KptnCook Privacy Policy

Last updated: April 27, 2026

Name and address of the data controller. The data controller responsible for compliance with the General Data Protection Regulation as well as other data protection regulations, including the national data protection laws of the EU Member States, is: KptnCook GmbH, Mariendorfer Weg 64, 12051 Berlin, Germany. Phone: +49 176 43655171. Email: support@kptncook.com. Website: https://www.kptncook.com/. Represented by the Managing Director Alexander Reeg.

General information on data processing

1. Description and scope of data processing. We only process personal data of our users to the extent that this is necessary for the provision of a functional website as well as our content and services. We regularly collect and use your personal data, but only with your consent. An exception applies in those cases where prior consent cannot be obtained for legal or factual reasons and the processing of the data is permitted by law.

2. Legal basis for data processing. Insofar as we obtain your consent for the processing of your personal data, Art. 6 para. 1 lit. a of the EU General Data Protection Regulation (GDPR) is the legal basis. When processing personal data that is necessary to fulfill an agreement with you, Art. 6 para. 1 lit. b GDPR is the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures. Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR is the legal basis. In the event that your vital interests or those of another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR is the legal basis. If processing is necessary to safeguard our legitimate interest or that of a third party and if your interests, fundamental rights, and freedoms do not outweigh the former, Art. 6 para. 1 lit. f GDPR is the legal basis.

3. Data deletion and storage duration. Your personal data will be deleted or blocked as soon as the purpose for its storage no longer pertains. Your data may, however, continue to be stored if required by EU or national regulations, laws, or other provisions to which we are subject. Data will be blocked or deleted once said retention periods expire, unless its further retention is required to establish or fulfill a contractual relationship.

Privacy Policy of the Website

I. Provision of the website

1. Description and scope of data processing. Every time you visit our website, our system automatically collects data and information from your computer system, including: the user's IP address; the time of access. The data are also stored in the log files of our system, not together with any other personal data we may have collected about you.

2. Legal basis for data processing. The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing. The temporary storage of the IP address by the system is necessary to enable the delivery of the website to your computer. The data is stored in log files in order to ensure the website's functionality, to optimize the website, and to ensure the security of our information technology systems. We do not evaluate this data for any marketing purposes.

4. Storage duration. The data will be deleted as soon as it is no longer required. If collected for the provision of the website, it is retained for a maximum of 7 days.

5. Possibility of objection and deletion. The collection of data for the provision of the website is absolutely necessary for its operation; you do not have the possibility to object to its collection.

6. Data recipients / transfer to third countries. In addition to us, our hosting provider Heroku, Salesforce, 415 Mission St., 3rd Floor, San Francisco, CA 94105, USA, has access to this data (privacy policy: salesforce.com/company/privacy). Our service provider SolarWinds Worldwide, LLC, 7171 Southwest Parkway, Bldg 400, Austin, Texas 78735, USA, also has access (solarwinds.com/legal/privacy), as does our cloud monitoring provider New Relic, Inc., 188 Spear Street, Suite 1200, San Francisco, CA 94105, USA (newrelic.com/termsandconditions/privacy). These service providers are based in the USA, outside the EU, where the ECJ has found there is currently no comparable level of data protection, as US authorities and secret services could access this data. By visiting the website you consent to this transmission and possible access.

II. Use of website cookies

1. Description and scope of data processing. Our website uses cookies, text files stored on or by your internet browser containing a distinctive string enabling identification of the browser on repeat visits. We use cookies to make our website more user-friendly, storing language settings so the site displays in your previously chosen language. We also use analytics cookies that can transmit: the user's IP address; website accessed; referrer website; subpages accessed; time and duration of access; frequency of access; location (via IP); browser; device information (OS, version, brand, model); and user events. You are informed about analytical cookies and asked for consent when accessing the site, with reference to this Privacy Policy.

