Safety and privacy
Built for children’s safety and privacy.
Luncheezy holds information about children, including allergies, so privacy is part of the design, not an add-on.
How allergy checks work
- Parents add allergies and diets once, after giving consent. Each allergy has a severity; until one is set, it’s treated as severe.
- A meal that contains an allergen a child is severely allergic to is blocked, unless the school allows an override.
- Any other conflict, including “may contain” with a severe allergy or a diet the meal doesn’t meet, needs a parent’s acknowledgement, stored with the order.
- Children ordering for themselves only ever see food that’s safe for them, and can never override.
- Allergies appear on class lists, labels, prep lists and the lunch-day list.
Luncheezy checks orders against each meal’s listed allergens. The school or kitchen is responsible for ingredients and preparation.
Who sees what
Everyone sees only what their job needs.
- Parents, school admins and managers
- The child’s full profile, including dietary notes.
- Teachers
- Their own class: names, allergy codes and severity, and notes. Parents’ names, but not their contact details.
- Kitchen staff and volunteers
- First name and last initial, class, allergy codes and severity, and the EpiPen flag. Never notes. Volunteers see only the lunches they help with, around lunch day.
- Caterers
- First name and last initial (or a label code), class, and allergy codes with severity, for lunches from a week back to two weeks ahead. Never notes, last names or families’ contact details.
- Lunch support
- Only the school’s finance staff see which families get help. The family just sees the lower price.
Where your data goes
Our database, files and backups stay in Canada: on our own servers, with files and backups in Toronto.
A few services process limited data to do their job: Stripe (payments), MailerSend (email) and Plivo (text messages), some of it outside Canada. Dietary info is never sent by email or text, and card details are handled only by Stripe.
Law 25 and PIPEDA
- Parents give express consent before any allergy or diet is saved, and can withdraw it.
- Luncheezy has a privacy officer, and each school names one too.
- We complete a privacy impact assessment before launch, covering every service that handles children’s data.
- Parents can download their data or delete their account.
- Children’s records are anonymized 12 months after they leave the school. Financial records are kept for 7 years, for tax purposes.
- We never collect children’s birth dates or photos.
Security
- No passwords: people sign in with a code or a passkey, and school admins use two-step sign-in.
- Card details are handled only by Stripe; they never reach our servers.
- Encryption in transit and at rest.
- An audit log that can’t be edited records changes to rosters, dietary info, roles and money.
- Each role gets the least access it needs.
- Sign-in codes, PINs and dietary info are never written to our logs.
Accessibility
Luncheezy is built to WCAG 2.1 AA, with automated checks on every screen in English and French, in light and dark mode, and a full keyboard path.
Read our accessibility statementQuestions from your board?
Our privacy officer can walk your board or IT team through how Luncheezy handles children’s data.