Privacy notice

This notice explains what personal data Mealforma (“we”) collects, why, who it is shared with and what you can ask of us.

Two different roles

For our own customers and website visitors — the businesses that sign up and the people who visit this website — we decide how data is used, and this notice applies in full.

For a shop’s own customers — the people who order food from a business that runs on Mealforma — the shop decides how their data is used, and we process it on the shop’s behalf, only to run its service. If you ordered from a shop, its own privacy notice applies; contact the shop first, and we will help it answer you.

What we collect

• Account details: your company name, your name, email address, country, time zone and the web address you chose for your shop.
• Billing: handled by our payment provider, Stripe. We see the card brand and last four digits, never the full card number.
• Use and security records: sign-ins, security events and a log of changes made in your admin, so it is always possible to answer “who did this?”.
• Support: messages you send us and what is needed to answer them.
• Website visits: pages viewed, the page that sent you here, campaign tags on the link, your IP address and your browser and device details. We measure visits without a cookie. One first-party cookie, mf_first_touch, kept for 30 days, notes how you first arrived so a sign-up can be credited to the page or campaign that brought it; it does not identify you.
• Advertising measurement: this website uses the Google Ads tag to count sign-ups that came from our ads. For visitors in the UK, the EEA and Switzerland, advertising storage is off by default.

Why we use it

To provide and bill for the service (our contract with you); to keep it secure, prevent abuse and fix problems, to improve the website and to measure our advertising (our legitimate interests); and to meet our legal and tax obligations. Where the law requires your consent, we ask for it.

Who we share it with

We do not sell personal data. We share it only with the service providers that run Mealforma, under contracts that limit them to processing it for us:

• Railway — hosting and databases (servers in Singapore)
• Cloudflare — file storage
• Stripe — payments
• Resend — email delivery
• Twilio, Meta (WhatsApp) and LINE — text and chat messages, only when a shop switches them on
• Anthropic — AI features, only when used; data sent to it is not used to train its models
• Google — maps and address lookup, and advertising measurement on this website

We may also disclose data where the law requires it.

International transfers

Our servers are in Singapore and our providers operate worldwide, so your data may be processed outside your country. Where the law requires it, we rely on safeguards such as standard contractual clauses.

How long we keep it

• Account and billing records: while your account exists, and afterwards for as long as tax and accounting law requires.
• Website visit records: 400 days.
• Database backups: 30 days.
• Security and change records: kept for the life of the account, because they exist to answer questions about the past.

Security

Each shop’s data is held in its own dedicated database. Connections are encrypted, and staff access is limited and recorded.

Your rights

You can ask to see, correct, export or delete your personal data, and object to or restrict how we use it. Much of this you can do yourself in your admin; for the rest, use the contact page and we will answer within 30 days. You also have the right to complain to the data protection authority where you live.

Children

Mealforma is a service for businesses and is not directed at children under 16.

Changes

If we change this notice in a way that matters, we will tell account holders by email or in their admin before the change takes effect.

Contact

Questions about privacy: use the contact page.