Privacy policy

PrepRail provides software to independent kitchens. Your kitchen uses customer information to manage its orders and fulfillment. PrepRail uses information to operate accounts, payments, support and security, and processes kitchen information to provide the service. Use the privacy contact on our Contact page for questions about PrepRail privacy practices and your kitchen about its own use of your information.

Account information includes your name, email and securely hashed password. Ordering information includes kitchen memberships, plan terms, meal choices, favorites and ratings, contact details, delivery addresses and instructions, payment references, consent records and order history. Kitchens may provide customer information through invitations or imports. We also process technical information, product events, security and error logs, and information you provide to support.

Use delivery notes for delivery instructions only. Do not add medical information or rely on these notes to prevent an allergic reaction. Contact your kitchen before ordering if you need allergy or dietary accommodations. Information you provide in notes may appear in kitchen fulfillment lists and order records.

Stripe receives card details directly. PrepRail stores Stripe references and masked card details, not your full card number. One saved card can be used across kitchens you join. Saving a card alone does not authorize automatic meal selection. Confirmed orders charge at cutoff; automatic weekly orders require separate permission in Account. Authorized failed payments may be retried on the disclosed schedule.

Our infrastructure includes Supabase for database, storage and sign-in; Vercel for hosting; Stripe for payments; Resend for email; Upstash for jobs and rate limiting; Cloudflare Turnstile for bot protection; and Sentry for error monitoring. Providers receive the information needed for the configured feature. Data may be processed in the United States and other countries where these providers operate.

When you submit an address for a delivery-area lookup, the address is sent to the US Census geocoding service. Opening external map links or using map features can involve the relevant map provider. Your kitchen receives information needed to serve you. Authorized support personnel may access information to resolve issues. We may also disclose information when required by law or to protect rights and security.

Essential cookies support sign-in. The app also uses device storage for functions such as retaining an unfinished meal selection and your preferences. PrepRail does not load third-party analytics or advertising scripts on any host, and does not store an analytics identifier on your device.

PrepRail records first-party operational and product events on its own servers: for example a marketing page view, a button press on the marketing site, a completed step in kitchen setup, or an order a customer saved. When a signup arrives from a marketing link, the event notes which page or campaign link led to it. These records carry no device identifier, are not shared with an analytics provider, and do not include session recordings or the contents of forms. Essential security and error monitoring, including page-load performance measurements sent to Sentry, remain active. We do not use this information for advertising targeting.

We send order, payment, consent and account messages needed to operate the service. Kitchens may also send menu announcements and ordering reminders. Use Manage emails in customer messages to turn off optional menu announcements and pick reminders. A requested one-menu alert has its own cancellation link. Muting optional messages does not cancel an order or automatic weekly orders.

How to request your data or close your account

We retain information for providing the service, resolving disputes and meeting applicable recordkeeping obligations. Some payment and authorization evidence must remain after a membership ends. A deletion request is reviewed by record category; retaining a receipt does not require retaining every delivery instruction indefinitely.

Use the privacy-request contact on our Contact page to request access, a copy, correction or deletion of your information, or to raise a privacy concern. We verify identity proportionately and coordinate with your kitchen where appropriate. Applicable rights, exceptions and response periods depend on your location and the laws that apply. We will explain any information retained in response to a deletion request. Do not email full card numbers or identity documents unless a secure verification process specifically requires them.

Updates are dated here. Material changes that require notice or a new choice will be communicated through the service or email, as applicable.