebook login screen, your name, email address and profile picture. We never receive your Facebook password, and we do not post anything to Facebook on your behalf.

2.2 Content you create (provided by you)

• Recipes, ingredients, quantities, portions, selling prices and notes you enter.
• Purchase orders you create, including the supplier details, products, quantities and prices they contain.
• Voice notes and audio recordings (collected through your device microphone when you choose to record).
• Photos and videos (collected through your device camera or photo library when you choose to capture or select them).
• Text you type, AI-generated transcriptions and structured content, and files you export (for example PDF or Excel).

2.3 Supplier invoices you scan (provided by you)

When you use the invoice scanning feature, you take a photo of a supplier invoice or select one from your photo library. We collect:

• The invoice image itself, which is stored in your account in Google Firebase Storage. To read it, the image is also sent from our servers to Google's Gemini servers; Google does not keep it once the result is returned, apart from the limited logging described in section 3.1.
• The data extracted from it, which may include: supplier name, address, phone, email and company or VAT number; invoice number and date; product and ingredient names; quantities and units; unit prices, totals, taxes and discounts; and your own business name and address if they appear on the invoice.

Invoices may contain personal data about other people, for example a supplier who trades as a sole trader or the name of a sales representative. Please photograph only the invoice, and do not capture payment card numbers, bank details or other information that is not needed for the feature.

2.4 Data generated by the App

• Ingredient costs linked to your recipes, recipe food cost, cost per portion and margin.
• Price history for each ingredient and supplier, built from the invoices you scan over time, and the price increase or decrease detected between invoices.
• Margin history per recipe and margin erosion alerts.

2.5 Technical and usage data (collected automatically)

• Device model, operating system, app version, language and time zone.
• IP address, used for security, fraud prevention and abuse detection.
• Error logs.
• Performance data (for example app start-up time, screen loading time and the duration of network requests), collected with Firebase Performance Monitoring to detect and fix slowdowns.
• Product usage events (for example screens viewed, features used, button taps, trial start and subscription events), with their timestamps, collected with Mixpanel and linked to an internal user identifier so that we can understand how the App is used and improve it. Where your consent is required by law, we collect these events only after you allow it in the App (see section 3.3).

Technical and usage data is processed in pseudonymised or aggregated form. It is not used for cross-app tracking, advertising or data brokerage, and is not used to identify you outside the App.

2.6 Subscription and payment data

Cookler never receives or stores your payment card details. Payments are handled by Apple (App Store) or Google (Google Play). Through RevenueCat we receive only subscription information such as the plan, trial status, purchase and renewal dates, expiry date, country or storefront, and an anonymous purchase identifier.

2.7 Device permissions

The App asks for access to your camera (to scan invoices and take photos or videos), photo library (to select images or videos), microphone (to record voice notes) and, if you agree, notifications (for example margin erosion alerts). Each permission is requested only when you first use the related feature, and you can change it at any time in your device settings.

3. Third-party AI processing and your permission

3.1 What is sent, to whom, and when

Item	Details
Who receives the data	Google, which runs the Gemini AI models for us through Google's Gemini API (paid service). The content is sent from Cookler's servers, not directly from your device. For this processing Google acts as our data processor under its Data Processing Addendum for products where Google is a data processor.
What is sent	Only the content you submit to an AI feature: - invoice photos you scan (and any personal data visible on them); - voice notes and audio recordings; - photos and videos; - text, notes or recipe content you ask the AI to process. Your password, payment information and Mixpanel usage data are never sent to Gemini.
Why it is sent	To read your invoices and extract supplier, product, quantity and price data; to transcribe voice notes; to turn photos, videos and text into structured recipe and ingredient data; and to generate recipes when you ask for it.
When it is sent	Only when you actively use an AI feature (for example you tap "Scan invoice", record a voice note or ask the App to generate a recipe), and only after you have given your permission in the App.
What Google may do with it	Process it to return the result to Cookler. Under the Gemini API terms for paid services, Google does not use your prompts or the responses to improve its products or to train its AI models. Google keeps logs of requests and responses for a limited period, solely to detect and prevent misuse of its service and for legally required disclosures, and then deletes them.
Where it may be processed	Google may process this content outside the European Union, in countries where Google or its subcontractors operate, with the safeguards described in section 7.