2. Legal basis for data processing. The legal basis for technically necessary cookies is Art. 6 para. 1 lit. f GDPR; for analytics cookies where consent is obtained, Art. 6 para. 1 lit. a GDPR, obtained via a consent/cookie banner.

3. Purpose of data processing. Technically necessary cookies simplify use of the website; some features cannot be offered without them. They are not used to build user profiles. Analytics cookies help us understand website usage and continuously optimize our service, also covered by our legitimate interest under Art. 6 para. 1 lit. f GDPR.

4. Duration of storage and options for objection and removal. Cookies are stored on your device and transmitted to our site; you have full control via your browser settings to disable, restrict, or delete cookies at any time. Disabling cookies may limit some website functionality.

5. Data recipients / transfer to third countries. Our analytics provider Google Analytics, Google, 1600 Amphitheater Pkwy, Mountain View, CA 94043, USA, has access to this data (privacy policy: cloud.google.com/security/privacy). See also our comments on Google Analytics below. The following cookies are set by Google:

III. Newsletter

1. Description and scope of data processing. You can subscribe to a free newsletter on our website, blog, and in our app (as a registered user). Registration collects: email address; optionally first and last name; the user's IP address; time of registration. A double opt-in procedure is used, requiring confirmation by the user before activation.

2. Legal basis for data processing. Where consent has been obtained, the legal basis is Art. 6 para. 1 lit. a GDPR.

3. Purpose of data processing. The email address is collected to deliver the newsletter.

4. Storage duration. The email address is stored for as long as the subscription is active.

5. Possibility of objection and deletion. You may cancel your subscription at any time via a link in every newsletter, which also withdraws consent to storage of related personal data.

6. Data recipients / transfer to third countries. Our newsletter provider Iterable, Inc., 71 Stevenson St, #300, San Francisco, CA 94105, USA, has access to this data (privacy policy: iterable.com/trust/privacy-policy). This provider is based in the USA, outside the EU; by signing up you consent to this transmission and possible access by US authorities.

IV. Newsletter tracking

1. Description and scope of data processing. Newsletters contain tracking pixels, miniature graphics embedded in HTML emails to record and analyze log data, used to evaluate whether and when an email was opened and which links were clicked.

2. Legal basis for data processing. Where consent was given when subscribing, the legal basis is Art. 6 para. 1 lit. a GDPR.

3. Purpose of data processing. This improves newsletter quality and optimizes our offers.

4. Storage duration. Data is stored for as long as the newsletter subscription is active.

5. Possibility of objection and deletion. You can prevent tracking by disabling image loading in your email program, or revoke consent at any time; unsubscribing is also treated as revocation of tracking consent.

6. Data recipients / transfer to third countries. Our newsletter provider Iterable, Inc. (address as above) has access to this data for the same reasons as above.

V. Email contact

1. Description and scope of data processing. When you contact us by email, we store the personal data transmitted, including: email address; content of the message; if applicable, name; if applicable, email signature contact details. This data is not disclosed to third parties and is used exclusively to carry out the conversation.

2. Legal basis for data processing. The legal basis is Art. 6 para. 1 lit. f GDPR, or additionally Art. 6 para. 1 lit. b GDPR if the email aims to enter into an agreement with us.

3. Purpose of data processing. The purpose is to initiate and establish contact.

4. Storage duration. Data is deleted once no longer required for its purpose.

5. Possibility of objection and deletion. You may object to storage at any time, though this ends the ability to continue the conversation.

6. Data recipients / transfer to third countries. Our email provider Google (Gmail), 1600 Amphitheater Pkwy, Mountain View, CA 94043, USA, has access to this data (privacy policy: cloud.google.com/security/privacy), based in the USA outside the EU as described above.

VI. Gift Cards (Purchase and Redemption)

1. Description and scope of data processing. When purchasing and redeeming KptnCook Gift Cards, we process personal data of purchasers and, where applicable, recipients (e.g. name, email address, order/transaction data, voucher/code information, redemption status) to enable purchase, management, and redemption.

