1 Information We Collect

Information you provide

When you use CreateMeals.org, you may choose to provide information such as:

• Name, email address, and password for your account
• Organization name, type, and size
• Nutrition program details (CACFP or SFSP, site type, meal service schedule)
• Age groups served and facility information
• Food preferences, allergen information, and dietary restrictions
• Menu content, recipes, and meal plans you create
• Chat messages and questions submitted to our AI assistant
• Files you upload (product labels, nutrition facts, documents)
• Messages submitted through contact or feedback forms
• Billing and subscription information (processed by Stripe; see Section 6)

You are not required to provide information to browse the public areas of the site.

Information collected automatically

When you visit CreateMeals.org, we may collect technical information such as:

• IP address
• Browser type and device type
• Pages viewed and time spent on the site
• General location based on IP address (country-level)
• Site interaction data (clicks, scrolls, navigation patterns)

This information is used to improve site performance, enforce geographic availability (see Section 10), maintain security, and improve user experience.

Cookies and tracking

We use cookies to provide functionality and improve your experience. You can manage your cookie preferences at any time using the "Cookie Preferences" link in our footer.

Essential Cookies (Always Active)

Required for the website to function properly:

• Authentication cookies (sb-*) — Keep you logged into your account. Duration: Up to 1 year (refresh token).
• Cookie consent (cookie_consent) — Stores your cookie preferences. Duration: 1 year.
• hCaptcha — Bot prevention on login, registration, and password reset pages. Duration: Session.

Analytics Cookies (Optional)

Help us understand how visitors interact with our site:

• Vercel Analytics — Anonymous page view and web vitals tracking. Duration: Session.
• Vercel Speed Insights — Performance monitoring. Duration: Session.
• Engagement tracking (engagement_session_id) — Tracks scroll depth, time on page, and interaction counts to improve site experience. Session ID is randomly generated and not linked to your account. Duration: Browser session.

Session Recording Cookies (Optional)

Allow us to record and replay browsing sessions to improve user experience:

• Hotjar (_hj*) — Session recordings and heatmaps. Personal data is masked. Admin pages are excluded. Duration: Up to 1 year.
• LogRocket (_lr_*) — Error tracking and session replays. Sensitive data (passwords, auth tokens, API keys) is automatically stripped. Duration: Up to 1 year.

When you set or change your cookie preferences, we log the choice along with a timestamp, your IP address, and browser type to maintain an auditable record of consent as required by applicable privacy regulations. These consent records are retained for the duration of your account or for up to 3 years for anonymous visitors.

You can manage these preferences or withdraw consent at any time by clicking "Cookie Preferences" in the footer of any page.

2 How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Generate menus, compliance checks, and recommendations using AI
• Provide access to tools, resources, and crediting documentation
• Process subscription payments and manage billing
• Respond to questions or support requests
• Send transactional emails (account confirmation, billing receipts)
• Send updates, newsletters, or marketing emails if you opted in
• Analyze site traffic and user interactions to improve the platform
• Maintain security, enforce rate limits, and prevent misuse

3 AI-Powered Features

CrEATe Meals uses artificial intelligence to power several features, including menu generation, compliance checking, the "Ask CrEATe" chat assistant, recipe analysis, and educational content generation. When you use these features:

• Your messages, menu data, and related content are sent to third-party AI providers (OpenAI and Anthropic) for processing
• AI providers process this data to generate responses. Under their current API terms of service, data submitted through the API is not used for model training
• Chat conversation history is stored in our database to provide continuity across sessions
• AI-generated content (menus, compliance suggestions, recommendations) may contain errors and should always be verified by the user
• Image generation features (such as activity sheet illustrations) use OpenAI's DALL-E service. Text prompts describing the requested image are sent to OpenAI for processing — no personal data is included in image generation requests

We do not send your personal account information (name, email, password) to AI providers. Only the content of your queries, program data, and AI-specific prompts is shared for processing.

4 Email Communications

We use Resend as our email delivery service. If you choose to opt in, we may send you emails that include:

• News and updates
• New resources or tools
• Member announcements
• Occasional marketing messages related to CrEATe Meals

We track email delivery metrics such as opens and clicks to improve our communications. You can unsubscribe at any time using the link in any email or by contacting us directly.

Transactional emails (account verification, password resets, billing receipts) are sent regardless of marketing preferences as they are necessary for account operation.

5 Advertising and Sponsorships

CreateMeals.org does not currently sell ads or share information with advertisers.

We may partner with advertisers or sponsors in the future. If we do, this Privacy Policy will be updated to explain how information is collected, used, and shared. Users will be given any required opt-out choices as required by law.

6 Third-Party Services

We do not sell, rent, or trade your personal information. We use the following categories of third-party services to operate the platform:

Payment processing

Stripe handles all payment processing. When you subscribe to a paid plan, your payment information (credit card details) is collected directly by Stripe and never touches our servers. We receive subscription status, plan details, and billing history from Stripe. See Stripe's Privacy Policy.

