Privacy Policy
Effective 2026-09-15
CaliMeal ("the Service") collects only the minimum personal information required to operate, and deletes it without delay once its purpose is fulfilled.
What we collect
- Account — email address, the user identifier issued by our authentication provider (Google Identity Platform), and the sign-up timestamp. Passwords are held by the authentication provider and are never stored by the Service.
- Invitations — the email address an administrator enters to invite a colleague, the role granted, and the expiry time. The invitation token is stored only as a hash; the original cannot be reconstructed.
- Payments — payment identifier, amount, status, and billing period. Card numbers and other payment credentials are held by the payment provider and are never stored on our servers.
- Send-suppression list — if a message bounces or a recipient reports it as spam, we store that address and the reason so we do not send to it again.
- Website visits — when you visit our introduction site (calimeal.com), Google Analytics uses cookies to collect the pages viewed, visit time, browser and device type, approximate location (country and city), and referral source. This is not used to identify you, and it is not collected in the service app (portal.calimeal.com).
Meal plans, menu names, and cafeteria settings created while using the Service do not identify individuals.
Why we use it
- Providing the service, including sign-in and permission checks
- Organization invitations and member management
- Billing for paid plans
- Handling bounces and unsubscribe requests (blocking further delivery)
- Analyzing visits to the introduction site
We do not use personal information for advertising. Every message the Service sends results from an action a user took.
Retention
| Data | Period |
|---|---|
| Account | Until the member withdraws or the organization is deleted |
| Invitation records | One year after acceptance or expiry |
| Payment records | Five years after paid service begins, as required by Korean e-commerce law |
| Send-suppression list | Until deletion is requested, to protect sending reputation |
| Website visits | Two months after collection (Google Analytics data retention) |
Processors
| Processor | Purpose |
|---|---|
| Amazon Web Services | Servers, database, outbound email (Seoul region, South Korea) |
| Google Cloud (Identity Platform) | Sign-in authentication |
| Google Cloud (Vertex AI) | Meal-plan generation, translation, search |
| PortOne | Payment processing |
| Cloudflare | Domain and inbound email routing |
| Google LLC (Google Analytics) | Visit analytics for the introduction site |
Transfers outside Korea — some processors may operate servers outside South Korea. The Vertex AI endpoint used for generation is not region-pinned, so processing may occur outside Korea; the data sent there is limited to meal-plan content such as menu names. Account information is not sent.
Website visit data collected by Google Analytics is transmitted over the network to servers of Google LLC (United States) at the time of your visit and processed for the retention period above. You can refuse this transfer as described in the cookies section below.
Cookies
Our introduction site (calimeal.com) uses Google Analytics cookies to analyze visits. Storage the service app needs to keep you signed in is not used for this purpose.
- You can block or delete cookies in your browser settings
- You can opt out with the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout)
Refusing cookies does not limit your use of the introduction site or the Service.
Sharing with third parties
We do not provide personal information to third parties, except where required by law.
Your rights
You may request access, correction, deletion, or suspension of processing of your personal information at any time. Requests to delete your account and data are received at support@calimeal.com; we act without delay and reply with the outcome.
Safeguards
- Data belonging to different organizations is isolated by row-level access control in the database
- Invitation tokens are stored only as hashes
- All traffic is encrypted with TLS
- Operational secrets are kept in a separate store and are not committed to the source repository
Contact
- Operator — CaliMeal Operator
- Data protection officer — CaliMeal Operator
- Contact — support@calimeal.com
CaliMeal is currently operated by an individual and is not a registered business entity. When paid service begins, business registration details will be added here and announced with an effective date.
Changes
Any change to this policy will be posted on this page together with its effective date.