1. Who we are and what this policy covers
This policy explains how CHEFNOMICS TECHNOLOGIES W.L.L., trading as Chefnomics (Commercial Registration No. 200684-1), registered at Level 2, Unit 202, The Terminal, Building 120, Road 3803, Manama, Kingdom of Bahrain ("Chefnomics", "we", "us"), handles personal data when you use chefnomics.com and the Chefnomics app.
Chefnomics is a service for restaurant businesses and their staff. It is not meant for consumers or for anyone under 18.
Our role. We are the data controller for your account, sign-in security and billing details. For the restaurant business data you enter (recipes, ingredient costs, suppliers, prices), we process it on your behalf to run the service. You decide what to enter, and you are responsible for having the right to enter it (see section 2).
The law. We follow Bahrain's Personal Data Protection Law (Law No. 30 of 2018). Where the EU or UK GDPR applies to you, we also honor the rights in section 8.
Questions about this policy: support@chefnomics.com.
2. Personal data we handle
About account owners and team members
- Email address, name, country and, if you choose to give it, a phone number. Owners also enter the names and email addresses of their team members, which stay in the team list and team history while the account exists.
- Your password, stored only as a one-way hash that nobody can read.
- If you turn on two-step sign-in: an authenticator app setup and backup codes (stored as hashes).
- Your preferences, such as language, theme, date format, start page and which guided tours you have seen.
Sign-in and security records
- For each signed-in session: a description of your device and browser, your IP address, and an approximate city and country (worked out from the IP address by our hosting provider).
- A security activity log of sign-ins, failed sign-ins, password and email changes, two-step sign-in changes and downloads. It records the IP address and approximate location. We keep it for 1 year and then delete it automatically. Each person can see only their own sign-in and security records. Owners cannot see their team members' records, but they can see team access changes and who changed which recipe or item.
- We email you when someone signs in from a device we do not recognize. To block password guessing, we keep a short count of sign-in, sign-up and password reset attempts by email address and internet address, deleted after one day. Each time you accept our documents (at sign-up, at checkout or when adding a restaurant), we also record which documents and versions, which boxes you ticked, the language shown, the date and time, and your IP address and browser.
Restaurant business data
- Ingredients, prices, pack sizes, recipes, methods, photos, categories, catering events, promotions, batch plans, price history and reports.
Personal data about other people that you enter
- Suppliers' contact details (phone, email, address).
- Names you enter on catering events and batch plans, such as a client or recipient.
You are responsible for having the right to enter these details. Please do not enter anything more sensitive than a business contact needs.
Files and voice
- Photos and logos you upload are private and can be opened only by your account.
- Files you attach to Chef AYA (photos, PDFs, Word and Excel files) are used to read the recipe or invoice. We delete them after about one day.
- Voice messages are sent for transcription and turned into text. We do not store the recording.
AI usage records
- For each Chef AYA request: the date, the AI model used, the amount of AI usage and its cost. The usage records never include what you wrote. We also save every question you type into the Help assistant, with its answer, and short notes of anything Chef AYA could not understand in a message. These are kept per restaurant so we can see what Chef AYA misses, and are deleted automatically after 12 months.
Billing
- Through Tap Payments: your billing name, email and the amount. Card, Apple Pay and Benefit Pay details go straight to Tap and never reach us. Tap sends back to us only the card type, the last 4 digits, the expiry month and year, and its own references for you, your card and your renewal agreement. We also keep your billing address and tax number if you enter them in Plan and Billing. We keep payment records and send receipts that show our company details and a reference number.
We do not run advertising, we do not sell personal data, and we do not use tracking analytics. We do not knowingly collect special categories of personal data, so please do not enter any in free-text fields.
3. How we use data and why
| Purpose | Data used | Basis |
|---|---|---|
| Provide the app: costing, pricing, reports, catering, team seats | Account data, restaurant business data | Performing our contract with you |
| Run Chef AYA, voice and photo reading | What you send to Chef AYA | Performing our contract with you |
| Keep accounts secure: sign-in checks, rate limits, session control, security log, new-device and security alert emails | Account data, sign-in and security records | Legitimate interest; legal obligations |
| Send service emails: verification, password reset, invitations, cost alerts, monthly summaries | Account data | Performing our contract with you |
| Take payment and manage your subscription | Billing data | Performing our contract; legal obligations |
| Find and fix errors | Error details with personal data removed | Legitimate interest |
| Control AI cost and keep fair usage limits | AI usage records | Legitimate interest |
| Answer support requests | Support messages, account data | Legitimate interest |
| Meet legal, tax and accounting duties | Billing data | Legal obligation |
Where Bahrain law requires your consent for a use, we ask for it separately and you can withdraw it at any time. We do not sell your personal data. We also keep proof of what you agreed to, which we need to deal with disputes. We save Help questions and notes of what Chef AYA could not understand to see what it misses and to improve it, which is in our legitimate interest. By improving Chef AYA we mean that we read them and adjust our own instructions. We never use them to train AI models. We send service emails only: account and security emails, billing emails (receipts, failed payments, renewal reminders), cost alert emails (on by default, and you can turn them off in Settings) and a monthly cost update email (off by default). We send no marketing emails.
