Read the Cookie PolicyPRIVACY NOTICE — ICHEF
https://ichef.it · Updated: 29 September 2026
1. CONTROLLER AND CONTACT
VISIBILITY S.L.U., NIF B76194323, Calle Domingo J. Navarro n.1, 2a planta - Oficina 5, 35002 Las Palmas de Gran Canaria, Spain, operates iChef. Information and rights: hello@visibility.company. This notice concerns visitors and dashboard users. Notices published for client websites identify their respective controllers separately.
2. BROWSING, ACCESS AND SECURITY
Infrastructure receives IP, requested URL, date, time and browser information to deliver and protect the service. The basis is our legitimate interest in availability and security (GDPR Article 6(1)(f)), with use limited to these purposes. Essential technical data are necessary to connect.
For accounts we process name, email, role, authorised sites, status, creation date and last login. An administrator may provide these when inviting a colleague; the colleague sets their own password. Passwords are checked against salted hashes, never stored in clear text. Sessions and activation links are stored as token hashes. This provides access and enforces permissions under contract performance (Article 6(1)(b)) when the user is a party, or legitimate interest in administering the company service (Article 6(1)(f)) for authorised colleagues. Access data are required for restricted functions.
Authorised administrators can see account details, permissions, status and last login. Relevant administrative actions record actor, action, target and date for security and traceability under legitimate interest. Temporary anti-abuse counters use identifiers derived from IP or email through hashing; this does not make them anonymous.
Initial owner account recovery may use the owner’s ChatGPT identity. Ordinary login uses iChef email and password and does not require providing ChatGPT credentials to iChef.
3. CLIENT DATA AND WEBSITE RECORDS
The dashboard stores domains, controllers’ details, contacts, declared services, questionnaire answers, scan reports and notice versions. Published text is accessible to visitors: include only information intended to be public. Internal answers and accounts remain subject to dashboard permissions.
For personal data processed on clients’ behalf, the client sets purposes and instructions and remains controller of their website processing; VISIBILITY provides the technical service within those instructions. Third-party use requires applicable roles and agreements, including a GDPR Article 28 agreement where relevant. This notice does not replace that agreement or assign clients’ independent purposes to VISIBILITY.
Receipts sent by connected sites contain random event and browser identifiers, site, choice, configuration version and date. Application receipts do not add visitor name, email or IP. Infrastructure still receives connection data. For requests about a client site, first contact the controller in its notice; VISIBILITY provides technical assistance according to the respective roles.
Operator-requested quick scans read public resources on specified domains. Do not include credentials, tokens or personal data in scanned paths. Deep-scan reports, when the service is connected, are intended to include requests and cookie/storage names without values. Availability appears in the dashboard; scanning is not a compliance certification.
4. CONTACT
Emails to hello@visibility.company are processed to respond, manage the service or handle privacy requests. Bases are requested pre-contractual steps or contract performance where applicable, legitimate interest in professional contacts, and legal obligations for rights requests. Do not send passwords or unnecessary data. Contact does not create an automatic newsletter subscription.
5. COOKIES AND LOCAL STORAGE
The current iChef configuration uses technical authentication and interface-preference tools. It has no Analytics, advertising pixels, remote fonts or profiling services. Interface images and fonts require no connection to external font providers. Names, purposes and durations appear in the Cookie Policy.
The Cookies & privacy panel provides information. With technical tools only, it does not collect fictitious consent, record an acceptance receipt or block access. Adding optional services will require updated configuration and consent where required.
6. RETENTION
Login sessions last up to eight hours and end earlier on logout or account invalidation. Expired session records cannot grant access and are removed during later session creation. Activation and recovery links are valid for 24 hours unless used or revoked; expiry and physical deletion need not coincide. Anti-abuse counters have 15-minute windows and are cleaned during later operations applying the control.
Accounts and configurations remain during the service relationship and for subsequent documented needs involving requests, applicable duties, security or protection of rights. Disabling an account blocks access but does not automatically erase its details. Notice versions, audit records and receipts document configurations, actions and choices and support disputes, taking client instructions and relevant obligations into account. The current version does not apply one automatic deletion deadline to these archives: contact us for erasure or restriction. The controller assesses what must be retained or erased by purpose; retention does not permit indefinite use for other purposes.
Contact messages remain for the request and resulting relationship, plus periods needed for obligations or protection of rights. Device storage durations are stated separately in the Cookie Policy.
7. RECIPIENTS AND TRANSFERS
Authorised VISIBILITY staff, administrators of the relevant workspace and necessary delivery, security and support providers access data according to their roles. iChef runs on OpenAI Sites with Cloudflare infrastructure. Scanning can involve Cloudflare DNS requests and requests to sites the operator asks to analyse. The current application does not send dashboard data to behavioural advertising services.
Infrastructure may process data outside the EEA, including the United States. OpenAI contractual documentation provides for adequacy decisions or standard contractual clauses for relevant transfers. Provider and safeguard details: https://openai.com/policies/chatgpt-sites-data-processing-addendum/ and https://openai.com/policies/sub-processor-list/. Request information and copies of relevant safeguards from hello@visibility.company. Developing and hosting with Sites does not imply an AI model analyses passwords, receipts or questionnaire answers: current notice generation uses text templates filled from entered data.
8. RIGHTS AND COMPLAINTS
Subject to the GDPR, request access, rectification, erasure, restriction and portability where applicable. Object to legitimate-interest processing on grounds relating to your situation. Where processing relies on consent, withdraw it without affecting earlier lawful processing. Contact hello@visibility.company; proportionate information may be requested to verify and handle the request.
Complain to the AEPD (https://www.aepd.es) or the competent authority for your residence, work or alleged infringement. iChef makes no solely automated decisions with legal or similarly significant effects. The dashboard is for authorised operators and colleagues, not collecting student or child data.
9. UPDATES
The opening date identifies this version. Changes in services, purposes or recipients require updated information. Client-site notices have their own versions associated with their configurations.