Privacy Policy

01 Who we are

Cook AI is an iOS application and a website published by Skaly Consulting FZ-LLC (“we”), a Free Zone Limited Liability Company registered in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates. Cook AI turns the ingredients you already have into personalized, AI-generated recipes.

This policy explains what personal data we collect, why, who we share it with, how long we keep it and what rights you have over it. It covers both the Cook AI iOS application and the getcookai.com website.

Data controller:
Skaly Consulting FZ-LLC
FOB51075, Compass Building, Al Shohada Road
Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
Email: team@skalyconsulting.com

02 Data we collect

Account information

When you create your account we collect your email address and an authentication credential. If you register with a password, it is stored only in hashed form by our authentication provider — we never see it in clear text. If you use a third-party identity provider, we receive an identifier and the associated email address, plus a display name and profile picture where the provider supplies them.

Each account is given an internal identifier: that is what links your content to you across our systems.

Profile & preferences

We store what you configure in the app: display name, dietary preference, selected culinary cultures, goals, onboarding answers and language. We also store what you create — saved recipes, favorites and grocery lists.

Subscription status

We receive the information indicating whether your Cook AI Premium subscription is active, in trial, expired or cancelled, and which plan it corresponds to. It comes from Apple and from Adapty, the provider we use to manage entitlements. We never receive your card number, bank details or Apple ID credentials.

Usage data

We record events relating to use of the service — a scan performed, an AI request and the volume consumed, onboarding steps completed, a subscription screen displayed. Some of these records are tied to your identifier and therefore constitute personal data rather than anonymous statistics. They serve to operate technical usage limits, understand product usage and improve the app.

Support correspondence

If you write to us we keep the correspondence — your email address and the content of your messages — to handle your request and improve the quality of our support.

03 Ingredient photos & AI processing

Ingredient scanning is Cook AI's core feature. Here is precisely what happens to a photo:

• You take a photo, or select an existing image from your photo library. Cook AI accesses only the images you explicitly provide — we neither browse nor index your library.
• The image is transmitted to OpenAI and analysed by a vision model in order to identify the ingredients it contains.
• OpenAI returns a list of detected ingredients, which is then used to generate a recipe.
• Cook AI does not keep the photo. It is transmitted for processing and is written neither to our database nor to our file storage. We build no image library of your kitchen or fridge. What we keep is the result — the detected ingredients and the generated recipe — together with a technical consumption record (timestamp, model used, volume).
• Photos are never used to identify you, never made public and never used for advertising.

04 Website & use without an account

This section concerns the getcookai.com website only, not the iOS application. In the app, AI features are reserved for the Premium subscription — see our Subscription Terms.

On the website, part of Cook AI can be tried without creating an account. To keep that free access usable and prevent misuse, we apply technical limits — which require processing some data:

• Hashed IP address. We derive an irreversible fingerprint from your IP address in order to count anonymous requests and apply limits. We store that hash, not the readable IP address.
• Anonymous session identifier and device signal. A random session identifier and a technical device signal allow us to recognise a returning anonymous visitor and apply the site's trial limits. They are used neither for advertising nor for cross-site tracking.
• Referral parameters. If you arrive through an affiliate or referral link, we record the click and its source in order to attribute the referral. This may be linked to your account if you subsequently register.

If you later create an account, content generated during your anonymous session may be attached to it so that you do not lose it.

05 Notifications & emails

We may send you transactional emails — a welcome message, or information relating to your account. They go through our email provider, which processes your address on our behalf. We keep a log of messages sent so we can diagnose delivery problems.

If you enable notifications, we store the technical details needed to deliver them, your notification preferences and a record of what has been sent. You can revoke this at any time from your device or your settings, which stops future sends.

06 How we use your data

• Provide the service: authenticate you, recognise ingredients, generate recipes, keep your preferences, recipes and grocery lists.
• Manage subscriptions: confirm Premium access, apply trial periods, handle purchase restores.
• Enforce fair use: apply usage and rate limits, and prevent abuse of the AI features.
• Improve the product: analyse usage to fix defects, evolve features and monitor the cost and quality of AI processing.
• Support you: reply when you contact us.
• Meet our legal obligations: keep the records applicable law requires us to keep.

07 Legal basis for processing (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following bases:

• Performance of a contract (Art. 6(1)(b)): processing your account, photos, preferences and content in order to provide the service you asked for.
• Legitimate interests (Art. 6(1)(f)): usage analysis, abuse prevention, rate limiting and security monitoring, where these do not override your rights.
• Legal obligation (Art. 6(1)(c)): where retention is imposed by applicable law.
• Consent (Art. 6(1)(a)): for optional features such as notifications, which you may withdraw at any time.

