Privacy policy

1. Who is responsible

Meal Circle (ABN 63 874 126 787) is responsible for the information handling described here. This policy covers our marketing website, enquiries, surveys, customer accounts and ordering coordination, including relevant restaurant, delivery and support workflows. A feature described as available only when enabled does not mean it is currently offered.

For privacy questions, access, correction, deletion or complaints, use https://mealcircle.com.au/contact and select Privacy request or complaint. You do not need an account. Provide a reply email and enough information to identify your request. A general enquiry may use a preferred name or pseudonym; we may need proportionate identity verification before releasing or changing private records.

2. Information we collect

For enquiries we collect the name or preferred name, reply email, message and any optional phone, location, restaurant, property or university details you provide. For surveys we collect cuisine preferences, optional dietary answers with separate consent, price preference, building or suburb, optional first name and email, referral reference and marketing preference. You may submit a survey without contact details. With an email, we send your survey reference; launch marketing needs your separate choice.

When accounts or ordering are enabled, we process the details required for account access and customer contact, chosen building and collection point, items and sellers, prices and discounts, service date, order status, payment outcome and references, support correspondence and relevant preferences. The payment provider identified at checkout processes payment credentials; do not send card details through our contact form. A guest order still creates an order record.

Our services also process IP/connection information, browser and device details, timestamps, security events, diagnostic logs and necessary identifiers. Order operations can produce preparation, package, delivery, collection-verification, refund and staff-action records. Photos or other evidence you voluntarily supply for support may contain personal information.

We collect information from you and your device, and may receive information needed to fulfil or resolve an order from the relevant restaurant, delivery personnel, payment provider or a person you authorise. Accommodation contacts may supply limited collection-access information. Building selection does not require continuous precise-location tracking.

3. Purposes and optional information

We use relevant information to respond to requests; plan service coverage and menus; provide account and order access; coordinate preparation, payment, delivery and collection; investigate safety or service problems; process refunds; protect against fraud; improve operations; and meet legal, accounting and dispute obligations.

Required fields are identified when information is collected. Without essential contact or order details, we may be unable to respond or fulfil an order. You can decline optional marketing, cookies and survey questions. We use aggregated or de-identified information for planning where practical; identifiable or pseudonymous records are not anonymous.

4. Dietary and sensitive information

Dietary answers can reveal health information or religious beliefs. Dietary survey questions are optional. If you choose to provide them, we ask separately for consent to use them for menu and demand planning. Refusing or withdrawing this consent does not prevent participation in the rest of the survey. Dietary answers do not customise an order and are not used to build identifiable advertising audiences.

For an allergy or safety enquiry, we explain and obtain consent for handling sensitive details where required, or act as otherwise permitted by law. Relevant details may need to reach the restaurant or appropriate authority. Do not include unnecessary medical records. Check the specific item's information and obtain a clear answer before ordering if suitability is uncertain.

5. Who receives information

Authorised staff and service providers receive information needed for their work. A restaurant receives its order items and necessary preparation, packing, order and support details. Restaurants also have their own responsibilities for information they collect or handle as sellers. Delivery personnel receive collection-point, routing, package and necessary contact information. We share relevant information to investigate complaints, missing items, safety issues and refunds.

Accommodation contacts may receive information necessary to arrange access or resolve a collection issue, rather than routine access to full purchase or survey histories. Package identifiers or labels at a shared collection point may be visible to others. Avoid sharing private order links, codes or screenshots publicly.

The marketing website uses Vercel for hosting, Supabase for submission storage, Zoho for email, and, when you accept optional tracking, PostHog for analytics and Meta, TikTok and Snapchat advertising technologies. Ordering may use separate instances and service providers; additional providers and relevant information handling are explained in the ordering service when those features are offered.

We may disclose necessary information to advisers, insurers, regulators, courts or law enforcement when permitted or required, and in a genuine business transfer subject to appropriate safeguards. We do not sell customer lists. Optional advertising technologies disclose information to the providers described below.

6. Cookies, analytics and advertising

Necessary storage supports website operation, security and saved choices; ordering may also use it for carts and private order access. Other users of a shared browser may see locally stored information. Clearing browser storage does not delete records already submitted to our servers.

