Privacy policy
Effective Date: May 25, 2026
Last Updated: May 25, 2026
Take a K2K, S.L. ("Take a Chef", "TAC", "we", "our", or "us") operates the Take a Chef Marketplace and the Private Chef Manager (PCM), a SaaS platform that helps chefs manage their business. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our services.
This Privacy Policy also applies when you access Take a Chef through ChatGPT, OpenAI Apps, or another OpenAI Apps SDK surface. In that context, ChatGPT may send Take a Chef the request details that you choose to provide, and Take a Chef may return app responses to ChatGPT so that ChatGPT can answer you and render Take a Chef widgets. OpenAI operates ChatGPT separately under its own terms and privacy notices.
By using our Platform, including the Take a Chef marketplace and PCM tools, you agree to the practices described in this Privacy Policy.
1. Who We Are and What This Policy Covers
This Privacy Policy applies to data processed by Take a K2K, S.L., a Spanish company, in connection with:
- Take a Chef Marketplace – connecting clients with personal chefs for private dining experiences.
- Private Chef Manager (PCM) – a chef-facing service to manage bookings across multiple channels, including third-party integrations.
- Take a Chef through ChatGPT and OpenAI Apps – allowing users to search chefs, review menus and offers, validate event locations, create booking leads after explicit confirmation, and check lead or booking status through an OpenAI Apps SDK interface.
We act as a data controller under the GDPR and a business under the CCPA.
2. What Personal Data We Collect
We collect data in three main ways:
2.1. Data You Provide
- Account Details: Name, email, phone number (including mobile for SMS/WhatsApp notifications), password, and location.
- Chef Profiles: Bio, images, menus, pricing, availability, experience, and payment info.
- Bookings: Event date, location, dietary preferences, guest count, and special requests.
- Messages & Support: Communications via our Platform and customer service interactions.
- Payment Information: Chef payout details and client payment data (processed via third parties).
2.2. Data Collected Automatically
- Device & Log Data: IP address, browser, device identifiers, OS, and access logs.
- Usage Data: Page views, time on page, search queries, clicks, etc.
Note: For cookies and tracking technologies, refer to our third-party cookie manager's policy (e.g., Cookiebot).
2.3. Data from Third Parties
- Platform Integrations: When you connect with services like Airbnb or Booking.com, we may receive availability, pricing, and reviews.
- Marketing Partners: Analytics from ad networks or social media.
- Identity Verification: To prevent fraud, we may collect data from trusted third-party services.
2.4. Data Processed Through ChatGPT and OpenAI Apps
When you use Take a Chef through ChatGPT or another OpenAI Apps SDK surface, we may process the following categories of data:
- Search and event details: city, country, area, timezone, event date and time, number of guests, cuisine preferences, dietary restrictions, allergies, budget, minimum rating, sorting preference, preferred language, and similar filters you choose to provide.
- Location details: address text, city, country, postal code, region, latitude, longitude, geocoding candidates, and location validation results when needed to search or create a booking lead.
- Booking lead details: selected chef, menu, offer, price, event notes, customer name, email address, optional phone number, confirmation text, lead ID, booking status, reference ID, and booking summary.
- Technical and security data: IP address, request origin, referrer, user agent, timestamps, OAuth or account subject identifiers where authentication is enabled, rate-limiting events, error details, and non-PII correlation references.
- App responses returned to ChatGPT: chef names, menu names, cuisine types, prices, ratings, reviews, public reviewer display names or comments when already available through Take a Chef, images, service areas, search summaries, selected offer details, lead or booking status, and next steps.
We do not intentionally collect or reconstruct your full ChatGPT conversation. The app operates on the request details, snippets, and resources that ChatGPT or you send to Take a Chef for the current task.
3. How We Use Your Data
We use personal data for the following purposes and legal bases:
Purpose | Legal Basis |
Providing services via TAC and PCM | Contract (GDPR Art. 6(1)(b)) |
Managing chef-client bookings | Contract (GDPR Art. 6(1)(b)) |
Operating Take a Chef through ChatGPT and OpenAI Apps: responding to search requests, validating locations, showing relevant chefs or menus, preparing offers, creating booking leads after explicit user confirmation, and returning app responses to ChatGPT. | Contract or steps prior to contract; legitimate interest in operating and securing the service; consent where required for optional sensitive data. |
Security and minimization for OpenAI Apps: preventing abuse, debugging app errors, enforcing rate limits, masking personal data in app responses, and avoiding unnecessary diagnostic identifiers. | Legitimate interest; legal obligation where applicable. |
Creating & promoting chef profiles | Legitimate interest (Art. 6(1)(f)) |
Sharing profiles with partners | Consent or legitimate interest |
Processing payments | Contract / Legal obligation |
Improving services and support | Legitimate interest |
Marketing and promotions | Consent |
Fraud prevention, bot detection (via Cloudflare Turnstile) and compliance | Legal obligation / Legitimate interest (Art. 6(1)(f)) |
Creating and maintaining personalized chef websites | Consent (GDPR Art. 6(1)(a)) |
Transactional and marketing notifications via SMS/WhatsApp | Contract (GDPR Art. 6(1)(b)) |
3.1 Profile Visibility for Partnerships
With your consent, we may share chef profiles on major platforms (Airbnb, Booking.com, etc.). For smaller partners, profiles may appear by default, with opt-out available.