2. Legal basis for data processing. Art. 6(1)(b) GDPR for purchaser data; Art. 6(1)(f) GDPR for recipient email processing where no separate registration occurs.

3. Recipients / processors. Gift Up Ltd (UK), technical provider for sale and management of Gift Cards (processor under Art. 28 GDPR); Stripe Payments Europe, Ltd. (Ireland) for payment processing (Stripe generally acts as an independent controller for payment data).

4. Data transfers to third countries. Gift Up processes data within the EU/UK, with appropriate safeguards for any transfers; Stripe may use sub-processors outside the EU/UK protected via Standard Contractual Clauses under Art. 46 GDPR.

5. Storage period. Contract and transaction data are stored per statutory retention obligations (typically 6-10 years under commercial and tax law); technical voucher logs and recipient emails are deleted once no longer required unless statutory retention applies.

6. Necessity of data provision. This data is required to complete purchase, delivery, and redemption of the Gift Card.

VII. Prize competition

1. Description and scope of data processing. You can take part in competitions via our website or newsletter, for which we collect: surname (if applicable); first name (if applicable); email address.

2. Legal basis for data processing. Art. 6 para. 1(a) GDPR, where the data subject has consented.

3. Purpose of data processing. Your data is used only to carry out the competition.

4. Storage duration. Data is processed only as long as necessary for the competition and statutory retention requirements.

5. Possibility of objection and deletion. You can object and request deletion at any time, though further participation is then not possible.

6. Data recipients. Data is only passed to third parties if necessary for the competition; no other transmission occurs.

VIII. Web analysis by Google Analytics

1. Description and scope of data processing. This website uses Google Analytics, a web analysis service by Google Inc. Google Analytics uses cookies to analyze your use of the website; the resulting information is transmitted to and stored by Google on a server in the United States and used to evaluate website usage, compile activity reports, and provide related services to us. Your IP address transmitted via Google Analytics is not merged with other Google data. You may prevent cookie storage via your browser settings, though this may limit functionality. Your IP address may be sent to Google servers in the USA, a third country outside the EU without an equivalent level of data protection; US laws allow US intelligence agencies and authorities potential access to such servers and lines. The prior Safe Harbor and Privacy Shield frameworks have been invalidated by the European Court of Justice.

2. Legal basis for data processing. We obtain your consent to the use of Google Analytics and the setting of a cookie by Google via a cookie consent banner when you access the website. By ticking the box, you actively consent to the data processing described above, including the possibility that US secret services could access the server, the transmission lines, and thus your IP address once transmitted to Google servers in the USA. The legal basis is Art. 6 para. 1 lit. a, 7, 49 para. 1 lit. a GDPR.

3. Purpose of data processing. We use Google Analytics to analyze your browsing behavior so we can better tailor our website and products to your needs.

4. Duration of storage, possibilities for objection and data deletion. Cookies are stored by Google on your device and transmitted to our site; you have full control via your browser settings to disable, restrict, or delete them, though this may limit some functionality.

5. Data recipients. Our analytics provider Google Analytics, Google, 1600 Amphitheater Pkwy, Mountain View, CA 94043, USA, has access to this data (privacy policy: cloud.google.com/security/privacy).

Privacy Policy of the App

I. Provision of the app

1. Description and scope of data processing. We provide a mobile app you may download if you are at least 16 years old; parental consent is required otherwise per Art. 8 para. 1 sentence 2 GDPR. When using the app, our system collects: the user's IP address; device information (OS and version, brand, model, Android Advertising ID, Apple IDFA/IDFV, language setting); location (via IP); optionally GPS coordinates; time and duration of access; optionally diet information (e.g. "vegetarian diet"); user events (e.g. favoriting a recipe); device tokens for push notifications.

