Privacy, in plain terms
Privacy Policy
This policy explains what Served collects, how we use it, what we share, and the choices you have. We are built around data minimization: we try to keep only what we need to plan your meals, track your kitchen, and shop for you.
What we collect
Only what the Services need: the messages, photos, and recipes you send, the accounts you connect, and how you use Served.
What we never do
We never sell your personal identifiers, message content, photos, or Gmail data, and we never use your Gmail data for advertising.
What you control
Access, correct, export, or delete your data, and set dietary guardrails that sponsored content can never override.
Your kitchen should work for you. So should your data.
Introduction.
Served is an iMessage-native kitchen assistant operated by Chef.AI Incorporated ("Served," "we," "us," or "our"). Served helps you plan meals, keep track of what is in your kitchen, save recipes you find, and shop for groceries through connected retailers (collectively, the "Services").
This Privacy Policy describes how we collect, use, share, and protect information when you use the Services, and the rights and choices available to you. By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.
Information we collect.
We collect the following categories of information, guided by the principle of collecting only what the Services need to function.
Information you provide
- Account and contact details, such as your name, phone number, and the messaging identity you use to reach Served.
- Messages and conversation content you send to Served, including requests, questions, preferences, dietary restrictions, allergens, and blocklists.
- Photos and videos you send, such as photos of your refrigerator, pantry, or receipts, and recipe links or screenshots you share from social platforms.
- Household details you choose to share, such as who you are cooking for and household size.
- Payment information when you make a purchase, which is processed by our payment processor and not stored by us in full.
Information from connected accounts
When you choose to connect a third-party account (for example, Gmail or a grocery retailer), we receive information from that account only as needed to provide the feature you authorized. See Section 06 for Gmail-specific details.
Information collected automatically
- Usage information, such as features used, actions taken, and timestamps.
- Device and technical information, such as device type, operating system, and general diagnostic data.
- Approximate location derived from your device or network, used to find nearby stores and availability.
How we use information.
We use the information we collect to:
- Provide, operate, and improve the Services, including meal planning, pantry tracking, recipe extraction, and grocery shopping.
- Understand what is in your kitchen and build recommendations and grocery lists around it.
- Respect your dietary restrictions, allergens, and blocklists when generating recommendations.
- Carry out shopping on your behalf at the retailers you connect, with your review and approval.
- Communicate with you about the Services, including responses, confirmations, and support.
- Maintain the safety, security, and integrity of the Services and prevent abuse.
- Comply with legal obligations and enforce our terms.
AI processing and subprocessors.
The Services use artificial intelligence to understand your requests, read recipes, identify items in photos, and generate recommendations. To do this, we rely on trusted third-party AI providers, currently OpenAI and Anthropic, that process inputs on our behalf as subprocessors.
These providers process your inputs under their enterprise and API terms. Under those terms, your content is not used to train their models. We send these providers only what is needed to perform a given task, consistent with our data-minimization approach.
Data minimization
Wherever practical, we extract only the structured information we need, such as item names and quantities, and avoid retaining raw photos and videos longer than necessary to deliver the Services. The less we keep, the less is ever at risk.
How agentic shopping works.
When you ask Served to shop for you, you authorize Served to act as your agent to build a cart and place orders at the retailers you connect. You remain the principal: items are added on your behalf, and you can review and approve before checkout where that option is offered.
Served operates within the terms of service of the retailers you connect. You are responsible for the purchases made through your connected accounts. We use your connected retailer credentials only to perform the shopping actions you request and protect them with appropriate safeguards.
Gmail and Google user data.
If you connect a Google account, Served's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- We use Google user data only to provide and improve the features you authorized.
- We do not sell Google user data.
- We do not use Google user data for advertising.
- We do not allow humans to read your Google user data unless you give consent, it is necessary for security or to comply with law, or the data is aggregated and de-identified.
Cookies and tracking.
On our website, we use cookies and similar technologies to keep the site working, remember your preferences, and understand how the site is used. You can control cookies through your browser settings. Some features may not function properly if certain cookies are disabled.
Sponsored content & retail intelligence.