With your optional cookie choice, PostHog measures selected page visits and form-progress events. Our marketing configuration disables session recording and broad automatic capture and does not deliberately send form answers, names or email addresses in analytics events. It uses a United States endpoint.

With that choice, Meta, TikTok and Snapchat pixels measure selected marketing-page visits and may receive IP addresses, browser details, identifiers and page information. These providers may combine this with information they already hold. Our configured advertising-page restrictions exclude contact and survey pages. Follow external providers' own privacy information for their independent handling.

Use Cookie settings at the bottom of the website to accept, decline or withdraw optional tracking. Declining does not prevent ordinary use. Withdrawal stops future optional loading but does not automatically erase previously received information. Browser and provider controls may also be available. Our Cookie Policy gives more detail.

7. Messages and marketing

We send service replies, security notices and relevant order updates separately from promotional messages. Survey confirmation is not conditional on marketing consent. Promotional messages identify Meal Circle and provide a simple unsubscribe route. We honour unsubscribe requests within five working days, without requiring an account or extra personal information. You may also use the contact form to withdraw marketing consent.

We retain the minimum preference and suppression records needed to respect your choice. Sharing a referral link does not subscribe its recipient. Transactional messages may continue when needed for an existing request or order.

8. Overseas handling

Our providers may store or access information outside Australia, including through support teams and subprocessors. PostHog analytics is configured in the United States. Vercel describes processing in the United States and other countries where it and its subprocessors operate. Supabase describes transfers to the United States and Singapore; its project hosting region is a separate setting and does not rule out overseas support access. Zoho email is configured using its Australian service endpoint; overseas group-company or support access may still occur. These provider descriptions do not mean every record is sent to every country.

When you accept advertising tracking, Snap describes processing in the United States and other countries, and TikTok describes server locations including Singapore, Malaysia, Ireland and the United States. Meta also processes information internationally under its privacy information. Provider locations and subprocessors can change. Current provider information is available at https://vercel.com/legal/dpa, https://supabase.com/legal/privacy-resources/data-residency-and-transfers-faq, https://www.zoho.com/privacy.html, https://values.snap.com/privacy/privacy-policy, https://www.tiktok.com/legal/page/row/privacy-policy/en and https://www.facebook.com/privacy/policy/. Contact us for information relevant to your request.

We take reasonable steps appropriate to the information and applicable law to assess providers and protect overseas handling. Accepting this policy is not a waiver of cross-border privacy protections. Material changes in providers or overseas handling will be reflected in updated information and collection notices.

9. Security and retention

We use reasonable safeguards appropriate to the service, including restricted access and secure communications. No system is completely secure. Keep account credentials and private order links confidential and report suspected misuse.

We keep information for as long as reasonably needed for the stated purposes or legal, accounting, safety and dispute obligations. Account closure does not necessarily remove transaction records that must be retained. Survey data, technical logs and optional content are assessed separately from financial records. When no longer needed, information is deleted or de-identified, subject to lawful retention and backup cycles. Ask us about the retention applying to your information. We investigate data incidents and notify affected people and regulators where required.

10. Access, correction and deletion

Use the contact form to request access, correction, account closure or deletion, or to withdraw optional consent. We may need proportionate verification. We aim to respond within 30 days and explain any delay. There is no fee to make a request or correct information. Any lawful, reasonable access charge will be explained in advance. If a request cannot be fulfilled, we explain why, subject to lawful restrictions, and how to complain.

Withdrawing consent operates prospectively and does not automatically erase information we must lawfully retain. Browser-only drafts may need to be removed on your device. You may ask us to distinguish those from server records.

11. Complaints and changes

Send a privacy complaint through the Contact us form. We aim to acknowledge it within five business days and respond within 30 days. If dissatisfied or without a response after 30 days, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au where it has jurisdiction, or seek other available remedies.

Our customer ordering service is intended for adults aged 18 or over. Contact us if you believe a child has provided information that should be removed. This does not mean we routinely collect identity documents to verify age.

We publish the current version and date and give appropriate notice of significant changes. New uses requiring consent will not begin merely because we have updated this policy.