2. Legal basis for data processing. Where consent has been obtained, Art. 6 para. 1 lit. a GDPR.

3. Purpose of data processing. Device information helps developers address specific problems; diet and event information improves relevant content delivery and app optimization; device tokens enable push notifications and in-app messages, with location supporting targeted alignment; further data is used for app and marketing optimization.

4. Storage duration. Data is deleted once no longer required or statutory retention obligations expire.

5. Possibility of objection and deletion. As an unregistered user you may delete the app at any time to prevent further processing, or request deletion or changes by email.

II. Account registration

1. Description and scope of data processing. We offer users the ability to register with personal data, required for an extended range of functions or a subscription, collecting: email address; first and last name; time of registration; login data; optionally a profile picture; optionally notes on recipes; when registering via Facebook, Facebook profile picture, first and last name.

2. Legal basis for data processing. Where consent has been obtained, Art. 6 para. 1 lit. a GDPR.

3. Purpose of data processing. Registration enables favoriting more than 25 recipes, creating recipe collections, sharing shopping lists with other users, and logging in on multiple devices.

4. Storage duration. Data is deleted once no longer required, including if registration is cancelled or changed.

5. Possibility of objection and deletion. You may cancel registration at any time, change stored data, and delete your account at any time via the app settings.

III. Prize Competition

1. Description and scope of data processing. You can take part in competitions via our website or newsletter, for which we collect: surname (if applicable); first name (if applicable); email address.

2. Legal basis for data processing. Art. 6 para. 1(a) GDPR, where consent has been given.

3. Purpose of data processing. Your data is used only to carry out the competition.

4. Duration of Storage. Data is processed only as long as necessary for the competition and statutory retention requirements.

5. Possibility of objection and deletion. You can object and request deletion at any time, though further participation is then not possible.

6. Data recipients. Data is only passed to third parties if necessary for the competition.

IV. Paid and trial subscription

1. Description and scope of data processing. In addition to free use, you may sign up for a paid subscription or a trial. Payment information, including credit card data, is collected and stored via the platform provider (Apple or Google); KptnCook itself does not process credit or bank card details, receiving only: time of subscription; subscription term; type of subscription.

2. Legal basis for data processing. Where consent has been obtained, Art. 6 para. 1 lit. a GDPR; where necessary to fulfill an agreement, Art. 6 para. 1 lit. b GDPR.

3. Purpose of data processing. This information improves content delivery, service optimization, and is necessary to use a trial or paid subscription.

4. Storage duration. Data is stored as long as necessary for these purposes and statutory retention requirements.

5. Possibility of objection and deletion. You may object to processing and request deletion at any time.

V. Use of the AI Chatbot

1. Description and scope of data processing. We offer an AI-powered chatbot in our app for recipe-related questions and support. Content you enter (e.g. recipe modifications or ingredient questions) is transmitted to a third-party AI provider (currently Google Cloud, model "Gemini") to generate a response, processed in real time. Depending on your location, data may be processed on servers outside the EU; we have data protection agreements including standard contractual clauses with our provider. AI-generated content may occasionally be incorrect or misleading; further information is in our Terms of Use.

2. Legal basis for data processing. Art. 6(1)(f) GDPR, based on our legitimate interest in providing interactive support.

3. Purpose of Data Processing. To generate helpful, context-specific responses and to improve the chatbot and user experience.

4. Duration of Storage. Data is stored only as long as necessary; communication is anonymized where technically possible and not used for advertising or profiling.

5. Right to Object and Deletion Options. You may object at any time and request deletion of collected personal data.

VI. Disclosure of personal data to third parties

1. Description and scope of data processing. Where necessary for our contractual or legal obligations, your data is passed to service providers; a list is available.

2. Legal basis for data processing. Data is passed on only within relevant data protection and competition law requirements, per Art. 6 para. 1(a) GDPR where consent has been given.

3. Purpose of data processing. This enables provision of services in our name or on our behalf (e.g. email dispatch, payment processing, push notifications).

