Privacy policy

This policy explains how Munch Prep ("we", "us") handles personal data when you use our website, dashboards, and related services. It should be read alongside our Terms of service and Data and compliance page.

If you are a customer of a meal prep brand that uses Munch Prep, that brand may also process your data as a separate controller for its own business. This policy covers processing we carry out as a platform provider.

Who we are

The data controller for personal data processed in connection with the Munch Prep platform (as described here) is Munch Prep. For privacy questions, contact us at info@munch-prep.com or via our contact form.

Data we collect

Depending on how you use the service, we may process:

• Account and profile data — such as name, email address, and organisation or brand details you provide when registering or using dashboards.
• Operational and technical data — such as device/browser type, approximate location derived from IP where needed for security or delivery features, log and diagnostic data, and cookies or similar technologies where used.
• Transaction and fulfilment data — such as order contents, delivery addresses, payment-related references from our payment provider (we do not store full card numbers on our servers), and communications needed to operate checkout and kitchen workflows.
• Support and correspondence — information you send when you contact us.

How we use data

We use personal data to:

• Provide, secure, and improve the platform and storefront experiences;
• Authenticate users, enforce access controls, and prevent abuse or fraud;
• Process payments and order lifecycle events with our payment and infrastructure partners;
• Communicate about the service, including operational notices and support responses;
• Meet legal, regulatory, and accounting obligations where applicable.

Where UK or EU data protection law applies, we rely on appropriate lawful bases such as performance of a contract, legitimate interests (balanced against your rights), legal obligation, and consent where required.

Sharing and processors

We share personal data with trusted service providers who process it on our instructions (for example cloud hosting, database, authentication, email delivery, and payment processing). We require them to protect the data and use it only for the services they provide to us.

We may disclose information if required by law, to protect rights and safety, or in connection with a business transfer subject to appropriate safeguards.

International transfers

Some providers may process data outside the UK or EEA. Where we transfer personal data to countries not covered by an adequacy decision, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms, as required by applicable law.

Retention

We keep personal data only as long as needed for the purposes above, including legal, accounting, and dispute resolution requirements. Retention periods vary by data category and may depend on your relationship with us and with brands using the platform.

Security

We implement technical and organisational measures designed to protect personal data. No method of transmission or storage is completely secure; we encourage strong passwords and careful sharing of access.

Your rights

Depending on where you live, you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. You may also have the right to lodge a complaint with a supervisory authority. To exercise rights, contact us using the details above. See also our Data and compliance page for GDPR-focused information.

Children

The platform is not directed at children under 16. We do not knowingly collect personal data from children for marketing. If you believe we have done so, please contact us.

Changes

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be communicated through the service or by email where appropriate.