Privacy Policy

0 Participant Data Boundaries

CrEATe Meals is a menu planning and compliance preparation tool for sponsor organizations. The platform stores aggregate attendance records used for program operations. An attendance record may include the service date, site reference, meal type, total number present, counts by age group, optional recorder text, and optional notes. These fields record aggregate program activity and are not designed to identify an individual child or adult participant.

We do not ask you to enter individual participant identity, eligibility, or family records. Specifically, the platform is not designed to collect:

• Child or participant names, dates of birth, or demographic information
• Participant-level enrollment or attendance histories
• Family income, household composition, or free/reduced eligibility records
• Parent or guardian names, contact details, or signatures
• Photographs or images of children

Do not place participant names, dates of birth, contact details, eligibility information, or other individual identifiers in free-text recorder or notes fields. You remain responsible for participant-level records, which should be kept in your program's designated records system under the requirements applicable to your program.

1 Information We Collect

Information you provide

When you use CreateMeals.org, you may choose to provide information such as:

• Name, email address, and password for your account
• Organization name, type, and size
• Nutrition program details (CACFP or SFSP, site type, meal service schedule)
• Age groups served and facility information
• Food preferences, allergen information, and dietary restrictions
• Menu content, recipes, and meal plans you create
• Aggregate attendance dates, sites, meal types, totals, age-group counts, recorder text, and notes
• Chat messages and questions submitted to our AI assistant
• Files you upload (product labels, nutrition facts, documents)
• Messages submitted through contact or feedback forms

We do not currently offer paid subscriptions, collect payment-card details, or send account data to a payment processor.

You are not required to provide information to browse the public areas of the site.

Information collected automatically

When you visit CreateMeals.org, we may collect technical information such as:

• IP address
• Browser type and device type
• Pages viewed and time spent on the site
• General location based on IP address (country-level)
• Site interaction data (clicks, scrolls, navigation patterns)
• Error reports, logs, and performance traces processed by Sentry, which may include page URLs, browser or device context, network context, and information included in an error

This information is used to improve site performance, enforce geographic availability (see Section 10), maintain security, and improve user experience.

Cookies and tracking

We use cookies to provide functionality and improve your experience. You can manage your cookie preferences at any time using the "Cookie Preferences" link in our footer.

Essential Cookies (Always Active)

Required for the website to function properly:

• Authentication cookies (sb-*) — Keep you logged into your account. Duration: Up to 1 year (refresh token).
• Cookie consent (cookie_consent) — Stores your cookie preferences. Duration: 1 year.
• hCaptcha — Bot prevention on login, registration, and password reset pages. Duration: Session.

Aggregate Page-View Counting (Always Active)

We use Vercel Web Analytics to measure page views. It is cookieless: it sets no cookies and stores nothing on your device. We use this data as aggregate page and visit counts; we do not link it to your account or use it to build individual profiles. Because it uses no cookies or device storage, it is not controlled by the Analytics cookie category. Vercel processes these requests as our service provider; see Vercel's privacy documentation for how it handles them.

Analytics and Performance Tracking (Optional)

These services and internal measurements run only when you allow the Analytics category:

• Vercel Analytics CTA events — Non-PII signup or tool CTA events, including CTA placement and destination. Duration: Session.
• Vercel Speed Insights — Performance monitoring. Duration: Session.
• Marketing attribution session storage — Stores the landing path, referring host, and recognized UTM source, medium, and campaign values after analytics consent. Query strings and link text are not included in CTA events. Duration: Browser session.
• Resource interaction counts — Records the resource identifier when you open a listed external resource and, if you are signed in, associates that event with your account. This runs only after Analytics consent.
• Engagement session storage — Tracks scroll depth, time on page, and interaction counts for signed-in users. Its random session identifier stays in browser session storage and expires with the browser session.
• CrEATe performance metrics — Records page path, web performance measurements, browser or device context, connection type, and screen size in our database. This collector does not record the contents of a browser session.

When you set or change your cookie preferences, we log the choice along with a server timestamp, your IP address, and browser type to maintain a record of the choice. Account-linked records are handled through the account-deletion review process described below. Anonymous consent records do not currently have a fixed automated deletion interval; you may contact us to request a privacy review.

Operational error, log, and performance diagnostics provided by Sentry run separately from the optional Analytics category. In the browser, Sentry session replay is disabled and Sentry's default PII collection option is disabled. Diagnostic events may still contain technical context, page URLs, network context, or information included in an application error.

You can manage optional Analytics preferences or withdraw that consent at any time by clicking "Cookie Preferences" in the footer of any page. CreateMeals does not currently run advertising or marketing trackers.

