Privacy Policy
Effective date: July 25, 2026
H2O Catering ("H2O," "we," "us") provides this meal-ordering service for schools and organizations we cater for. This policy explains what information we collect, why we collect it, and how we handle it. We keep it simple on purpose: we collect only what we need to prepare and deliver your meals, and we never sell your information or share it for advertising.
Information we collect
- Your account: your name, email address, phone number, and a password (stored in encrypted form — we cannot see it).
- Your children: the name, school, classroom, and teacher of each child you add, plus any allergy or dietary notes you choose to provide.
- Your orders: what you ordered, for whom, for which day, and your payment and account-credit history.
- Support messages: anything you send us through the Help page.
- Payments: handled entirely by Stripe, our payment processor. Your card number goes directly to Stripe — we never receive or store it.
- Cookies: we use only the cookies needed to keep you signed in. No advertising or tracking cookies.
How we use it
- Preparing and delivering meals — including kitchen production lists and meal labels that show your child's name, classroom, and allergy notes so the right meal reaches the right child safely.
- Running your account — order confirmations, payment receipts, password resets, and replies to your support requests.
- Keeping the service safe — preventing fraud, abuse, and errors.
Who can see it
Only the people and services needed to get meals made and delivered:
- Our staff — kitchen and administrative team members see order details, including allergy notes, so meals are prepared correctly.
- Your school — we may confirm enrollment details, such as a classroom assignment, with the school your child attends.
- Service providers — the companies that run our infrastructure: Supabase (secure database hosting), Vercel (website hosting), Stripe (payment processing), and the messaging/email services we use to deliver notifications. They process data on our behalf and are not permitted to use it for their own purposes.
- Legal requirements — if the law requires us to disclose information, we will.
Children's privacy
Accounts are for parents, guardians, and adult customers — not for children. All information about children is provided to us by a parent or guardian. We do not knowingly collect information directly from children under 13, and children never interact with our service.
How long we keep it
We keep your information while your account is active, and order records for as long as reasonably needed for accounting and tax purposes. If you'd like your account and personal information deleted, email us and we'll take care of it.
Security
All data is encrypted in transit, stored in an access-controlled database with strict per-organization isolation, and payment details never touch our servers. No system is perfectly secure, but we take reasonable measures appropriate to the data we hold.
Your choices
You can view and update your information anytime from your account (Profile and My children pages). You can also ask us for a copy of your data, ask us to correct it, or ask us to delete it — Virginia residents have these rights under state law, and we extend them to all our customers. Just email us.
Changes & contact
If we make meaningful changes to this policy, we'll update the date above and let you know through the service. Questions or requests: info@h2ocatering.com.