1 Information We Collect

Information you provide

When you use CreateMeals.org, you may choose to provide information such as:

• Name, email address, and password for your account
• Organization name, type, and size
• Nutrition program details (CACFP or SFSP, site type, meal service schedule)
• Age groups served and facility information
• Food preferences, allergen information, and dietary restrictions
• Menu content, recipes, and meal plans you create
• Chat messages and questions submitted to our AI assistant
• Files you upload (product labels, nutrition facts, documents)
• Messages submitted through contact or feedback forms
• Billing and subscription information (processed by Stripe; see Section 6)

You are not required to provide information to browse the public areas of the site.

Information collected automatically

When you visit CreateMeals.org, we may collect technical information such as:

• IP address
• Browser type and device type
• Pages viewed and time spent on the site
• General location based on IP address (country-level)
• Site interaction data (clicks, scrolls, navigation patterns)

This information is used to improve site performance, enforce geographic availability (see Section 10), maintain security, and improve user experience.

Cookies and tracking

We use cookies to provide functionality and improve your experience. You can manage your cookie preferences at any time using the "Cookie Preferences" link in our footer.

Essential Cookies (Always Active)

Required for the website to function properly:

• Authentication cookies (sb-*) — Keep you logged into your account. Duration: Up to 1 year (refresh token).
• Cookie consent (cookie_consent) — Stores your cookie preferences. Duration: 1 year.
• hCaptcha — Bot prevention on login, registration, and password reset pages. Duration: Session.

Analytics Cookies (Optional)

Help us understand how visitors interact with our site:

• Vercel Analytics — Anonymous page view and web vitals tracking. Duration: Session.
• Vercel Speed Insights — Performance monitoring. Duration: Session.

Session Recording Cookies (Optional)

Allow us to record and replay browsing sessions to improve user experience:

• Hotjar (_hj*) — Session recordings and heatmaps. Personal data is masked. Admin pages are excluded. Duration: Up to 1 year.
• LogRocket (_lr_*) — Error tracking and session replays. Sensitive data (passwords, auth tokens, API keys) is automatically stripped. Duration: Up to 1 year.

You can manage these preferences or withdraw consent at any time by clicking "Cookie Preferences" in the footer of any page.

2 How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Generate menus, compliance checks, and recommendations using AI
• Provide access to tools, resources, and crediting documentation
• Process subscription payments and manage billing
• Respond to questions or support requests
• Send transactional emails (account confirmation, billing receipts)
• Send updates, newsletters, or marketing emails if you opted in
• Analyze site traffic and user interactions to improve the platform
• Maintain security, enforce rate limits, and prevent misuse

3 AI-Powered Features

CrEATe Meals uses artificial intelligence to power several features, including menu generation, compliance checking, and the "Ask CrEATe" chat assistant. When you use these features:

• Your messages, menu data, and related content are sent to third-party AI providers (OpenAI and Anthropic) for processing
• AI providers process this data to generate responses and are contractually prohibited from using it for training their models
• Chat conversation history is stored in our database to provide continuity across sessions
• AI-generated content (menus, compliance suggestions, recommendations) may contain errors and should always be verified by the user

We do not send your personal account information (name, email, password) to AI providers. Only the content of your queries and related program data is shared for processing.

4 Email Communications

We use Resend as our email delivery service. If you choose to opt in, we may send you emails that include:

• News and updates
• New resources or tools
• Member announcements
• Occasional marketing messages related to CrEATe Meals

We track email delivery metrics such as opens and clicks to improve our communications. You can unsubscribe at any time using the link in any email or by contacting us directly.

Transactional emails (account verification, password resets, billing receipts) are sent regardless of marketing preferences as they are necessary for account operation.

5 Advertising and Sponsorships

CreateMeals.org does not currently sell ads or share information with advertisers.

We may partner with advertisers or sponsors in the future. If we do, this Privacy Policy will be updated to explain how information is collected, used, and shared. Users will be given any required opt-out choices as required by law.

6 Third-Party Services

We do not sell, rent, or trade your personal information. We use the following categories of third-party services to operate the platform:

Payment processing

Stripe handles all payment processing. When you subscribe to a paid plan, your payment information (credit card details) is collected directly by Stripe and never touches our servers. We receive subscription status, plan details, and billing history from Stripe. See Stripe's Privacy Policy.

AI services

OpenAI and Anthropic process user queries, menu data, and compliance questions to power our AI features. See Section 3 for details.

Food and nutrition data

To provide crediting information, nutrition data, and product lookups, we send food-related search queries to:

• USDA FoodData Central — Nutrition database lookups
• Nutritionix — UPC product lookups and nutrition parsing
• Open Food Facts — Ingredient analysis and allergen detection
• UPCitemDB — Barcode product identification

These services receive food search queries and product identifiers, not personal user information.

Retail pricing (when available)

Product pricing and availability data may be retrieved from Kroger and Walmart APIs using product identifiers. No personal user information is shared with these services.

Document scanning

When you upload product labels or documents for scanning, images are processed by Google Cloud Vision for optical character recognition (OCR). Uploaded images are sent to Google's servers for text extraction and are not retained by Google after processing.

Translation

Menu text may be sent to LibreTranslate for multilingual translation. Only menu content is shared, not personal information.

Hosting, authentication, and database

Vercel provides hosting and edge network services. Supabase provides authentication, database, and file storage. Both maintain SOC 2 Type II compliance.

Bot prevention

hCaptcha is used on authentication pages to prevent automated abuse. hCaptcha collects interaction data to distinguish humans from bots.

Rate limiting

Upstash Redis stores IP addresses and request metadata temporarily to enforce rate limits and protect the platform from abuse.

All third-party service providers are contractually obligated to protect your data and may not use it for purposes unrelated to operating our platform.

7 Data Retention

We keep your information only as long as needed to operate the site, provide your membership, comply with legal obligations, or for other legitimate purposes such as improving the site.

If you request deletion of your account, we will delete your personal information and associated data unless we are required to retain it for legal, billing, or security reasons. Anonymized or aggregated data may be retained for analytics purposes.

8 Data Security

We use reasonable technical and administrative measures to protect your information, including:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Row-level security (RLS) to isolate user data at the database level
• Secure cookie handling with HttpOnly and SameSite flags
• Content Security Policy (CSP) headers to prevent cross-site attacks
• Rate limiting on sensitive endpoints

While no system is perfectly secure, we work to safeguard data against unauthorized access, disclosure, or loss.

9 Your Rights

Depending on your location, you may have the right to:

• Access the information we have about you
• Request corrections to inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Opt out of email communications
• Opt out of non-essential cookies and tracking
• Opt out of future data sale or sharing if it ever becomes applicable

To make a request, contact us using the information below.

10 Geographic Availability

CreateMeals.org is currently available to users in the United States. We use IP-based geolocation to determine your country. Users outside the United States may be redirected to an unavailability page. IP addresses of blocked requests are logged temporarily for security purposes.

11 Children's Privacy

CreateMeals.org is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe information has been collected from a child, contact us and we will remove it.

12 Third-Party Links

CreateMeals.org may link to external websites, including USDA resources, manufacturer websites, and state agency portals. We are not responsible for the content or privacy practices of those sites. We encourage you to review their policies.

13 Changes to This Policy

We may update this Privacy Policy as needed. When changes are made, the date at the top of this page will be updated. For significant changes, we will notify registered users via email. Continued use of the site means you accept the revised policy.

14 Contact Us

If you have questions about this Privacy Policy or need to submit a data access, correction, or deletion request, please contact us using the form available on our website.