Privacy

Accounts carry an email address, a name, and a password (stored hashed, never in plain text). Kitchens add the data they need to run their week: menus, prices, client names and contact details, delivery addresses and notes, and order history. Clients see only their own orders; each kitchen sees only its own clients.

Card payments are processed by Stripe. Your card number goes directly to Stripe and never touches PrepRail’s servers — we store only a reference to the saved card (like its last four digits) so you can recognize it. Charges happen on the kitchen’s own Stripe account at the weekly cutoff, exactly as shown when you confirmed your picks.

We send transactional email only: pick confirmations, reminders before picks close, receipts, and account messages like password resets. Delivery runs through an email provider that processes the address and message content on our behalf. No marketing lists, no selling addresses.

Cookies are used for one thing: keeping you signed in. There is no advertising tracking and no third-party analytics scripts. We record first-party product events (like “a menu was published”) to understand how the product is used.

Every kitchen’s data is scoped to that kitchen, enforced at the database level. Operators cannot see other kitchens’ clients, menus, or orders. If you order from several kitchens with one login, each kitchen still sees only its own relationship with you.

We use a small set of service providers, each processing only what it needs: Stripe (card payments), Supabase (database and sign-in hosting), Resend (transactional email delivery), and Vercel (application hosting). We don’t sell personal data to anyone.

Account data is kept while your account exists. Records of completed, paid orders are retained so kitchens have accurate books and clients have accurate receipts.

You can request a copy of your data, or its deletion, by emailing legal@preprail.com from your account’s email address. If you are a California resident, this covers your access and deletion rights under the CCPA. Order history a kitchen must keep for its own records (like receipts for paid orders) may be retained as required.

If this policy changes materially, the date at the top of this page changes with it.