Privacy

Pafos Chef is run by CEREBROX LTD, Paphos, Cyprus. For anything on this page, write to chef@pafoschef.com.

Only what the site needs to work: your sign-in session, the order you are building, which printed QR code you scanned, and small flags so we do not show the same welcome message twice. None of these identify you to anyone else and none are used to track you. That is why there is no cookie banner: nothing here needs your consent.

We use PostHog, hosted in the EU, to see which pages are visited, where people give up while ordering, and which buttons get used. It runs without cookies: your visit gets a random id that lives only in the page you have open and is gone when you close it. If you sign in, your visit is tied to your account id (a random string, never your name or email) so we can see the ordering flow end to end.

No session replay, no reading what you type. That stays switched off in the code, not in a setting someone could flip.

We also keep our own log of page visits with the same random id, your country and device type (mobile, tablet or desktop), and the campaign link you arrived from if there was one. Not your city, not your IP address.

Your name, email, phone, delivery address, allergies and dietary preferences, the dishes you chose, and your payment record are kept for as long as you have an account, plus the time Cyprus law requires us to keep invoices. Payments are handled by Revolut; we never see your card number.

We tell Meta (Facebook and Instagram) from our own server about four moments: when you open the menu builder, when you create an account, when you start a payment, and when a payment completes with its value. That lets us see whether an ad led to an order and stop paying for ads that do not. This goes through Meta's Conversions API, not a pixel in your browser. It carries a scrambled version of your email, your IP address and browser type, and, if you arrived from a Facebook or Instagram ad, the click id from that link. Meta uses it for ad measurement under its own terms. We also record the same order in PostHog with the order value and your account id.

These happen for every order, from our server, whether or not you did anything in your browser. We do them under our legitimate interest in knowing what works. You can object at any time and we will stop for your account and delete what was sent from our side.

Order confirmations, the Thursday reminder that your week is open, delivery updates and the occasional menu news. Our email provider records whether an email was delivered, opened and which link was tapped, so we know what is worth sending. Every marketing email has a one-tap unsubscribe; service emails about an order you placed do not.

Raw page-visit logs: 90 days, then aggregated into monthly counts and the raw rows deleted. Product-analytics events with PostHog in the EU: 12 months. Account and order data: while you have an account, then invoices for the statutory period.

We do not sell your data, ever, not now and not after an acquisition. No advertising pixels, no third-party trackers in the browser, no keystroke capture, no precise location, no contact-list scraping.

You can ask for a copy of what we hold about you, correct it, delete it, or object to the analytics and the ad measurement above. Email chef@pafoschef.com and we will answer within a week. You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus.