Privacy policy

Who we are

Meiko Technologies Ltd. (“Luncheezy”, “we”, “us”) operates Luncheezy, an online service that schools, parent councils and caterers in Canada use to run school lunch programs. Our address is 4648 Lakelse Avenue, Terrace, BC V8G 1R2, Canada.

Our privacy officer is responsible for how we protect personal information and for this policy. You can reach them at [email protected], or by mail at the address above.

What this policy covers

This policy covers our website (luncheezy.ca), the Luncheezy app, and the emails and text messages we send. It explains what we collect, why, who can see it, where it’s kept, for how long, and your rights.

Our two roles

• For the schools, parent councils, school boards and caterers that use Luncheezy, we are a service provider. They decide what their lunch program needs, and we keep and use the information put in for that program (children, families’ orders, class lists, allergies, lunch-day records) only on their behalf, under our data processing agreement. Each school has its own privacy officer, whose contact details are shown in the app.
• For our own purposes, we are responsible for the information: your account and how you sign in, security records, our billing of schools’ plans, requests sent through our website, messages to our support team, and the terms you accept.

We follow the privacy laws that apply to us: the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia’s Personal Information Protection Act and, for people in Quebec, Quebec’s Act respecting the protection of personal information in the private sector (Law 25).

What we collect

Parents and guardians

Your name, email address, language and, if you choose to sign in by text message, your mobile number. The schools you belong to, your children and your relationship to them, and the co-parents you invite. Your orders, payments (the amount, card brand and last 4 digits; Stripe keeps the card itself), credits and refunds. Your email and push notification choices, the devices you turned push notifications on for (the browser and system, and dates), and the consents and terms you accepted, with the language you read them in.

Children

First and last name, preferred name, school, grade and class, a student number if the school imports one, and whether the child is still at the school. Allergies, diets, an EpiPen flag and notes, only with a parent’s express consent or when the school enters them with a reason. Their lunches and when each was handed out. A username and PIN if a parent turns on child sign-in (the PIN is stored only in a form that can’t be read back), and any spending limit. Whether the child gets help with the cost of lunches, which only the school’s finance staff see. Notes school staff add about a child’s lunches. We never ask for a child’s date of birth or photo.

School staff and volunteers

Name, email address or mobile number, role, the classes and lunches you help with, and a record of the changes you make.

Schools and caterers

The organization’s name, legal name, address, contact details and privacy officer, the people who work on its account, its plan, invoices and billing contact, and the status of its Stripe account (Stripe collects the identity and bank details itself).

Website visitors

What you type in the demo, contact and sign-up forms (such as your name, email, organization, role, province, number of students, topic and message), the page you sent it from, the campaign tags in the link you followed, and whether you asked for product news. We use your IP address only to stop abuse of the forms, and don’t keep it with your request.

Everyone who signs in

Sign-in records: when and how you signed in, your IP address, and your browser and device type. Messages you send to our support, hello or privacy addresses.

Why we use it

• To run lunch programs: menus, orders, payments, credits, refunds, receipts, labels, class lists and lunch-day lists.
• To check each order against a child’s allergies and diets.
• To send the emails and text messages the service needs: sign-in codes, receipts, reminders and notices. Sign-in codes are the only text messages we send. You choose which menu and reminder emails you get.
• To keep accounts and payments secure, prevent fraud and abuse, and investigate problems.
• To bill schools for their Luncheezy plan, and to meet our legal, tax and accounting obligations.
• To answer your questions and requests. We send product news only to people who ask for it.

We don’t sell personal information, show ads, build profiles for marketing, or use anyone’s information to train AI models. We never use children’s information for marketing. If we ever want to use personal information for a new purpose, we’ll ask for your consent first unless the law allows it without.

Consent and the law

• When you join a school or accept an invitation, you’re told what is collected and why, and you agree to it. A parent consents for their children.
• Allergies and diets are health information. A parent gives express consent, for each school, before adding them.
• Some uses are needed to provide what you asked for, like processing an order or sending a receipt, or are required by law, like keeping tax records or answering a court order.
• For the information a school controls, the school is responsible for having a valid reason to collect it and for telling families; we process it on its behalf.

You can withdraw a consent at any time, as described under “Your rights” below. Some things then stop working: for example, without allergy information, Luncheezy can’t check meals against your child’s allergies.

