Privacy Policy


Last Updated: 06.09.2025

This Privacy Policy informs you about how GKM Interactive UG (haftungsbeschränkt) processes personal data when you use the mobile app CookingBuddy AI. The app is available worldwide via the Apple App Store and the Google Play Store.

1. Controller
GKM Interactive UG (haftungsbeschränkt)
Wasserstr. 5, 37186 Moringen, Germany
Authorized Representative: Davin Gindorf
Email: contact@gkminteractive.com

2. Data Protection Contact
For data protection inquiries: contact@gkminteractive.com
(No Data Protection Officer has been appointed; should this become a legal requirement in the future, this information will be updated.)

3. Scope, Definitions, and Age Limits
This policy applies to the use of the CookingBuddy AI app (iOS/Android).
The app is intended for users worldwide. For the European Economic Area (EEA), Switzerland, and the United Kingdom, local data protection laws also apply.
Minimum Age (EEA): The app is intended for individuals aged 16 and over. Persons under 16 in the EEA should only use the app with the consent of their legal guardians.

4. Purposes, Data Categories, Legal Bases, and Storage Periods
Personal data is processed only to the extent necessary to provide the app's features, if you have given your consent, or if a legal permission exists. The main processing operations are detailed below:

4.1 Account Registration & Authentication (Apple/Google Sign-In)
  • Data Categories: Email address, name/profile name (if provided), provider ID, timestamp, internal user ID
  • Purposes: Account creation, login, user account management
  • Legal Basis: Art. 6(1)(b) GDPR; where applicable, Art. 6(1)(f) (secure authentication)
  • Storage Period: Until account deletion; statutory retention obligations remain unaffected

4.2 App Features: "Generate Recipes," "Upload Pictures," "Share/Save Recipes"
  • Data Categories: Text inputs (recipe requests), food images, generated recipe data, internal IDs/references
  • Purposes: AI-powered recipe suggestions, saving personal recipes, sharing with other users
  • Legal Bases: Art. 6(1)(b) GDPR; Art. 6(1)(f) (stability/security)
  • Storage Period: Personal/saved/public recipes until deletion by you or account deletion; Image uploads are used only for processing and are deleted immediately thereafter
  • Special Categories: Information on allergies/intolerances/health is voluntary; processing for personalization is based solely on your explicit consent (Art. 9(2)(a) GDPR); consent can be revoked at any time

4.3 Push Notifications (FCM/APNs)
  • Data Categories: Device/registration token, language/country code, delivery status
  • Purposes: Service notifications (e.g., recipe shares)
  • Legal Basis: Art. 6(1)(a) GDPR (consent via OS) or Art. 6(1)(b) (service-related)
  • Storage Period: Until consent is revoked/unsubscribed or the token becomes invalid

4.4 Crashes, Performance & Security (Firebase Crashlytics, etc.)
  • Data Categories: Installation/instance IDs, crash logs, device/app metadata, timestamps
  • Purposes: Error analysis, stability, prevention of misuse
  • Legal Basis: Art. 6(1)(f) GDPR
  • Storage Period: Typically up to 90 days; longer internal archives if necessary/permitted

4.5 Usage Analysis & A/B Testing (Firebase/Google Analytics)
  • Data Categories: App events, device identifiers (e.g., Firebase Installation ID), AAID/IDFA only with consent
  • Purposes: Product analysis, feature evaluation, reach measurement, A/B testing
  • Legal Basis: Art. 6(1)(a) GDPR; Sec. 25 TTDSG (access to terminal equipment)
  • Storage Period: According to project settings and until consent is revoked
  • Status: Currently disabled (opt-in required); iOS: no ATT tracking without permission

4.6 Support Communication
  • Data Categories: Email, content data, metadata
  • Purposes: Processing inquiries, providing support
  • Legal Basis: Art. 6(1)(b) GDPR or Art. 6(1)(f)
  • Storage Period: Until the request is resolved; beyond that only as required by law