4. AI features (Chef AYA)
Chef AYA is our AI assistant. You describe a dish, or attach an invoice, recipe file or photo, and Chef AYA turns it into a costed recipe. It also answers questions in the in-app Help.
What is sent to our AI provider, Anthropic (USA)
- For Chef AYA: your message, any attached photos or PDFs, your restaurant's ingredient names and pack sizes, your recipe names, the recipe you are building, and the recent messages for that recipe.
- For Help: only the question you type.
- Chef AYA does not receive your email address, your login details or your saved prices.
Voice. If you use voice, the recording goes to OpenAI (USA) to be turned into text, together with up to 100 of your ingredient and recipe names as spelling hints. We do not store the recording. We do not store your Chef AYA conversations, except short notes of anything Chef AYA could not understand, kept for 12 months. Your messages are sent to Anthropic only to get the answer. Questions you type into Help are saved with their answers for 12 months. Our usage records hold only the AI model used, the amount used and the cost.
How it works for you
- Only your account's data is used. Chef AYA works with the account that is asking, never another restaurant's data.
- The AI does not do the maths. Costs, margins, yields, tax and prices come from our own fixed formulas. The AI only interprets what you typed or uploaded.
- You approve changes. Prices Chef AYA picks up wait in a review list. Nothing is saved until you tick it and press save.
- Usage limits. Each restaurant has a monthly Chef AYA usage limit. When it is reached, Chef AYA pauses for that restaurant and the rest of the app keeps working.
- No training on your data. We do not use your recipe and pricing data to train AI models. Under their business terms, our AI providers do not train on data sent through their API. They may keep it for up to 30 days for safety checks and then delete it.
Chef AYA does not make decisions about people. It only helps you cost recipes, and you approve every change. Chef AYA can misunderstand you, and AI output can be wrong. Please check the figures before you rely on them.
5. Who we share data with, and transfers abroad
We never sell your data. We share it only with the service providers below, which help us run Chefnomics, and only what each one needs.
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| Supabase | Database | All account and restaurant data | Ireland (EU) |
| Vercel | Runs the website | Every request to the app | Dublin, Ireland (EU) |
| Cloudflare R2 | File storage | Uploaded photos, logos and Chef AYA attachments | EU |
| Anthropic | Powers Chef AYA and Help | As described in section 4 | USA |
| OpenAI | Turns voice messages into text | The recording and up to 100 ingredient and recipe names | USA |
| Resend | Sends our emails | Email address, name and the email content | Ireland (EU) |
| Sentry | Error reports | Error details, with emails, cookies, request contents and IP addresses removed first | EU |
| Cloudflare Turnstile | Bot check at sign-up | What your browser sends to the check | Run by Cloudflare under its own privacy terms |
| open.er-api.com | Exchange rates | Only a currency code, for example BHD | |
| Tap Payments | Takes payment | Billing name, email and amount | Bahrain and the GCC |
We may also disclose data when the law requires it, to protect our rights, or in a sale or restructuring of the business, with notice to you where the law requires.
We use Cloudflare to protect our website from attacks, so Cloudflare sees visitors' internet addresses and requests, under Cloudflare's own privacy terms. We may use Cloudflare Turnstile to check that a sign-up is made by a person. It is run by Cloudflare under Cloudflare's own privacy terms. When you pay, you do so on Tap Payments' own page. Tap runs that page under its own policies and may set its own cookies there.
Transfers outside Bahrain. Your data is stored in the European Union (Ireland), and some providers process data in the USA. We transfer data only to countries that Bahrain's Personal Data Protection Authority lists as providing adequate protection, or where Bahraini law otherwise allows it, and our providers are bound by contract to protect it. If we add or replace a provider that receives personal data, we will update this table before the change takes effect.
6. How long we keep data, export and deletion
| Data | How long we keep it |
|---|---|
| Your account and business data, while the account is active | For as long as the account is active |
| After you delete your account | A 30-day window to change your mind (choose "Keep my account" when you sign in), then your account and everything in it is permanently deleted: restaurants, recipes, ingredients, history, sign-in records, the security log and stored pictures. Payment records and records of what you accepted are kept (see below) |
| If you stop paying but do not delete | Kept, but locked, for 12 months so you can come back. We email a reminder 30 days before deletion |
| Security activity log | 12 months |
| Chef AYA attachments | About one day |
| Unfinished Chef AYA work saved on your device | Until you submit it, choose "Start fresh" or sign out, and in any case dropped after 14 days |
| Backups | Daily database backups by Supabase, kept for 7 days, and deleted data is gone from the backups within 7 days |
| Payment records | Kept for 10 years after the end of the accounting year they belong to, as Bahrain's Commerce Law requires, also after an account is deleted. They include the billing name and contact details as they were when you paid. Only the link to the deleted account is removed |
| Support emails | 2 years |
| Help questions and answers, and notes of what Chef AYA could not understand | 12 months, then deleted automatically |
| Records of what you accepted (documents and versions, boxes ticked, language, date and time, IP address and browser) | 10 years after your account ends, as proof in case of a dispute. Longer only while a dispute or investigation is open |
Export. You can download your data at any time (Excel, CSV, PDF and a full backup). The backup includes your account, all your restaurants and their data, the change history, team members, invitations, sign-in records and the security log. It does not yet include payment history or the records of what you accepted.