You can manage profile-sharing preferences in Account Settings or by contacting us (see Section 9).
3.2 Bot Detection
We use Cloudflare Turnstile on this website to protect you against bots and SPAM. This service is provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile analyzes visitor behavior based on various characteristics (such as IP address, time of visit, and mouse movements) to verify that the interaction is human. The analysis starts automatically upon accessing the page. The collected data is transmitted to Cloudflare. For more information, please refer to the Cloudflare Turnstile Privacy Policy.
3.3 Dietary Restrictions, Allergies, and Sensitive Data in OpenAI Apps
Some optional event notes, dietary restrictions, or allergy information may reveal sensitive or special-category data under applicable law. We only ask for this information when it is relevant to preparing a safe and suitable private chef experience, and you decide whether to provide it. We do not use this information for advertising or unrelated profiling.
Do not provide payment card data, protected health information, government identifiers, access credentials, API keys, passwords, or MFA/OTP codes through ChatGPT or the Take a Chef app. Payment and final booking flows, when applicable, are handled outside ChatGPT through Take a Chef's own approved payment and booking processes.
4. How We Share Your Data
We do not sell personal data. We may share your data as follows:
Recipient | Purpose |
Partner Platforms | Display chef profiles, sync bookings (with consent) |
Clients (for chefs) | Share booking details |
Payment Providers | Secure payment processing |
Service Providers | Hosting, analytics, support tools and bot protection |
OpenAI / ChatGPT | To send app requests to Take a Chef and receive app responses from Take a Chef so the ChatGPT app can work. OpenAI processes ChatGPT and workspace data under its own terms and privacy notices. |
Geocoding and location providers | To validate event locations, coordinates, and service areas when needed for search or booking lead creation. |
Chefs, concierge partners, or marketplace partners | To prepare, respond to, or fulfill a booking lead when you ask Take a Chef to create one. |
Legal Authorities | Where required by law (e.g., fraud, tax) |
Website Hosting Providers | To create and maintain personalized chef websites on external domains |
SMS/WhatsApp Providers | For sending transactional notifications (booking confirmations, updates, etc.) |
5. Data Retention
Type of Data | Retention Period |
Active Accounts | As long as the account is active |
Chef Profiles (after deactivation) | Up to 12 months (for SEO, credibility) |
Marketing Content | Retained indefinitely, unless removal is requested |
Transaction Data | Retained for 6 years (legal/tax) |
Inactive Accounts | Deleted or anonymized after 2 years |
Search-only ChatGPT app interactions and widget state | Cached by the MCP app for up to 30 minutes to re-open or continue a prior result, then retained only as long as needed to troubleshoot issues, prevent abuse, and generate aggregated analytics before deletion or anonymization according to operational retention controls. |
Booking leads created through ChatGPT or OpenAI Apps | Retained while the request, booking, support, dispute, or account relationship remains active. |
Security logs and diagnostic records for the ChatGPT app | Retained for security, compliance, and incident-response purposes, then deleted or anonymized when no longer needed. |
You may request deletion via Account Settings or by contacting us (Section 9).
6. Your Rights (GDPR & CCPA)
Depending on your jurisdiction, your rights may include:
Right | GDPR | CCPA |
Access personal data | ✅ | ✅ |
Correct data | ✅ | ✅ |
Delete data | ✅ | ✅ (some limits) |
Opt-out of marketing | ✅ | ✅ |
Object to processing | ✅ | ❌ |
Data portability | ✅ | ❌ |
Opt-out of data sale | ❌ (not applicable) | ✅ |
For Take a Chef app interactions in ChatGPT, you control what information you provide. You can stop before creating a booking lead, decline to provide optional phone numbers or sensitive event notes, continue the booking flow through Take a Chef's own website, or disconnect the app through your ChatGPT or workspace settings. Access to account-specific booking information may require authentication or other verification that you are authorized to view that information. Disconnecting the app prevents future app requests from that ChatGPT connection but does not automatically delete booking or legal records that Take a Chef must retain.
To exercise your rights, email [email protected].
7. Data Security
We implement industry-standard measures, including:
- SSL/TLS encryption
- Access controls
- Routine security audits
- Origin, CORS, rate-limiting, and OAuth controls for MCP and OpenAI Apps SDK endpoints.
- Data minimization in tool inputs and app responses.
- PII masking in MCP structured payloads and logs where possible.
- Avoidance of diagnostic metadata in app responses unless it is strictly required to fulfill the user's request.
8. International Data Transfers
If you're outside the EU, your data may be transferred to Spain or the U.S. We use Standard Contractual Clauses (SCCs) for GDPR compliance.
9. Contact Us
For any privacy-related questions or requests:
- Email: [email protected]
- Mail: Take a K2K, S.L., Calle Valcarlos 36, 3º B, 28050 Madrid, Spain