5. Device Access (Sec. 25 TTDSG) and App Permissions
  • Optional Technologies/SDKs: e.g., Analytics/A/B Testing, IDFA/AAID – activated only after consent
  • Status: Analytics/A-B testing is currently not active (opt-in only)
  • iOS (ATT): No tracking without prior permission
  • App Permissions: Camera/Photos (image uploads), Notifications (push); managed via device settings

6. AI Processing (Vertex AI/Gemini)
  • Your text inputs and, if applicable, images are used exclusively for the respective request
  • Use for training is disabled
  • Special categories of data (allergies/health) are processed only with explicit consent; no use for advertising/profiling

7. Recipients, Data Processing, and Third-Country Transfers
  • Google/Firebase: Functions/Storage us-central1 (Iowa, USA), Firestore Frankfurt (DE), Crashlytics, Cloud Messaging
  • Vertex AI/Gemini: Processing of prompts/responses; Zero-Data-Retention activated
  • Apple/Google: Sign-In and In-App Purchases
  • Third Countries (USA): Secured by Standard Contractual Clauses (+ supplementary measures, if applicable)

8. Storage Locations & Data Flow (Brief Overview)
  • App → Firebase Functions us-central1 (Processing)
  • Firebase Storage us-central1 (Temporary image processing; immediate deletion)
  • Firestore Frankfurt (Permanent recipe/account data)
  • Vertex AI/Gemini (Model execution; no use for training)

9. No Automated Individual Decision-Making
There is no automated decision-making within the meaning of Art. 22 GDPR.

10. Obligation to Provide Data
The provision of basic data (login/account) is necessary; without it, the app cannot be used or can only be used with limited functionality.

11. Your Rights
  • Access, rectification, erasure, restriction of processing, data portability
  • Object to processing based on legitimate interests
  • Withdraw previously given consent with future effect
  • Lodge a complaint with a data protection supervisory authority (in the EEA, the one at your place of residence is competent)

12. Supervisory Authority (Location of the Controller)
The State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany; Email: poststelle@lfd.niedersachsen.de

13. Security
We implement state-of-the-art technical and organizational measures (including transport encryption, access controls, logging).

14. Data Deletion
  • Account/Profile Data: Until account deletion
  • Recipes/Contributions: Until deleted by you or account deletion
  • Image Uploads: Immediately after processing
  • Crash Logs/Diagnostics: Typically up to 90 days
  • Push Tokens: Until consent is revoked/unsubscribed or the token becomes invalid

15. Overview of Third-Party Providers (Excerpt)
  • Google Ireland Limited / Google LLC: Firebase (Auth, Functions, Firestore, Storage, Cloud Messaging, Crashlytics), Analytics (optional), Vertex AI/Gemini
  • Apple Inc. / Apple Distribution International: Sign-in with Apple; In-App Purchases
  • Google LLC / Google Commerce: Google Sign-In; In-App Purchases

16. App Store/Play Store Disclosures
We provide the required information in the store forms ("App Privacy" / "Data Safety") regarding data categories, purposes, linkage to identity, and transfers.

17. Changes to this Privacy Policy
We may adapt this Privacy Policy as needed. The version linked in the app profile is the one that applies. We will inform you of significant changes within the app.

Appendix A – Data Matrix (Brief Overview)
  • Account & Login: Email, name (optional), provider ID, internal user ID — Purpose: Registration/Login — Legal Basis: Art. 6(1)(b) — Storage Location: EU (Frankfurt) — Duration: Account lifetime
  • AI Recipes: Prompts/text inputs, recipe data — Purpose: Recipe generation — Legal Basis: Art. 6(1)(b) — Storage Location: EU (Frankfurt) / Processing via Google — Duration: Until deletion
  • Image Uploads: Image files — Purpose: Processing for recipe generation — Legal Basis: Art. 6(1)(b) — Storage Location: USA (us-central1, temporary) — Duration: Immediately after processing
  • Sharing/Saving: Recipe content, metadata — Purpose: Community features — Legal Basis: Art. 6(1)(b)/(f) — Storage Location: EU (Frankfurt) — Duration: Until deletion
  • Push: Device token, delivery info — Purpose: Service notifications — Legal Basis: Art. 6(1)(a)/(b) — Storage Location: USA/EU (Provider) — Duration: Until revoked/token invalid
  • Crashlytics: Crash logs, device/app metadata — Purpose: Stability/error analysis — Legal Basis: Art. 6(1)(f) — Storage Location: Provider — Duration: approx. 90 days
  • Analytics/A-B: App events, installation ID, AAID/IDFA (if applicable) — Purpose: Product analysis/testing — Legal Basis: Art. 6(1)(a); Sec. 25 TTDSG — Storage Location: Provider — Duration: As per project settings