2 How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Generate menus, compliance checks, and recommendations using AI
• Provide access to tools, resources, and crediting documentation
• Respond to questions or support requests
• Send essential service emails, such as account confirmation and security notices
• Send updates, newsletters, or marketing emails if you opted in
• Analyze site traffic and user interactions to improve the platform
• Maintain security, enforce rate limits, and prevent misuse

3 AI-Powered Features

CrEATe Meals uses artificial intelligence to power several features, including menu generation, compliance checking, the "Ask Ben" chat assistant, recipe analysis, and educational content generation. When you use these features:

• Your messages, menu data, and related content are sent to third-party AI providers (OpenAI and Anthropic) for processing
• AI providers process this data to generate responses. Under their current API terms of service, data submitted through the API is not used for model training
• Chat conversation history is stored in our database to provide continuity across sessions
• AI-generated content (menus, compliance suggestions, recommendations) may contain errors and should always be verified by the user
• Image generation features (such as activity sheet illustrations) use OpenAI's DALL-E service. The image prompt contains a selected activity theme, an age-range style instruction, and fixed illustration directions. Free-text custom notes, account name, and email are not included in the image prompt. If you request AI-generated worksheet text or a coloring-page description, custom notes may be sent to Anthropic for that text generation

We do not automatically add your stored account name, email, or password to AI requests. Content you enter in queries or custom notes, relevant program data, and AI-specific prompts may be shared with the provider used for that feature.

4 Email Communications

We use Resend as our email delivery service. If you choose to opt in, we may send you emails that include:

• News and updates
• New resources or tools
• Member announcements
• Occasional marketing messages related to CrEATe Meals

We track email delivery metrics such as opens and clicks to improve our communications. You can unsubscribe at any time using the link in any email or by contacting us directly.

Essential service emails, such as account verification, password resets, and security notices, may be sent regardless of marketing preferences when needed to operate or protect your account.

5 Advertising and Sponsorships

CreateMeals.org does not currently sell ads or share information with advertisers.

We may partner with advertisers or sponsors in the future. If we do, this Privacy Policy will be updated to explain how information is collected, used, and shared. Users will be given any required opt-out choices as required by law.

6 Third-Party Services

We do not sell, rent, or trade your personal information. We use the following categories of third-party services to operate the platform:

Future paid services

CrEATe Meals does not currently use a payment processor. If we introduce a paid service in the future, we will update this policy before collecting or sharing payment-related information and provide notice about the applicable data practices.

AI services

OpenAI and Anthropic process user queries, menu data, and compliance questions to power our AI features. See Section 3 for details.

Food and nutrition data

To provide crediting information, nutrition data, and product lookups, we send food-related search queries to:

• USDA FoodData Central — Nutrition database lookups
• Nutritionix — UPC product lookups and nutrition parsing
• Open Food Facts — Ingredient analysis and allergen detection
• UPCitemDB — Barcode product identification

These services receive food search queries and product identifiers, not personal user information.

Retail pricing (when available)

Product pricing and availability data may be retrieved from Kroger and Walmart APIs using product identifiers. No personal user information is shared with these services.

Document scanning

When you upload product labels or documents for scanning, images are processed by Google Cloud Vision for optical character recognition (OCR). Uploaded images are sent to Google's servers for text extraction and are not retained by Google after processing.

Translation

Menu text may be sent to LibreTranslate for multilingual translation. Only menu content is shared, not personal information.

Email integrations

If you choose to connect your Gmail account for email coordination features, you authorize CrEATe Meals to access your Gmail inbox via Google OAuth. We request only the scopes necessary to read and send messages related to your nutrition program operations. You can revoke this access at any time through your Google account settings. Email content accessed through this integration is processed on our servers and is not shared with other third parties.

Hosting, authentication, and database

Vercel provides hosting and edge network services. Supabase provides authentication, database, and file storage. Each provider maintains its own security and compliance program; any provider certification applies to that provider's services, not to CreateMeals as a certified organization.

Error and performance diagnostics

Sentry processes application errors, logs, performance traces, and technical request or device context for troubleshooting, security monitoring, and performance analysis. Depending on the event, this processing may include network context, page URL, browser or device information, or information included in an application error. Browser session replay and Sentry's default browser PII collection option are disabled.

Bot prevention

hCaptcha is used on authentication pages to prevent automated abuse. hCaptcha collects interaction data to distinguish humans from bots.

Rate limiting

Upstash Redis stores IP addresses and request metadata temporarily to enforce rate limits and protect the platform from abuse.