3.2 Your permission before any data is shared

Before any of your content is sent to Google for the first time, the App shows a dedicated screen that explains what will be sent and that it will be processed by Google Gemini, and asks you to choose Allow or Later (in French: Autoriser or Plus tard). Nothing is sent unless you choose Allow. If you choose Later, the screen is shown again the next time you use an AI feature. If you have used the App before this policy took effect, you will see this screen before your next use of an AI feature. You can withdraw or give your permission at any time in the App under Profile > Privacy > AI processing. If you do not allow, or later withdraw, AI processing, the AI features (invoice scanning, voice transcription, photo and video processing, AI recipe generation) are unavailable, but you can keep using the features that do not rely on AI, including entering ingredient prices and recipes manually. Withdrawing your permission does not affect processing that already took place.

3.3 Product analytics permission

Where the law requires your consent for product analytics, the App asks for it separately from the AI permission. You can turn analytics off at any time under Profile > Privacy > Usage analytics. Turning analytics off has no effect on the features available to you. Cookler itself does not use your content to train any public or third-party AI model.

3.4 Margin calculations are not made by AI

Gemini is used only to read and structure the content you submit. Food cost, cost per portion, margin, price change and margin erosion figures are calculated by Cookler's own deterministic formulas from the data stored in your account. The App does not make any decision about you that produces legal effects or similarly significantly affects you based solely on automated processing.

4. How we use your data and our legal bases

Purpose	Data used	Legal basis (GDPR)
Create and manage your account, authenticate you (including sign-in with Facebook if you choose it)	Account and profile data, Facebook login data	Performance of our contract with you; your consent for optional profile information, which you can remove at any time
Store, display, organise, search, retrieve and export your recipes, purchase orders, notes and files	Content you create, account data	Performance of contract
Read your invoices and extract their data with AI	Invoice images and extracted data	Performance of contract, plus your prior permission in the App (section 3.2)
Transcribe and structure voice notes, photos, videos and text with AI; generate recipes and other AI-assisted documents you request	Content you submit to AI features	Performance of contract, plus your prior permission in the App
Calculate food cost and margins, track ingredient price changes per supplier, keep margin history and send margin erosion alerts	Recipes, extracted invoice data, data generated by the App	Performance of contract
Manage the free trial and subscription	Subscription data	Performance of contract
Understand how the App is used and improve it	Usage events (Mixpanel), technical data	Your consent where required by law; otherwise our legitimate interest in improving the App
Keep the App secure, stable and fast, prevent fraud and abuse, fix errors and slowdowns, enforce fair use and subscription rules	Technical data, performance data, IP address, usage data	Legitimate interest
Send service messages (security, changes to terms, subscription notices)	Email address	Performance of contract, legal obligation
Comply with the law and respond to lawful requests; keep accounting records	Relevant data only	Legal obligation
Enforce our Terms of Use and defend our legal rights	Relevant data only	Legitimate interest

We do not use your content, your invoices or the prices you pay your suppliers for advertising, we do not make them public, we do not sell or license them, and we do not share them with other users, other businesses or your suppliers. We use them only to provide the features described above to you.

5. Who we share data with

We share personal data only with the service providers below, and only as needed to run the App. Each acts on our instructions under a data processing agreement, except Apple and Google for payments and Meta for Facebook sign-in, which act as independent controllers under their own privacy policies. We require each provider to protect personal data to a standard equal to the protection described in this policy.

Provider	Purpose	Data concerned
Google (Firebase)	Hosting, authentication, database, file storage (including invoice images), server functions, performance monitoring	All App data, including account data, content, invoice images and extracted data, performance data
Google (Gemini models via Google's Gemini API)	AI processing: invoice reading, transcription, structuring of photos, videos and text, recipe generation	Only the content you submit to an AI feature (section 3.1)
Meta Platforms (Facebook Login)	Optional sign-in with your Facebook account	Facebook user identifier, and name, email and profile picture if you authorise them; Meta also learns that you used Facebook to sign in to the App
Algolia	Search indexing so you can search your own content	Searchable text such as recipe, ingredient and supplier names and notes
Mixpanel, Inc.	Product analytics	Usage events, device and app information, internal user identifier
RevenueCat, Inc.	Subscription and free trial management	Subscription data, anonymous purchase and app user identifiers
Apple / Google	In-app purchase processing	Purchase and payment data (handled directly by Apple or Google)

We do not sell personal data and we do not share data for advertising purposes. We may also disclose data if required by law or by a competent authority, to protect our rights or the safety of users, or to a successor in the event of a merger or acquisition, in which case you will be informed.