08 Sub-processors

We rely on the providers below. Each processes data only to the extent needed for its function.

These providers operate infrastructure in several countries. If you need to know the current hosting region for a specific category of data, write to us at team@skalyconsulting.com and we will tell you.

09 Cookies & local storage

Website. We use neither advertising cookies nor cross-site trackers. The site keeps in your browser's local storage the minimum needed to work: an anonymous session identifier, the state of your free trial usage and any recipes generated before signing up, your personalisation choices, and whether you have dismissed the install prompt. Signing in additionally stores an authentication token that keeps you signed in.

Application. The iOS app stores data locally on your device — your authentication session and cached preferences — to keep you signed in and running smoothly. This stays on the device, except where it must be sent to our servers to sync your account.

You can clear all of it at any time by signing out, clearing your browser data or deleting the app.

10 Retention periods

• Account, profile and content (recipes, favorites, grocery lists): kept for as long as your account exists, deleted when you delete it.
• Ingredient photos: not retained — transmitted for processing only, as described in Section 3.
• Usage and technical records (AI consumption, usage limits, onboarding and subscription-screen events, notification and email logs): kept for as long as they remain useful to operating the service, then deleted or detached from any link to you.
• Support emails: kept for as long as needed to handle your request and to record what was agreed.
• Records required by law (for example accounting records relating to a subscription): kept for the period applicable law requires, including after account deletion.

Irreversibly anonymised data — which can no longer be linked to you — is not subject to deletion, since it is no longer personal data.

11 Deleting your account

You can delete your Cook AI account and the personal data attached to it at any time. You can do it yourself from within the app, in your profile / account settings. You can also ask us directly by writing to team@skalyconsulting.com from the address associated with your account.

What deletion removes. Deleting your account removes your profile and the content linked to it — saved recipes, favorites, grocery lists, preferences, usage counters, notification settings, and your authentication record. Once the account is deleted you can no longer sign in and the content is not recoverable.

What may remain. A limited number of technical and statistical records may be kept after deletion, detached from your account, so that they can no longer identify you. We also keep records that applicable law requires us to retain, as set out in Section 10.

12 Data security

We implement appropriate technical and organisational measures. Traffic between your device and our services is encrypted in transit, data stored with our infrastructure providers is encrypted at rest by them, access to production systems is restricted to those who need it, and database-level access rules keep each user's content separate from others'.

No system is perfectly secure and we do not claim otherwise. If you discover a vulnerability, report it responsibly to team@skalyconsulting.com and give us a reasonable opportunity to fix it before public disclosure.

13 Children's privacy

Cook AI is intended for a general audience and is not directed at young children. We do not knowingly collect personal data from children below the age of valid consent in their country — 13 in many jurisdictions, and up to 16 in some EU member states under Article 8 GDPR.

If you are a parent or guardian and believe a child has provided us with data, write to team@skalyconsulting.com and we will delete it promptly. Note also that recipes are generated automatically and are not supervised by a nutrition professional — see our Terms of Use.

14 Your rights (GDPR)

If you reside in the EEA, the United Kingdom or Switzerland, you have the following rights:

• Access (Art. 15): obtain a copy of the data we hold about you.
• Rectification (Art. 16): have inaccurate or incomplete data corrected.
• Erasure (Art. 17): have your personal data deleted — see Section 11.
• Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Objection (Art. 21): object to processing based on our legitimate interests.
• Restriction (Art. 18): ask us to limit how we use your data in certain circumstances.
• Withdrawal of consent: withdraw consent at any time where processing relies on it, without calling into question what has already been done.

15 International transfers

Skaly Consulting FZ-LLC is established in the United Arab Emirates, and several of our sub-processors operate infrastructure outside your country of residence — notably in the United States. Using Cook AI therefore involves an international transfer of your data.

Where we transfer personal data out of the EEA, we rely on the safeguards provided by the GDPR — in particular the Standard Contractual Clauses approved by the European Commission, or the transfer frameworks our providers adhere to. You may write to us at team@skalyconsulting.com for information on the safeguards applicable to a given transfer.

16 Contact & updates

For any question about this policy, to exercise your rights, or to report a privacy concern:

Skaly Consulting FZ-LLC
FOB51075, Compass Building, Al Shohada Road
Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
Email: team@skalyconsulting.com

This policy may be updated. Material changes will be announced in the app or by email. The “last updated” date at the top always reflects the most recent revision.