Kevin Baur, BSc
Hochstraß 542
3033 Klausen-Leopoldsdorf
Austria
Email: [email protected]
Controller within the meaning of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and – for users from Switzerland – the revised Swiss Data Protection Act (revFADP).
Pelican is an order-planning app for professional kitchens. We process personal data exclusively to provide the app and the associated website, to fulfil the contract with the business, and to comply with legal obligations. The following sets out which data we process, on what legal basis, and which service providers (processors) are involved.
This website is delivered via Cloudflare Pages (Cloudflare, Inc., USA). When the site is accessed, technically necessary server log data is processed (including IP address, time, requested resource, user agent) to ensure delivery and security. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We use DataFast for audience measurement; marketing cookies from Reddit are only set after your consent (see section 16).
If you use voice input, your audio recording is transmitted to OpenAI (OpenAI, L.L.C., USA) for processing. There, the recording is transcribed (speech recognition) and then analyzed to extract the item, quantity, unit and category and to match it against the product catalog. The recognized entries are added to your order list.
Accounts, authentication and the database are operated via Supabase (Supabase, Inc.). The account, organization and content data referred to in Section 4 is stored here. Access is secured by access rules at database level (Row Level Security), so that each business sees only its own data. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). The hosting region used is aimed at a location in the EU (Frankfurt); for any processing outside the EU, the safeguards in Section 10 apply.
Payment is made exclusively via the external platform Lemon Squeezy (Merchant of Record). The payment and billing data (e.g. name, billing address, payment method) is collected and processed directly by Lemon Squeezy; we receive no complete payment data. To activate the business, we receive via a signed callback (webhook) only the information necessary for assignment (e.g. business identifier, subscription/payment status, access end date). As Merchant of Record, Lemon Squeezy also remits the applicable sales tax. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
When order lists change, the app may send push notifications. For this, a device token is processed via the Expo service. You can disable push notifications at any time in the app or in your device settings (opt-out). The legal basis is our legitimate interest in functioning team collaboration (Art. 6(1)(f) GDPR) or your consent via the system prompt (lit. a).
Where required, data processing agreements (DPAs) pursuant to Art. 28 GDPR are concluded with these providers.
Some of the services mentioned process data in the USA or other third countries. For these transfers we rely on appropriate safeguards pursuant to Art. 44 et seq. GDPR – in particular the EU Commission's Standard Contractual Clauses (SCC) and, insofar as the providers are certified, the EU-US Data Privacy Framework (DPF). Despite these safeguards, a lower level of data protection compared to the EU may exist in third countries.
Processing is carried out to perform the contract (Art. 6(1)(b) GDPR), on the basis of legitimate interests (lit. f), on the basis of your consent (lit. a, in particular for voice processing), and to fulfil legal obligations (lit. c).
We store personal data only for as long as necessary for the stated purposes or due to statutory retention periods. Accounts and associated data can be removed via the account deletion function integrated into the app. After the end of the contract or deletion, the data is deleted or anonymized within a reasonable period. [Specific periods are still to be added, e.g. deletion of business data X days after the end of use; statutory retention of billing data.]
You have the right to information, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent given at any time with effect for the future. A message to [email protected] is sufficient to exercise these rights.
You have the right to lodge a complaint with a supervisory authority:
For data subjects in Switzerland, the revised Data Protection Act (revFADP) additionally applies. GDPR terms are to be applied mutatis mutandis to the revFADP; the corresponding provisions of the revFADP take the place of the GDPR legal bases.
Strictly necessary. In the activation portal, an authentication token is stored locally in the browser (local storage) for login. A cookie remembers your language choice. Both serve solely to operate the website and are not evaluated for advertising purposes. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
Audience measurement with DataFast. We measure anonymously which pages are accessed. No cross-site profiles are created and the data is not shared with advertising networks. The legal basis is our legitimate interest in a website that meets user needs (Art. 6(1)(f) GDPR).
Reddit Pixel and Conversions API – only with your consent. If you agree in the cookie notice, we load the advertising pixel from Reddit, Inc. (USA). It sets a cookie (_rdt_uuid) and reports to Reddit whether a click on one of our ads led to a page view, a sign-up or a purchase. In addition, we transmit the same events server-side via the Conversions API; your email address and IP address are hashed with SHA-256 before transmission, so Reddit does not receive them in plain text. Reddit may combine this data with an existing Reddit account and is, to that extent, a joint controller together with us (Art. 26 GDPR). The legal basis is solely your consent (Art. 6(1)(a) GDPR). Without consent, the pixel is not loaded and no cookie is set.
Withdrawal. You can withdraw your consent at any time with effect for the future: delete this site's website data in your browser settings – the notice will then appear again and you can decide anew. Alternatively, a message to [email protected] is sufficient.
We adapt this Privacy Policy when the legal situation, the services used or features change. The version published on this page applies in each case.
As of: September 2026
Pelican