Política de privacidade
This policy explains how Culinaro processes personal data for accounts, chef profiles, recipes, requests, messages, reviews, verification, security and support.
We may collect account details such as username and email, profile and chef-service information, recipes and media you publish, request details, messages needed to deliver the service, reviews, cookie preferences, device data, technical logs and verification status data.
Identity and liveness checks are performed only in the hosted environment of the configured verification provider. Culinaro does not request or store copies of identity documents, selfies or raw OCR text. We receive and keep only the provider reference, outcome/status and timestamps needed to protect the marketplace. Verification is unavailable when the hosted provider is not configured or its monthly limit is reached.
We use data to operate Culinaro, display public content, connect clients and chefs, deliver messages and requests, manage reviews, provide support, secure accounts, prevent abuse, improve the product and meet legal obligations.
Account, profile, support, messaging and request data are processed to provide the requested service or take pre-contractual steps (Article 6(1)(b) GDPR). Security, fraud prevention, service reliability, moderation and limited dispute evidence rely on legitimate interests (Article 6(1)(f)). Accounting or mandatory disclosures rely on legal obligations (Article 6(1)(c)). Optional analytics and any dietary or allergy health details rely on explicit, withdrawable consent (Articles 6(1)(a) and, for health data, 9(2)(a)).
Chef profile fields, public recipes, article bylines, images and reviews are published at the user's request and can be indexed by search engines, cached or linked by third parties. A profile can be hidden or published from Settings; hiding removes it from Culinaro public search and sitemap, but does not instantly remove independent search-engine caches. Do not publish private contact, identity, health or other sensitive information. De-indexing can be requested separately.
Do not add health or allergy details to public profiles, recipes or general messages. A chef request provides a separate optional protected flow for dietary or allergy information. It is shared only with the selected chef and authorised support staff after explicit consent, for planning that request. If the details concern a guest, the requester must first inform that person and obtain their explicit permission to provide the data. The requester can withdraw consent and remove the details from the request at any time without affecting earlier lawful processing.
We do not sell personal data. Public profile, recipe and review content may be visible to other users and search engines. Request and message details are shared with the relevant client or chef. We may disclose data where required by law.
We use vetted processors for EU hosting and email, optional Google Analytics, AI-assisted translation of submitted recipe/blog content, and Didit identity verification when enabled. We require data-processing terms before enabling a processor. Where a processor or subprocessor receives data outside the EU/EEA, we use an adequacy decision, Standard Contractual Clauses and transfer assessment, or another valid safeguard described in the current processor register.
Prestadores de serviçosActive account/profile data is kept until account closure; approved erasure anonymises it, with removal from rolling backups targeted within 30 days. Dietary/allergy details are removed on consent withdrawal and have a proposed maximum of 90 days after a request is completed, rejected or cancelled. Support enquiries are kept up to 12 months after closure, security logs up to 90 days, and ordinary request/message records up to 3 years after last activity for disputes. Legal acceptance and booking audit records may be kept up to 5 years. Culinaro verification references/status are removed within 90 days after account closure unless a dispute or law requires longer. Analytics data is limited to 14 months. Legal holds override deletion only for the affected records.
You can request access, correction, deletion, restriction, portability or objection where applicable by contacting us. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Registered users can also use Privacy & data in Settings. We respond without undue delay and normally within one month; for complex or multiple requests this may be extended by up to two further months with an explanation within the first month.
Account identifiers and the information marked as required in a request are needed to provide the selected Culinaro service. Without them, the relevant account, request or communication feature cannot be provided. Culinaro does not currently make decisions based solely on automated processing that produce legal or similarly significant effects for users.
We use HTTPS, HttpOnly session cookies, role-based access, origin checks for state-changing requests, logging and operational safeguards designed to protect personal data. Culinaro does not store identity-document or selfie files. No online service can guarantee absolute security.
The lead supervisory authority for the controller is the Commission for Personal Data Protection (CPDP) in Bulgaria. You may contact us first, lodge a complaint with the CPDP, or contact another supervisory authority competent under the GDPR.