Privacy Policy

1. Who we are

MealMesh is a platform that connects neighbourhood kitchens with customers who order meals. This Privacy Policy explains how we collect, use, and protect personal information under South Africa’s Protection of Personal Information Act (POPIA), with rights language also informed by the GDPR. The information officer and data contact is info@mealmesh.co.za.

2. What data we collect

Account data: name, email address, phone number (optional), and preferred language. Order data: meals ordered, quantities, amounts, fulfilment type (pickup or delivery), delivery address when provided, and order status. Proof of payment (POP): files you upload to show payment to a kitchen. Kitchen operational data linked to your orders: menus, pickup points, and delivery settings. Technical data: a session cookie for sign-in, and limited IP addresses used for rate limiting and abuse prevention. We also send transactional emails (order confirmation, pickup reminders, POP rejection, pickup changes, and password reset) and may keep related notification logs.

3. Why we process your data

We process personal information to create and manage your account, fulfil meal orders, track proof of payment between you and kitchens, send service emails and reminders, operate kitchen and customer tools, prevent abuse (including rate limits), and meet legal and bookkeeping needs. Processing is necessary to provide the MealMesh service you request.

4. Who processes your data

MealMesh (operated by MealMesh / the platform operator) processes your data to run the service. Kitchens see the order and customer details needed to fulfil meals and verify payment proof for their own customers. Email is sent via Resend. Uploaded files (such as POP documents) are stored in MinIO object storage. The application is hosted on the operator’s VPS. We do not sell your personal information.

5. How long we keep data

Account data is kept until you delete your account (or it is otherwise closed). When you delete your account, we remove or anonymise your personal identifiers. Order records and proof-of-payment files may be retained in anonymised or kitchen-facing form for kitchen bookkeeping and dispute handling. Notification logs may retain operational history with personal contact details removed where feasible.

6. Your rights

Under POPIA (and in GDPR-informed terms) you may request access to your personal information, correction of inaccurate data, deletion of your account (self-service in your profile, subject to kitchen-owner limits), and objection to certain processing where applicable. You may lodge a complaint with the Information Regulator (South Africa). To exercise rights or ask questions, contact info@mealmesh.co.za.

7. Cookies and similar technology

We use a session cookie required to keep you signed in, and we store your language preference so the site can show Afrikaans or English. With your consent (Accept on the cookie banner), we also use Google Analytics 4 cookies to understand how the site is used and improve MealMesh. You may Decline analytics cookies; essential session and language preferences still work. We do not use advertising cookies.

8. No sale of personal information

We do not sell personal information. We share data only as described above to operate MealMesh, fulfil orders with kitchens, and use essential service providers (email, file storage, hosting).

9. Contact

For privacy questions, access or correction requests, or complaints about personal information, contact the information officer at the email below.

info@mealmesh.co.za

9A. Complaint photos and health information

When you submit a complaint (for example about a defective meal, allergen issue, or illness), we may collect special personal information including photographs of the food and packaging, and health or allergy information. Under POPIA this is classified as special personal information. We use it solely to investigate and resolve your complaint, share it only with the Kitchen and the relevant authorities as necessary (such as the municipal environmental health office), and retain it only as long as needed to handle the matter and meet our bookkeeping obligations. We do not sell or market-use it.