Allergies and diets

Allergies and diets are health information, so we treat them with extra care. A parent gives express consent, for each school, before adding them, and can withdraw it in the app (Account, Privacy). The information that relied only on that consent is then deleted, and the child’s teachers and other guardians are told it’s gone. School staff can also enter this information, with a reason; it’s then shown as entered by the school.

This information appears only in the app, to the people whose role needs it. It never goes in emails, text messages, logs or links, and it never leaves Canada.

Who can see what

• Parents and guardians see their own family’s information. Co-parents see the children they share.
• School admins and managers see what they need to run the program, including allergy notes.
• Teachers see the children in their own classes, with their allergies and diets, and the names (not the contact details) of their parents.
• Kitchen staff and volunteers see a first name and last initial, the class, allergy codes and severity and the EpiPen flag, for the lunches they serve; volunteers only from the day before to the day after. Never notes or money.
• Caterers see a first name and last initial, or only a label code if the school chooses, with the class and allergy codes and severity, for lunches from 7 days back to 14 days ahead. They never see last names, allergy notes or parents’ contact details, and each time they open children’s names it’s recorded in the school’s audit log.
• Help a family gets with the cost of lunches is visible only to the school’s finance staff.
• Children who sign in see only their own lunches and the food that’s safe for them.
• Luncheezy’s support staff can look up an account to help you. Only a few senior staff can act on it or view Luncheezy as you do, read-only and with a reason, and every such access is recorded.

We share personal information outside Luncheezy only with the service providers below, or when the law requires it, such as a court order. If we ever sell or merge our business, the buyer would have to protect your information as this policy promises, and we would tell you first.

Where your information is kept

Luncheezy runs on servers we operate ourselves, in Canada. Files and backups are kept with Backblaze in Toronto. These service providers process some information outside Canada:

• Stripe, for payments: the payer’s email address, what was bought (never a child’s name) and the card details you type into Stripe’s form; for a dispute, the payer’s name and a child’s first name and last initial only if the school chooses to add them. In the United States and other countries.
• MailerSend, for email: your email address and the content of each email (never allergy information). In the European Union.
• Plivo, for sign-in and confirmation codes by text message: your mobile number, and the code Plivo creates and checks for us. In the United States.
• Your device’s push service (Apple, Google, Mozilla or Microsoft, depending on your browser), only if you turn on push notifications: the address your browser gives us for your device, and each notification, encrypted so the service can’t read it. Notifications never contain allergy information. In the United States and other countries.

Each provider gets only what its job needs, under a contract that requires it to protect that information. Information processed in another country is subject to that country’s laws, and its courts and authorities may be able to reach it. The sub-processors list gives the details, and we update it before we add anyone.

How long we keep it

• Your account: while you use it. If you delete it, it’s removed after a 30-day grace period.
• Children: while they attend the school. Twelve months after a child leaves, their name is replaced by a code and their allergies, sign-in and class details are deleted.
• Allergies and diets: until a parent removes them or withdraws consent, or the child’s information is made anonymous.
• Orders, payments, refunds and credits: 7 years, as tax law requires, with a deleted account’s name removed.
• The audit log: 2 years, or 7 years for entries about money.
• Sign-in codes: deleted a day after they expire (they only work for 10 minutes). Sign-in sessions: deleted 90 days after they end. IP addresses are kept in full for 30 days, then shortened so they no longer point to a device.
• Push notification devices: until you turn notifications off, remove the device or sign out on it, and at most 60 days after a notification last reached it.
• Report files staff export: download links last 24 hours, and the files are deleted after 30 days. Emails waiting to be sent: deleted a day after they go out.
• The lunch-day list on a volunteer’s device: deleted 2 days after the lunch, or when they sign out.
• Website requests: deleted after 24 months if they don’t lead to an account (spam after 30 days). If you asked for product news, we keep the proof of your consent until you withdraw it.
• When a school leaves Luncheezy: its staff can export its information for 90 days; then its personal information is deleted or made anonymous, except the financial records above.
• Records of the consents and terms you accepted: kept as proof, even after your account is deleted. Our register of privacy incidents: 5 years.
• Our server logs (which never contain sign-in codes, PINs, email addresses or allergy information): 30 days. Backups: deleted information leaves them within 35 days.