Earlier deletion. To ask for earlier deletion of anything, email support@chefnomics.com. We may ask you to confirm you own the account first.
Copies in backups are gone within 7 days. Our providers' short-term logs (hosting and email) are removed on those providers' own schedules. Records of what you accepted (documents and versions, the boxes you ticked, the language, the date and time, your IP address and browser) are kept for 10 years after your account ends, also after your account is deleted, as proof in case of a dispute. We keep them longer only while a dispute or investigation is open.
7. How we protect your data
- Connections are encrypted (HTTPS) everywhere.
- Passwords are stored only as hashes, never in plain text.
- Two-step sign-in is available to owners and team members, but is not required.
- Each restaurant's data is kept separate from other accounts, and we test this.
- Private files can be opened only by their own account.
- Sign-in attempts are rate-limited, and we send alerts for unusual sign-in activity.
- Error reports are scrubbed of personal data before they are sent.
- Team members are invited as separate logins with permissions chosen by the owner, who can pause or remove them at any time.
We access your account only to support you, fix a problem, keep the service safe or when the law requires it, and we record when we lock or unlock an account or change its limits. No system is completely secure, and we cannot promise otherwise.
If something goes wrong. If a breach affects your personal data, we will tell the Personal Data Protection Authority within 72 hours of finding out, unless the breach is unlikely to affect people's rights. If it is likely to put your rights at high risk, we will also tell you without undue delay. If a breach affects the restaurant data you entered, we will tell the account owner without undue delay, and within 72 hours of finding out where possible.
8. Your rights and controls
You can do much of this yourself in the app:
- see and change your details in Settings;
- download your data (full backup and exports);
- delete your account, with the 30-day window described in section 6;
- see your own sign-in and security activity, and sign out other devices;
- turn on two-step sign-in.
You can also ask us, by email, to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, where we have no legal reason to keep it;
- stop or limit how we use your data, or object to a use based on our legitimate interest;
- stop processing that rests on your consent, by withdrawing it.
These rights come from Bahrain's PDPL and, where it applies to you, the GDPR. Email support@chefnomics.com. We answer privacy requests ourselves, as soon as we can. We may ask you to prove who you are before we act, and we reply within the time the law allows (within one month under the GDPR). You can also complain to the Personal Data Protection Authority in Bahrain, or to your local data protection authority if you are outside Bahrain.
Team members. If you are invited by a restaurant owner, the owner controls that restaurant's business data and your permissions, and some requests may need to go to them. The owner can see your name and email, your access settings, and who changed which recipe or item.
Other people's details. If you are a supplier or client whose details a restaurant owner entered, the restaurant owner is responsible for them. You can ask us to pass your request on, and we will help where we can.
9. Cookies, children, changes and contact
Cookies and on-device storage. We use only what the app needs to work. We use no advertising or analytics cookies.
| Name | What it does | How long it lasts | Security settings |
|---|---|---|---|
| costflo_session | Keeps you signed in | Until you close the browser, or 30 days if you choose "Remember me" | HttpOnly, Secure, SameSite=Lax |
| costflo_active_brand | Remembers which restaurant is open | 1 year | HttpOnly, Secure, SameSite=Lax |
| chefnomics_device | Recognizes a device you have used before, so we can email you about sign-ins from new devices | About 13 months (400 days) | HttpOnly, Secure, SameSite=Lax |
| cf_lang | Remembers the language you chose on the website | 1 year | SameSite=Lax |
Your browser also stores two display choices on the Pricing screen (whether to show prices with VAT and whether to include delivery packaging) and unfinished Chef AYA work, so it can be restored if the page reloads. Unfinished work is kept per login and restaurant, cleared when you submit, choose "Start fresh" or sign out, and dropped after 14 days.
Children. Chefnomics is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.
Changes. If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect, and ask you to accept it again where the law requires. This is version 1.0, effective 5 November 2026.
Contact. CHEFNOMICS TECHNOLOGIES W.L.L., trading as Chefnomics, Level 2, Unit 202, The Terminal, Building 120, Road 3803, Manama, Kingdom of Bahrain. Email: support@chefnomics.com.