Privacy Policy

1. Who we are

“Tiffin Plus”, “we” and “us” mean the operator of tiffinplus.com and its subdomains. You can reach us at hello@tiffinplus.com.

2. Information we collect

Business owners and staff

• Name, email address, and password (stored hashed, never in plain text).
• Role and permissions within the business (for example owner, manager, cook, driver).
• Business details: business name, email, phone, address, time zone, logo, brand colour, delivery areas, and operating settings.
• Session information when you sign in, including IP address and browser/device (user agent).
• Billing relationship with us: plan, subscription status, and a Stripe customer ID. We do not store full card numbers.

Customers of a business (entered by the business or by you when ordering)

• Name, phone number, and email address.
• Delivery address, delivery notes, preferred delivery time, and map coordinates derived from the address.
• Meal plan, order, subscription, pause, and payment history, and internal notes the business records.
• Stripe customer and saved-card reference IDs. Card numbers are entered on Stripe's page and are not stored by Tiffin Plus.
• Your agreement to the business's terms at checkout.

Technical information

• IP address, browser, device type, and page performance measurements (see Vercel in section 5).
• Server and error logs used to operate and debug the service.

3. How we use information

• To provide the platform: accounts, customer and subscription management, order portals, delivery routes, billing, and notifications.
• To send messages the business configures, such as order confirmations, delivery and payment reminders, pause and renewal notices.
• To process payments through Stripe, including charging a saved card for renewals where the customer agreed at checkout.
• To verify accounts, secure the service, and prevent fraud or abuse.
• To respond to support requests and to notify you about important service changes.
• To meet legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use it for third-party advertising.

4. Messages (WhatsApp, SMS, email)

Notifications are sent through Twilio and Resend at the direction of the business you ordered from. Businesses are responsible for having the right to contact their customers. If you do not want to receive messages, tell the business, or contact us at hello@tiffinplus.com.

5. Service providers (sub-processors)

We use the following providers to run the service. They receive only the information needed for the purpose listed.

This list can change as we change how the service works; we will update this page when it does. Each provider handles information under its own terms and privacy policy.

6. Other sharing

• The business you order from sees the information you give it, and may share route details (such as delivery addresses) with its own drivers and staff.
• Legal and safety: where required by law or to protect rights, safety, or the security of the service.
• Business transfer: if Tiffin Plus is involved in a merger, acquisition, or sale of assets, information may be transferred, and we will tell you if its handling materially changes.

7. Cookies and similar technologies

We use a cookie to keep business users signed in. The customer ordering portal does not require an account. We do not use advertising or cross-site tracking cookies. Stripe's payment pages and Google Maps features may set their own cookies or collect device information under their own policies. Vercel Speed Insights collects performance measurements about page loads.

8. Where information is processed

Our production database is hosted in Canada (AWS Canada Central via Supabase). Some providers listed above, such as Vercel, Stripe, Twilio, Resend, Google, and Inngest, may process information in other countries, including the United States.

9. Retention

We keep business and customer information while the business's account is active. When an account is closed, or when we are asked to delete information, we delete or anonymize it, except where we need to keep certain records, for example for payments, taxes, disputes, security, or legal obligations. Backups and provider records may persist for a limited time before they are overwritten.

10. Security

We protect information with measures including encrypted connections (HTTPS), hashed passwords, role-based access within each business, and delegating card handling to Stripe. No system is perfectly secure, so we cannot guarantee absolute security. Please use a strong, unique password and tell us promptly if you suspect unauthorized access.

11. Your choices and rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, or to object to or restrict certain uses.

• Customers of a business: contact the business first, since it controls your order data. You can also email us and we will help route or act on your request.
• Business owners and staff: email us to access, correct, or delete your account information. Some account data can be edited directly in Settings.

We will respond within a reasonable time and may need to verify your identity.

12. Children

Tiffin Plus is intended for businesses and adults. It is not directed to children, and we do not knowingly collect their information.

13. Changes to this policy

We may update this policy. The “Last updated” date above shows the latest version, and we will give additional notice of material changes where appropriate.

14. Contact

Email hello@tiffinplus.com for privacy questions or requests.