1. Controller
Janik Pazos Kempka · Bei der Hopfenkarre 24, 22047 Hamburg
kontakt@tischklar.com
2. Hosting and technical data
This website is provided via OpenAI Sites / Cloudflare. Operating the website may involve IP addresses, request times, browser information and technical logs. Processing provides and secures this website under Art. 6(1)(f) GDPR. Hosting providers may process data outside the EU. See the privacy information of OpenAI and Cloudflare for their processing details.
3. Enquiries and quick checks
We store name, business email, business, selected package, message and selected options. A callback request also includes a phone number and preferred time window; a quick check may include a supplied profile URL. This supports handling enquiries and pre-contractual steps. Art. 6(1)(b) GDPR may apply to the contracting individual; for business representatives, Art. 6(1)(f) GDPR must be assessed against the actual process. No newsletter consent is requested.
No automatic email is currently sent. Saved enquiries can only be read in the protected owner area. The form does not upload files or automatically fetch supplied URLs.
4. Sign-in
The owner area uses ChatGPT sign-in with a site-specific identifier and email. Restaurant access uses email and a personal password. Only salted password verifiers are stored (PBKDF2-SHA256 with 600,000 iterations). Starter codes expire after 72 hours and are consumed at first sign-in. Necessary HttpOnly cookies support sessions lasting up to 12 hours, or 20 minutes for password setup. Suspension or password reset invalidates sessions. Short-lived hashed rate-limit keys restrict login attempts. Expired sessions and old limit entries are cleaned up at successful sign-in.
5. Retention and deletion
Enquiry data is stored for handling and follow-up. Its continued necessity is reviewed after closure, normally within 90 days. Statutory obligations and legal claims may require longer retention. Deletion is performed by the operator, not automatically.
6. Device access, language and external services
We use no advertising trackers, analytics pixels or externally loaded fonts. Website copy and sample translations are supplied directly by this application; changing language makes no external translation request. The gallery loads our own image files. External links are visited only when clicked. Language selection uses no cookies or persistent browser storage. Necessary platform sessions follow the platform’s information. The fictional reservation demo handles entries temporarily in the open view, without storage or transmission. Additional technology requires assessment under GDPR and § 25 TDDDG.
7. Your rights
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent for the future. You may complain to a competent data protection authority. Contact the controller named above.
Menu studio and restaurant access
Authorised operators upload menu photos to private file storage. Menu data, selected languages, approvals and changes are stored in a protected database. Saved menu changes record their date, time, editor and previous and new field values, with private JSON audit files. Operators can export the history as CSV or JSON. Passwords and session tokens are excluded. Deleting a menu job also deletes its audit records and files; there is no automatic retention cleanup. Booked restaurant access uses an email and a personal password; each business sees only assigned menus. Operators can delete uploaded photos. There is no automatic retention cleanup. Processing through the connected ChatGPT app also follows the account and privacy settings of the ChatGPT product used. The optional OpenAI API is used only after data and cost confirmation; photos and text are transferred to OpenAI and background responses are stored for retrieval. Services and required data-processing agreements are agreed separately for commissioned projects.