Privacy Policy

Last updated: April 3, 2026

WiseChef ("we", "us", "our") operates the wisechef.ai platform. This policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and applicable Polish and EU data protection law.

1. Data Controller

Adam Krawczyk, operating as WiseChef
Kraków, Poland
Contact: [email protected]

2. What Data We Collect

Account data: Name, email address, company name — provided at signup.
Payment data: Processed by Stripe. We do not store card numbers. Stripe acts as an independent data controller for payment data.
Usage data: Pages visited, features used, timestamps — collected for analytics and service improvement.
Communication data: Messages exchanged with your AI assistant (WhatsApp, Telegram, Signal) — stored on your dedicated server instance.
Technical data: IP address, browser type, device info — collected automatically via server logs.
API keys: Third-party API credentials you configure (e.g., OpenRouter) — stored encrypted on your dedicated VPS.

3. Legal Basis for Processing

Contract performance (Art. 6(1)(b) GDPR): Processing account and service data to deliver the platform.
Legitimate interest (Art. 6(1)(f) GDPR): Analytics, security monitoring, fraud prevention.
Consent (Art. 6(1)(a) GDPR): Optional cookies, marketing communications.

4. How We Use Your Data

Provision and maintenance of your AI assistant and agent services
Processing payments via Stripe
Sending transactional emails (via Resend)
Improving our platform and user experience
Security monitoring and abuse prevention

5. Third-Party Processors

Hetzner Online GmbH (Germany) — VPS hosting. Data stays in EU.
Stripe, Inc. (USA) — Payment processing. EU-US Data Privacy Framework certified.
Resend (USA) — Transactional email delivery.
Cloudflare, Inc. (USA) — DNS, CDN, DDoS protection.
OpenRouter / LLM providers — AI model inference. Data sent per your API key configuration.

6. Data Retention

Account data: Retained while your account is active + 30 days after deletion.
Communication data: Stored on your dedicated VPS. Deleted when your subscription ends and VPS is decommissioned (within 7 days).
Server logs: 90 days.
Payment records: As required by Polish tax law (5 years).

7. Your Rights (GDPR)

You have the right to:

Access your personal data (Art. 15)
Rectify inaccurate data (Art. 16)
Erase your data ("right to be forgotten") (Art. 17)
Restrict processing (Art. 18)
Data portability — receive your data in a machine-readable format (Art. 20)
Object to processing based on legitimate interest (Art. 21)
Withdraw consent at any time for consent-based processing (Art. 7(3))

To exercise any right, email [email protected]. We will respond within 30 days.

8. Cookies

We use:

Essential cookies: Session management, security tokens. Required for the platform to function.
Analytics cookies: Used only with your consent to understand usage patterns.

You can manage cookie preferences via the cookie banner on first visit, or clear cookies in your browser at any time.

9. Data Security

We implement:

TLS/SSL encryption for all data in transit
Encrypted storage for API keys and credentials
Dedicated VPS per client (data isolation)
IP-restricted access to management APIs
Regular security audits

10. International Transfers

Your data is primarily processed in the EU (Hetzner, Germany). Where data is transferred outside the EU (Stripe, Cloudflare, Resend), we rely on EU Standard Contractual Clauses or adequacy decisions.

11. Children

WiseChef is a business platform. We do not knowingly collect data from anyone under 16. If you believe a minor has provided data, contact us for immediate deletion.

12. Supervisory Authority

You have the right to lodge a complaint with the Polish Data Protection Authority:
UODO (Urząd Ochrony Danych Osobowych)
ul. Stawki 2, 00-193 Warszawa
uodo.gov.pl

13. Changes to This Policy

We may update this policy. Changes will be posted here with an updated date. Material changes will be notified via email.