AI services

OpenAI and Anthropic process user queries, menu data, and compliance questions to power our AI features. See Section 3 for details.

Food and nutrition data

To provide crediting information, nutrition data, and product lookups, we send food-related search queries to:

• USDA FoodData Central — Nutrition database lookups
• Nutritionix — UPC product lookups and nutrition parsing
• Open Food Facts — Ingredient analysis and allergen detection
• UPCitemDB — Barcode product identification

These services receive food search queries and product identifiers, not personal user information.

Retail pricing (when available)

Product pricing and availability data may be retrieved from Kroger and Walmart APIs using product identifiers. No personal user information is shared with these services.

Document scanning

When you upload product labels or documents for scanning, images are processed by Google Cloud Vision for optical character recognition (OCR). Uploaded images are sent to Google's servers for text extraction and are not retained by Google after processing.

Translation

Menu text may be sent to LibreTranslate for multilingual translation. Only menu content is shared, not personal information.

Email integrations

If you choose to connect your Gmail account for email coordination features, you authorize CrEATe Meals to access your Gmail inbox via Google OAuth. We request only the scopes necessary to read and send messages related to your nutrition program operations. You can revoke this access at any time through your Google account settings. Email content accessed through this integration is processed on our servers and is not shared with other third parties.

Hosting, authentication, and database

Vercel provides hosting and edge network services. Supabase provides authentication, database, and file storage. Both maintain SOC 2 Type II compliance.

Bot prevention

hCaptcha is used on authentication pages to prevent automated abuse. hCaptcha collects interaction data to distinguish humans from bots.

Rate limiting

Upstash Redis stores IP addresses and request metadata temporarily to enforce rate limits and protect the platform from abuse.

Internal activity logging

We log certain user interactions (feature usage, search queries, errors, and task completions) internally to improve the platform, debug issues, and understand how tools are used. This data is stored in our database and is not shared with third parties. Blocked access attempts (e.g., from geo-restricted locations) are also logged with IP address and user agent for security monitoring.

We may integrate additional third-party services (such as push notification providers or additional email delivery services) in the future. When new services are added that materially affect how your data is processed, this policy will be updated accordingly.

All third-party service providers are bound by their own terms of service and privacy policies to protect your data. Where available, we use API configurations that prevent providers from using your data for model training or purposes unrelated to operating our platform.

7 Data Retention

We keep your information only as long as needed to operate the site, provide your membership, comply with legal obligations, or for other legitimate purposes such as improving the site.

If you request deletion of your account, we will delete your personal information and associated data unless we are required to retain it for legal, billing, or security reasons. Anonymized or aggregated data may be retained for analytics purposes.

8 Data Security

We use reasonable technical and administrative measures to protect your information, including:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Row-level security (RLS) to isolate user data at the database level
• Secure cookie handling with HttpOnly and SameSite flags
• Content Security Policy (CSP) headers to prevent cross-site attacks
• Rate limiting on sensitive endpoints

While no system is perfectly secure, we work to safeguard data against unauthorized access, disclosure, or loss.

9 Your Rights

Depending on your location, you may have the right to:

• Access the information we have about you
• Request corrections to inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Opt out of email communications
• Opt out of non-essential cookies and tracking
• Opt out of future data sale or sharing if it ever becomes applicable

To make a request, contact us using the information below.

10 Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will:

• Notify affected users via email as soon as reasonably practicable, and no later than required by applicable law
• Provide details about what information was affected and what steps we are taking
• Report the breach to applicable regulatory authorities as required by law
• Offer guidance on steps you can take to protect yourself

We take reasonable precautions to minimize the risk of unauthorized access to your data, including the security measures described in Section 8.

11 Do Not Track

Some browsers include a "Do Not Track" (DNT) signal. Because there is no industry-standard way to interpret DNT signals, we do not currently respond to them. However, you can control tracking through our cookie consent manager, which provides granular control over analytics and session recording cookies.

12 California Privacy Rights

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), depending on whether CrEATe Meals meets the applicable business thresholds. Regardless of CCPA applicability, we are committed to honoring the following rights for all users:

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to opt out of the "sale" of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us using the information in Section 17.

13 Geographic Availability

CreateMeals.org is currently available to users in the United States. We use IP-based geolocation to determine your country. Users outside the United States may be redirected to an unavailability page. IP addresses of blocked requests are logged temporarily for security purposes.

14 Children's Privacy

CreateMeals.org is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe information has been collected from a child, contact us and we will remove it.

15 Third-Party Links

CreateMeals.org may link to external websites, including USDA resources, manufacturer websites, and state agency portals. We are not responsible for the content or privacy practices of those sites. We encourage you to review their policies.

16 Changes to This Policy

We may update this Privacy Policy as needed. When changes are made, the date at the top of this page will be updated. For significant changes, we will notify registered users via email. Continued use of the site means you accept the revised policy.

17 Contact Us

If you have questions about this Privacy Policy, need to submit a data access, correction, or deletion request, or wish to exercise any rights described in this policy, please contact us using the form available on our website. We make reasonable efforts to respond to privacy-related requests promptly.