Served operates a trade desk that allows CPG brands and retailers to sponsor product placement within recommendations. Served also generates aggregated, de-identified insights from how the Services are used and licenses those insights to business partners.
What sponsors and business partners receive
Sponsors and business partners receive aggregated and de-identified data, such as how many users viewed, clicked, or purchased a product, pantry composition trends, shopping patterns, category demand signals, and substitution behavior. They do not receive your name, phone number, message content, photos, voice notes, or any other personally identifiable information.
De-identified data is processed so that it does not identify you and cannot, in our reasonable assessment, be linked back to you. Recipients are contractually prohibited from attempting to re-identify the data or combining it with other data to identify you. See Section 10 for a fuller description.
What sponsors and business partners do not influence
- Your dietary restrictions, allergens, and blocklists.
- Whether items unsafe for you appear in your recommendations.
- Your message content or AI conversation outputs outside of the sponsored placement itself.
Sponsored Content is clearly identified within the Services in line with FTC disclosure rules. By using the Services, you acknowledge and agree that Served may include your usage in this aggregated and de-identified data.
How we share information.
We share information only in the following ways:
- Service providers and subprocessors who process information on our behalf to run the Services, such as our AI providers, hosting, and payment processing.
- Connected retailers when you direct us to shop on your behalf.
- Business partners, who receive only aggregated and de-identified data as described in Sections 08 and 10.
- Legal and safety recipients when required to comply with law, enforce our terms, or protect the rights and safety of users and the public.
- Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.
We do not sell your name, phone number, message content, photos, voice notes, or Gmail data.
De-identified and aggregated data.
"De-identified data" is information that has been processed so that it does not identify, and cannot reasonably be linked back to, any individual. "Aggregated data" combines information across many users so that no single person is identifiable.
When we create de-identified or aggregated data, we maintain it as de-identified, do not attempt to re-identify it except to test that our de-identification is effective, and contractually require recipients not to re-identify it. Properly de-identified data falls outside the definition of personal information under laws such as the California Consumer Privacy Act.
Data retention and minimization.
We keep personal information only for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Raw inputs such as fridge videos and receipt photos are retained only as long as needed to extract the structured information we use, after which we delete or de-identify them.
When you delete your account, we delete or de-identify your personal information within a reasonable period, except where we are required to retain it by law.
How we protect information.
We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and the principle of least privilege. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your information and to limit how much of it we hold in the first place.
Your privacy rights.
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate personal information.
- Delete your personal information.
- Receive a copy of your personal information in a portable format.
- Object to or restrict certain processing.
To exercise any of these rights, contact us using the details in Section 20. We will respond as required by applicable law and will not discriminate against you for exercising your rights.
California privacy rights.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you rights regarding your personal information. We collect the categories of personal information described in Section 02, for the business purposes described in Section 03.
You have the right to know, access, correct, and delete your personal information, and to limit the use of sensitive personal information, subject to legal exceptions. You may also have the right to opt out of the "sale" or "sharing" of personal information as those terms are defined under the CCPA/CPRA.
We do not sell your personal information, and we do not use Google user data for advertising. The aggregated and de-identified data described in Sections 08 and 10 is not "personal information" under the CCPA/CPRA, because it cannot reasonably be linked back to you. You may submit a request, or designate an authorized agent to do so, using the contact details in Section 20.
Other US state rights.
Residents of other states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Utah, and Texas, may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. You can exercise these rights using the contact details in Section 20, and you may appeal a decision we make about your request.
International users.
If you are in the European Economic Area or the United Kingdom, we process your personal data on the legal bases of performing our contract with you, your consent where required, our legitimate interests in operating and improving the Services, and compliance with legal obligations. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority.
International data transfers.
We are based in the United States and process information there and in other countries where we or our service providers operate. Where required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses, to protect your information.
Children's privacy.
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.
Changes to this policy.
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised policy.
Contact us.
If you have questions about this Privacy Policy or want to exercise your rights, contact us at:
Chef.AI Incorporated
131 Continental Drive, Suite 305
Newark, DE 19713
privacy@getserved.ai