4. Storage duration. Data is deleted once no longer required or statutory obligations expire; see also each service provider's privacy notices.

5. Possibility of objection and deletion. You may object and request deletion at any time.

VII. Transfer to third countries

1. Description and scope of data processing. To provide KptnCook-related services, data is also transmitted to third countries; processing outside the EU/EEA must meet the requirements of Art. 44 et seq. GDPR.

2. Legal basis for data processing. Processing occurs on the basis of special guarantees such as Standard Contractual Clauses.

3. Purpose of data processing. This enables provision of services in our name or on our behalf.

4. Storage duration. Data is deleted once no longer required or statutory obligations expire.

5. Possibility of objection and deletion. You may object and request deletion at any time.

VIII. Recipients of data (in third countries) / Service providers with access to personal data (from third countries)

KptnCook works with service providers to offer KptnCook-related services; each receives personal data and is commissioned to process it for specific purposes. A list of all service providers with the purpose and location of processing is available on request at support@kptncook.com. These providers are based in the USA, outside the EU, where the ECJ has found there is currently no comparable level of data protection, as US authorities and secret services could access this data; by using the app you consent to this transmission and possible access.

Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights, which you can assert by emailing support@kptncook.com:

1. Right to information, including: the purposes of processing; categories of data processed; recipients or categories of recipients; planned storage duration or criteria for determining it; existence of rights to correction, deletion, restriction, or objection; right to lodge a complaint with a supervisory authority; source of data if not collected directly from you; existence of automated decision-making including profiling, and information about the logic, scope, and intended effects; and whether your data is transferred to a non-EU country, with information on appropriate safeguards under Art. 46 GDPR.

2. Right to have data corrected, if incorrect or incomplete, which we must action immediately.

3. The right to restrict processing, where: you dispute the accuracy of the data (for the duration of verification); the processing is unlawful and you prefer restriction over deletion; we no longer need the data but you need it for legal claims; or you have objected under Art. 21 para. 1 GDPR pending assessment. Restricted data may only be processed with your consent or for legal claims, protection of others' rights, or important public interest, and you will be informed before any restriction is lifted.

4. Right to erasure. You may request immediate deletion where: the data is no longer necessary; you withdraw consent with no other legal basis; you object under Art. 21 GDPR with no overriding legitimate grounds; the data was unlawfully processed; erasure is required by law; or the data was collected under Art. 8 para. 1 GDPR in relation to information society services. If we have made your data public, we will take reasonable steps to inform other controllers of your erasure request. The right to erasure does not apply where processing is necessary for freedom of expression and information, compliance with a legal obligation or public interest task, public health reasons under Art. 9, archiving/research/statistical purposes under Art. 89, or the establishment, exercise, or defense of legal claims.

5. Right to information about recipients notified of any correction, deletion, or restriction, unless impossible or disproportionately burdensome.

6. The right to data portability, to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is based on consent or contract and carried out by automated means; you may also request direct transmission between controllers where technically feasible.

7. Right of objection to processing based on Art. 6 para. 1 lit. e or f GDPR, including related profiling, unless we demonstrate compelling legitimate grounds overriding your interests or the processing serves legal claims; you have an unconditional right to object to processing for direct marketing purposes at any time.

8. The right to revoke consent at any time, without affecting the lawfulness of processing carried out before the revocation.

9. The right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effect, unless necessary for a contract, authorized by law with safeguards for your rights, or based on your explicit consent; such decisions may not be based on special categories of data unless specific conditions and safeguards apply, and you retain the right to obtain human intervention, express your view, and contest the decision.

10. The right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, workplace, or the place of the alleged infringement, if you believe processing of your data infringes the GDPR; the supervisory authority will inform you of the status and outcome of the complaint, including the possibility of judicial remedy under Art. 78 GDPR.

The text of this Privacy Policy is translated; in case of inconsistency between the German version and any other language version, the German language version shall prevail.