6. Data storage and security

Your data is stored with Google Firebase. Search indexes are stored with Algolia and subscription records with RevenueCat. Data may be stored in the European Union or in other regions, with the safeguards described in section 7. We use encrypted transmission (TLS/HTTPS), encryption at rest provided by our hosting provider, secure authentication, access rules that restrict each user to their own data, and restricted internal access on a need-to-know basis. No system can guarantee absolute security, but we work to protect your data and review our measures regularly.

7. International data transfers

Some of our providers (in particular Google, including for Gemini AI processing, Meta, Mixpanel, Algolia and RevenueCat) may process data outside the European Economic Area, including in the United States. When this happens we rely on appropriate safeguards under the GDPR, such as an adequacy decision (including the EU-U.S. Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses. You can ask us for more information at [email protected].

8. How long we keep data

Data	Retention period
Account and profile data	While your account is active; deleted within 30 days after you delete your account
Recipes, notes, voice notes, photos, videos, exports	Until you delete them or your account; then deleted within 30 days
Invoice images and extracted invoice data	Until you delete the invoice or your account; then deleted within 30 days
Price history and margin history	While your account is active; deleted within 30 days after you delete your account
Content sent to Gemini (including invoice images)	Not kept by Google after the result is returned, except limited logs kept for a limited period to prevent misuse, as described in the Gemini API terms for paid services. The copy stored in your Cookler account follows the rows above.
Usage analytics (Mixpanel)	Up to 24 months, then deleted or anonymised; deleted earlier if you delete your account
Technical and security logs	Up to 12 months
Records we must keep by law	For the period required by law

Deleted data cannot be recovered.

9. Your rights

Under the GDPR and French data protection law you have the right to:

• access your personal data and receive a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to processing, including processing based on our legitimate interest;
• receive your data in a portable format;
• withdraw your consent or permission at any time (including AI processing and analytics, directly in the App);
• give instructions on what happens to your data after your death (French law).

To exercise your rights, write to [email protected]. We answer within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority in your country of residence.

10. Children

The App is a professional tool and is not intended for anyone under 16 years of age. If we learn that we have collected data from a person under 16, we will close the account and delete the associated data.

11. No tracking and no advertising

Cookler does not track you as defined by Apple: we do not link data collected in the App with data from other companies' apps or websites for advertising or advertising measurement, and we do not share data with data brokers. We do not use the advertising identifier (IDFA) or any other third-party advertising identifier, nor device fingerprinting. No personal data is used for targeted advertising. Mixpanel analytics are used only to understand and improve the App itself. Facebook Login is used only to sign you in; we do not use the Facebook SDK for advertising, advertising measurement or app event tracking.

12. Deleting your account

You can delete your account at any time in the App under Profile > Delete Account, or by writing to [email protected]. Account deletion is permanent and cannot be undone. Deleting your account deletes your data as described in section 8. It does not cancel an App Store or Google Play subscription or free trial; you must cancel it in your store account settings. If you signed in with Facebook, you can also remove Cookler from the apps connected to your Facebook account in your Facebook settings.

13. Data breach

If a personal data breach occurs, we will notify the CNIL and any other competent authority and, where required, the affected users, in accordance with applicable law.

14. Changes to this policy

We may update this policy, for example when we add a feature. We will change the effective date above. If the change is material, in particular a new type of data sent to a third party or a new use of your data, we will inform you in the App or by email, and where your permission is required we will ask for it again in the App before the change applies.

15. Contact

Email: [email protected] Post: Cookler SAS, 4 Passage Germinal, 93200 Saint-Denis, France