Appendix B – App Permissions
  • Camera & Photos: Uploading food images
  • Notifications: Push alerts
  • Network Access: Communication with backend/AI services
  • Permissions can be managed in device settings

Appendix C – Apple App Store: App Privacy (Privacy Nutrition Label)
  • Data Used to Track You: None
  • Data Linked to You: Varies by category (see below)
  • Data Not Linked to You: Varies by category (see below)
  • Contact Info: Email (Login/Support) — Purpose: App Functionality, Support — Linked: Yes — Tracking: No
  • Identifiers: Push token, internal user/installation ID — Purpose: App Functionality (Login, Push) — Linked: Yes — Tracking: No — AAID/IDFA only with consent for Analytics/A-B
  • User Content: Recipes (text) — Purpose: App Functionality, Community — Linked: Yes — Tracking: No
  • User Content: Photos/Videos (food images) — Purpose: App Functionality (AI processing) — Linked: No — Tracking: No — temporary and deleted afterwards
  • Diagnostics: Crash data/logs — Purpose: Stability/Error analysis — Linked: No — Tracking: No — Retention ~90 days
  • Purchases: Subscription status/receipts (without payment data) — Purpose: Entitlements — Linked: Yes — Tracking: No
  • Usage Data: App events (opt-in only) — Purpose: Analytics/A-B Testing — Linked: No — Tracking: No

Appendix D – Google Play: Data Safety (Form Mapping)
  • Data shared with third parties: No (except for data processors/service providers like Firebase; not considered "sharing" under Play's definition)
  • Data security: Transport encryption; deletion options (account/data deletion)
  • Collection depends on consent: Analytics/A-B only after opt-in; no AAID/IDFA/Analytics events without consent
  • Account Information: Email, User ID — Collected: Yes — Shared: No — Purpose: Account/Authentication — Optional: No — Retention: Until account deletion
  • Device or other IDs: Push token, Firebase Installation ID — Collected: Yes — Shared: No — Purpose: Push, session management — Optional: No — Retention: Until revoked/token invalid
  • Device or other IDs: AAID/IDFA — Collected: Only on opt-in — Shared: No — Purpose: Analytics/A-B — Optional: Yes — Retention: As per project settings
  • User-generated Content: Recipes (text) — Collected: Yes — Shared: No — Purpose: App functionality/Community — Optional: No — Retention: Until deletion
  • Photos and videos: Food images — Collected: Yes (ephemeral) — Shared: No — Purpose: AI processing — Optional: No — Retention: Immediately after processing
  • App activity/Usage data: Events — Collected: Only on opt-in — Shared: No — Purpose: Analytics/A-B — Optional: Yes — Retention: As per project settings
  • Diagnostics: Crash logs — Collected: Yes — Shared: No — Purpose: Stability/Error analysis — Optional: No — Retention: ~90 days (provider)
  • Purchases: Subscription status (without payment data) — Collected: Yes — Shared: No — Purpose: Entitlement/Billing — Optional: No — Retention: Until account deletion
  • Security practices: Data is encrypted in transit
  • Users can request deletion of their account/data
  • App is not primarily aimed at children (EEA minimum age of 16 is regulated)
  • Essential data collection: Account/Push/Crash data required; Analytics/A-B is optional