Your rights

• See and download your information: in the app, Account, Your data gives you a file with your account, your children and their allergies, your orders and credits, and your consents, in a common format you can take elsewhere.
• Correct it: change your details, your children and their allergies in the app, or ask your school or us.
• Delete your account: in the app, Account. You have 30 days to change your mind, and we email you a link to cancel. We can’t delete it while you are a school’s last admin, while you owe a balance, while you have lunches ahead (you can cancel them), or while you have credit from a card payment (use it first, or ask the seller to settle it with you). Your name is then removed from the records we must keep.
• Leave a school: this ends your link to that school and its lunches, with the same checks.
• Withdraw a consent: for allergy information in Account, Privacy; for menu and reminder emails in your notification settings or with the link in each email; for push notifications in your notification settings, where you can also remove a device; for product news by writing to us.
• Ask about an automated decision (see below), and be told how your information is used.

For anything else, or if you prefer, write to our privacy officer at [email protected]. We answer within 30 days, free of charge, and may ask you to confirm who you are. If your request is about information your school controls, we help the school answer it or pass it to the school’s privacy officer.

If you aren’t satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, to the Office of the Information and Privacy Commissioner for British Columbia, or, in Quebec, to the Commission d’accès à l’information.

Automated decisions

A few decisions in Luncheezy are made automatically. Each one says why when it happens, and a person can review it:

• Allergy checks: a meal that contains something a child is severely allergic to (or an allergy whose severity isn’t set yet) is blocked; other conflicts ask a parent to confirm. Children ordering for themselves see only food that’s safe for them. This uses the child’s allergy information and the meal’s allergen list. If it’s wrong, update the child’s information, or ask the school to review the meal.
• Unpaid balances: if a card payment is reversed after a lost dispute, or a cash or cheque payment is overdue, new orders with that seller pause until the balance is settled. Ask the seller (the school or caterer) to review it.
• New schools: a school that signs up on its own has limits (for example, card payments are off) until Luncheezy checks it’s real. Our team reviews each new school; write to [email protected].
• Website forms: requests that look automated are set aside or ignored. If you didn’t hear back, write to [email protected].

You can ask us what information a decision used and the main reasons for it, and ask a person to review it: [email protected].

How we protect it

• Sign-in without passwords: one-time codes and passkeys. Anyone who can change a school’s banking or billing, caterer owners and all Luncheezy staff also use two-step sign-in, with an authenticator app or a passkey.
• Connections are encrypted (HTTPS).
• Each school’s information is kept apart by the database itself, and each role sees only what it needs.
• Authenticator secrets are encrypted, and children’s PINs are stored only in a form that can’t be read back. Repeated wrong codes or PINs are blocked.
• Card details are handled only by Stripe.
• Photos are stripped of location data, and files are served only through links that expire.
• An audit log that can’t be edited records changes to children, allergies, roles and money, and every time our staff view an account.
• Sign-in codes, PINs, tokens, email addresses and allergy information never go in our logs.

No system is perfectly secure. If a confidentiality incident puts you at risk of serious harm, we tell you and the privacy regulators, as the law requires, and we record every incident in our register.

Cookies and your browser

This website sets no cookies and loads nothing from other companies. It remembers two small things in your browser only: that you closed the language suggestion, and, for the length of your visit, the campaign tags in the link you followed, so a demo request can include them.

The app uses only the cookies it needs: to keep you signed in (for up to 90 days on a parent’s device, less for staff), to recognize a device a parent or school set up for children to sign in, and to remember whether the side menu is open. It also keeps your theme, your language and your last workspace in your browser. A device used on lunch day keeps its lunch list for 2 days, and a copy of your session (without your email address or phone number) for 3 days, so it works offline.

On the pages where you pay or set up payments, Stripe’s own forms load from Stripe and use Stripe’s cookies to prevent fraud, under Stripe’s privacy policy.

There are no analytics, advertising or tracking cookies, and our emails have no tracking pixels. If we ever add website analytics, they’ll be cookieless, hosted in Canada, and listed here first.

Children

Children don’t create their own accounts: a parent or the school adds them, and a parent consents for them. A parent decides whether a child can sign in to pick lunches, if the school offers it. Children see only their own lunches and food that’s safe for them, can’t override an allergy check, and never see ads. We never market to children or build profiles of them.

Nothing about children or any other person is published: the app is private and isn’t shown in search engines.

Changes to this policy

The version and date at the top of this page tell you which policy applies. If we change it in a way that matters, we tell account holders by email before the change takes effect and show a notice in the app. Earlier versions are available on request.

Contact

Questions, requests or complaints about your personal information: [email protected], or by mail at 4648 Lakelse Avenue, Terrace, BC V8G 1R2, Canada, to the attention of our privacy officer.