1. Who We Are

Petit Lunch Inc. ("Petit Lunch", "we", "our") operates the Petit Lunch vendor portal at vendor.petitlunch.com. We process personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Privacy inquiries: contact@petitlunch.com

2. Information We Collect

Category	Examples	Purpose
Business information	Business name, address, GST/HST number	Vendor onboarding and tax compliance
Contact information	Name, email address, phone number	Account management and communications
Banking / payout	Stripe Connected Account details (managed by Stripe)	Processing payouts — Petit Lunch does not store bank account numbers
Menu and product data	Meal names, ingredients, allergens, photos, prices	Displaying menus to parents and generating compliance reports
Order data	Order contents, quantities, fulfilment status	Order management, NSFP reporting, and payout calculation
Usage data	Pages visited, device type, IP address	Platform security and performance

3. How We Use Your Information

Process orders placed by parents and schools through the platform
Calculate and disburse payouts via Stripe Connect (8% platform commission deducted)
Generate NSFP (National School Food Program) compliance reports
Provide real-time order management and kitchen display tools
Verify GST/HST-exempt status for school meal sales
Send order notifications, payout confirmations, and platform updates
Comply with CRA record-keeping requirements for 7 years

4. Sharing Your Information

We do not sell your personal information. We share information only as follows:

Schools and parents

Order status, meal details, and allergen information are shared with the school and ordering parent for delivery verification and safety purposes.

Stripe (payment processing)

Payout and bank account information is managed by Stripe under their Privacy Policy. Petit Lunch does not store bank account details.

AWS (cloud infrastructure)

All data is stored on AWS ca-central-1 servers in Canada under our data processing agreement with AWS.

CRA / tax authorities

We may share transaction data as required by the Canada Revenue Agency for GST/HST reporting compliance.

Legal requirements

We may disclose information if required by law, court order, or regulatory authority.

5. Data Residency and Security

All data is stored in Canada (AWS ca-central-1). We use HTTPS/TLS for all data in transit, BCrypt password hashing, and HTTP-only session cookies. Access to vendor data is restricted to authorized Petit Lunch staff on a need-to-know basis.

6. Your Rights (PIPEDA)

Under PIPEDA, you have the right to access, correct, or request deletion of your personal information. To exercise these rights, contact contact@petitlunch.com. We respond within 30 days.

7. Retention

Vendor account and transaction data is retained for 7 years to comply with CRA record-keeping requirements. Menu and product data is retained for the duration of the vendor relationship plus 90 days after account closure.

8. Changes to This Policy

We will notify registered vendors by email at least 14 days before any material change. Continued use of the platform constitutes acceptance.

Contact our Privacy Officer

Petit Lunch Inc. · contact@petitlunch.com