Privacy Policy
This Privacy Policy explains how Goldmonkey Studio LLC collects, uses, stores, and protects personal and operational data processed through ChefIApp™ OS.
Goldmonkey Studio LLC is committed to protecting the privacy of its users in compliance with the General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD).
1. Data Collected
We collect the following types of data: account data (name, email, phone), restaurant data (name, address, tax ID), operational data (orders, menu, shifts, reservations), reservation acquisition context (campaign or referral source, partner, offer and first landing page), usage data (access logs, features used), and technical data (device type, browser version, IP address).
2. Purpose of Processing
Data is processed for: service delivery and maintenance, billing and subscription management, customer support, product improvement and security, compliance with legal and tax obligations, and service-related communications.
3. Legal Basis
Data processing is based on: performance of the subscription contract, user consent (where applicable), legitimate interest for service improvement and security, and compliance with legal obligations.
4. Storage and Security
Data is stored on secure servers via Supabase (AWS infrastructure). We use encryption in transit (TLS 1.3) and at rest. Data access is controlled by Row Level Security (RLS) policies at the database level. We do not sell, share, or monetize customer data.
5. Data Subject Rights (GDPR/LGPD)
You have the right to: access your personal data, rectify inaccurate data, request data deletion, restrict processing, port your data to another service, and object to processing. These rights can be exercised through the account area in the application or by contacting contact@goldmonkey.studio.
6. Data Retention
Data is retained while the account is active. Identifiable reservation-attribution events are kept for no more than 90 days; they are then deleted, leaving only irreversibly aggregated monthly metrics with small-cell suppression. Reservations, invoices and complaints follow their own legal retention rules. After account deletion, remaining data is removed within 30 days, except where retention is required by law (e.g., tax records).
7. International Transfers
Data may be transferred to servers located outside the European Economic Area (EEA), specifically to the USA (AWS infrastructure). Such transfers are made under Standard Contractual Clauses approved by the European Commission.
8. Contact
For privacy questions, exercise of rights, or complaints, contact Goldmonkey Studio LLC at contact@goldmonkey.studio. You also have the right to lodge a complaint with the competent data protection authority in your jurisdiction.
9. Artificial Intelligence and Sub-processors
Some ChefIApp™ OS features use artificial intelligence (for example: automatic menu translation, catalog content generation, and menu photo reading). In those cases, the submitted content is processed by the Google Gemini API as a sub-processor. We also use the following sub-processors: Supabase/AWS (database, authentication, and storage), Vercel (hosting), Stripe and SumUp (payments), Google (AI and maps), Sentry (error monitoring), Meta/WhatsApp (messaging), and Resend (transactional email). We do not use customer data to train our own or third-party AI models.