Privacy Policy

We have designated a person responsible for our compliance with privacy law. You can contact our Privacy Officer about this policy, your personal information, or a privacy concern:

Privacy Officer: Cathy Wang · cathy.wang@fitboxmeal.ca

We collect the following categories of personal information, directly from you when you create an account, place an order, or contact us:

• Identity and contact information: name, email address, phone number, and delivery address.
• Order and account information: your plan, order history, delivery preferences and instructions, and communications with us.
• Payment information: processed by our payment processor. We do not store full card numbers on our own systems; our processor handles card data.
• Dietary and health information: dietary preferences, allergies, and similar information you choose to provide so we can prepare and flag suitable meals.

Sensitive information

Dietary, allergy, and health-related information may be considered sensitive personal information under Canadian privacy law (including Quebec Law 25). We collect such information only to provide the Service, request it only where relevant, and rely on your express consent — provided at the time you supply it — to collect and use it for that purpose. You may decline to provide this information, although doing so may limit our ability to accommodate dietary requirements.

We use your personal information to:

• create and manage your account and subscription;
• prepare, process, charge for, and deliver your orders, and accommodate dietary or allergy needs;
• communicate with you about orders, billing, renewals, skips, changes, and support;
• operate, secure, maintain, and improve the Service;
• send marketing or promotional messages where you have consented (you can opt out at any time);
• measure and improve our website and advertising (see Cookies and tracking below); and
• comply with legal, tax, and regulatory obligations.

We will not use your information for a materially new purpose without obtaining your consent, except where permitted or required by law.

We collect, use, and disclose your personal information with your consent, which may be express or implied depending on the sensitivity of the information and the circumstances. For sensitive information (such as health/dietary data) and for marketing, we rely on your express consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice — note that withdrawing certain consents may mean we can no longer provide part or all of the Service. To withdraw consent, contact our Privacy Officer.

We share personal information with trusted service providers who process it on our behalf, only as needed to provide the Service, and under contracts requiring them to protect it. These include:

• Payment processing — Stripe.
• Website hosting and infrastructure — Railway.
• File and image uploads — Uploadthing.
• Email and customer communications — Resend.
• Business and productivity tools — Google (Google Workspace).
• Analytics — Google Analytics and the Meta (Facebook) Pixel.
• Advertising and remarketing — Google Ads and Meta (Facebook).
• Delivery — our third-party delivery couriers, Fleet and Nimbus, who receive your name, address, and phone number to complete delivery.

We do not sell your personal information. We may also disclose personal information where required by law, to enforce our Terms, to protect our rights or the safety of others, or in connection with a business transaction (such as a merger or sale), in which case we will require the recipient to protect it.

Several of our service providers (including those listed above) are located in, or store and process data in, the United States and potentially other countries. This means your personal information may be stored or processed outside Canada and may be subject to the laws of those jurisdictions, including lawful access by foreign authorities. We take reasonable steps, including contractual protections, to ensure your information receives a comparable level of protection. By using the Service, you acknowledge this transfer. You may contact our Privacy Officer for more information about where your data is processed.

Our website uses cookies and similar technologies, including Google Analytics, the Meta (Facebook) Pixel, and Google Ads tags, to operate the site, understand how it is used, and measure and deliver advertising (including remarketing to people who have visited our site). These technologies may collect device, usage, and identifier information and share it with Google and Meta. Where required, we will ask for your consent to non-essential cookies and provide a way to manage your preferences. You can also control cookies through your browser settings and opt out of certain advertising through Google's and Meta's ad-settings tools.

We retain your personal information for as long as your account is active and for as long as necessary to provide the Service. Thereafter, we retain it only to the extent necessary to meet our legal, tax, accounting, and regulatory obligations, to resolve disputes, and to enforce our agreements. You may request deletion of your personal information at any time (see the section on your rights below), and we will comply unless we are required or permitted by law to retain it.

We use reasonable physical, technical, and organizational safeguards appropriate to the sensitivity of the information to protect it against loss, theft, and unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to those who need it.

If a breach of security safeguards involving your personal information occurs that creates a real risk of significant harm, we will notify you and the appropriate authorities (the Office of the Privacy Commissioner of Canada, and Quebec's Commission d'accès à l'information where applicable) as required by law, and keep records of breaches as required.

Subject to applicable law, you have the right to:

• access the personal information we hold about you and ask how it is used and disclosed;
• request correction of inaccurate or incomplete information;
• withdraw consent, subject to legal or contractual limits;
• request deletion of your personal information, and (for Quebec residents) request de-indexing or that we stop disseminating it, where the law allows; and
• request a copy of the computerized personal information you provided to us, in a structured, commonly used technological format (data portability, for Quebec residents).

To exercise any of these rights, contact our Privacy Officer at cathy.wang@fitboxmeal.ca. We will respond within the timeframes required by law. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, or, if you are in Quebec, to the Commission d'accès à l'information.

The Service is intended to be purchased by adults (the age of majority in their province) or by a parent or guardian on a household's behalf. We do not knowingly collect personal information directly from children without the consent of a parent or guardian. If you believe we have collected a child's information without appropriate consent, contact our Privacy Officer and we will take appropriate steps.

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, take reasonable steps to notify you. Your continued use of the Service after changes take effect means you accept the updated policy.

For any privacy question or request, contact our Privacy Officer, Cathy Wang, at cathy.wang@fitboxmeal.ca.