Internal activity logging

We store certain user interactions (feature usage, search queries, task completions, and consented performance measurements) in our database to improve the platform, debug issues, and understand how tools are used. Blocked access attempts (for example, from geo-restricted locations) may also be stored with IP address and user agent for security monitoring. As described above, error, log, and performance diagnostics are also processed by Sentry and therefore are not stored only in our internal database.

We may integrate additional third-party services (such as push notification providers or additional email delivery services) in the future. When new services are added that materially affect how your data is processed, this policy will be updated accordingly.

All third-party service providers are bound by their own terms of service and privacy policies to protect your data. Where available, we use API configurations that prevent providers from using your data for model training or purposes unrelated to operating our platform.

7 Data Retention

We keep your information only as long as needed to operate the site, provide your membership, comply with legal obligations, or for other legitimate purposes such as improving the site.

If you submit an account-deletion request, we record it for cancellation, retention, and ownership review. A request does not itself confirm that erasure has occurred or trigger a verified automated erasure process. Requests are handled through manual review and processing, including evaluation of legal, security, shared-organization, and program-record obligations. Contact us if you need the status of a request or a response within a timeframe required by applicable law.

8 Data Security

We use reasonable technical and administrative measures to protect your information, including:

• TLS encryption for all data in transit
• Managed provider controls for data at rest
• Row-level security (RLS) policies for tenant-scoped database data
• HttpOnly and SameSite cookie settings where applicable
• Content Security Policy (CSP) headers as a browser defense-in-depth control
• Rate limiting on sensitive endpoints

While no system is perfectly secure, we work to safeguard data against unauthorized access, disclosure, or loss.

9 Your Rights

Depending on your location, you may have the right to:

• Access the information we have about you
• Request corrections to inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Opt out of email communications
• Opt out of non-essential cookies and tracking
• Opt out of future data sale or sharing if it ever becomes applicable

You can download the listed self-service account and planning datasets and submit a deletion request separately from Dashboard › Settings; an export is recommended but is not required before requesting deletion. For a broader access or portability request, contact privacy@createmeals.org. The dashboard records a pending request and a review-due date, and you may cancel while the request remains pending. When due, the request is surfaced for manual review and processing; the dashboard does not represent that automated erasure has been verified. You may also contact us to request status or faster review where required by applicable law.

10 Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will:

• Notify affected users via email as soon as reasonably practicable, and no later than required by applicable law
• Provide details about what information was affected and what steps we are taking
• Report the breach to applicable regulatory authorities as required by law
• Offer guidance on steps you can take to protect yourself

We take reasonable precautions to minimize the risk of unauthorized access to your data, including the security measures described in Section 8.

11 Do Not Track

Some browsers include a "Do Not Track" (DNT) signal. Because there is no industry-standard way to interpret DNT signals, we do not currently respond to them. You can turn optional analytics and performance tracking on or off through our cookie consent manager. Operational Sentry error and performance diagnostics are not controlled by that preference; browser session replay and Sentry's default browser PII collection option remain disabled.

12 California Privacy Rights

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), depending on whether CrEATe Meals meets the applicable business thresholds. Regardless of CCPA applicability, we are committed to honoring the following rights for all users:

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to opt out of the "sale" of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us using the information in Section 17.

13 Geographic Availability

CreateMeals.org is currently available to users in the United States. We use IP-based geolocation to determine your country. Users outside the United States may be redirected to an unavailability page. IP addresses of blocked requests are logged temporarily for security purposes.

14 Children's Privacy

CreateMeals.org is intended for use by adult sponsor-organization staff (18 years of age or older), as required by our Terms of Use. The service is not directed to minors, and we do not knowingly collect personal information directly from anyone under the age of 18. As described in Section 0, the platform may store aggregate attendance records but is not designed to store participant identities. If you believe personal information from a minor was entered, contact us so we can review the record and take appropriate action.

15 Third-Party Links

CreateMeals.org may link to external websites, including USDA resources, manufacturer websites, and state agency portals. We are not responsible for the content or privacy practices of those sites. We encourage you to review their policies.

16 Changes to This Policy

We may update this Privacy Policy as needed. When changes are made, the date at the top of this page will be updated. For significant changes, we will notify registered users via email. Continued use of the site means you accept the revised policy.

17 Contact Us

If you have questions about this Privacy Policy, need to submit a data access, correction, or deletion request, or wish to exercise any rights described in this policy, please contact us using the form available on our website. We make reasonable efforts to respond to privacy-related requests promptly.