This Privacy Policy explains how amealio collects, uses, shares and protects personal information when you use our website, mobile apps, messaging channels and merchant tools in the United States. It is written to meet the California Consumer Privacy Act as amended by the CPRA, and comparable state privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states.
1. Who we are
amealio is the business, or controller, for personal information collected through the amealio consumer and merchant products in the United States. You can reach us at hello@amealio.com and our privacy team at privacy@amealio.com.
2. Personal information we collect
- Identifiers: name, mobile number, email address and profile photo.
- Preferences: dietary, cuisine, allergy, celebration and lifestyle preferences.
- Commercial information: orders, reservations, celebration bookings, receipts and refunds.
- Payment information: tokenized payment identifiers handled by our PCI DSS certified processor. We do not store full card numbers.
- Device and internet activity: IP address, device model, operating system, app version, cookies, pages viewed and interactions.
- Geolocation: approximate location for discovery and precise location, only with your permission, for delivery and reservations.
- Audio, visual and similar information: photos and videos you capture or upload through Memory Wall, Smart Mirror and reviews.
- Merchant information: restaurant profile, menu, inventory, staff and order data needed to run the service.
3. How we use personal information
- To create and secure your account and sign you in.
- To operate discovery, reservations, ordering, delivery, catering, celebrations and loyalty features.
- To personalize menus, recommendations and celebration ideas using your Taste Profile.
- To process payments and refunds and issue receipts with itemized sales tax.
- To send transactional messages and, where you have opted in, marketing communications.
- To prevent fraud, protect safety, enforce our Terms and comply with legal obligations.
- To improve our services and to train and evaluate models on de-identified or aggregated data.
4. Sale, sharing and targeted advertising
We do not sell personal information for money, and we do not sell or share the personal information of consumers under 16. We may share limited identifiers and internet activity with advertising partners for cross context behavioral advertising, which some state laws treat as a sale or share. You can opt out at any time in Settings or by enabling a Global Privacy Control signal in your browser, which we honor automatically.
5. Who we disclose information to
- Partner restaurants, only as needed to deliver your reservation, order or celebration.
- Delivery partners such as DoorDash Drive and Uber Direct for fulfillment.
- Payment processors and financial institutions for payments, refunds and chargebacks.
- Cloud, analytics and communication providers acting as service providers under contract.
- Law enforcement or government authorities in response to a valid legal request.
- A successor entity in a merger, acquisition or reorganization, subject to equivalent protections.
6. Where information is processed
Personal information is processed on servers located in the United States. If we transfer information internationally to a service provider, we apply contractual safeguards that require an equivalent level of protection.
7. Data retention
We keep personal information only as long as needed for the purpose it was collected or as required by tax, accounting and other legal obligations. Transaction records are generally retained for seven years and are then deleted or de-identified.
8. Your privacy rights
Depending on your state, you have the right to:
- Know what personal information we collect, use, disclose and share.
- Access a portable copy of your personal information.
- Correct inaccurate personal information.
- Delete personal information, subject to legal retention exceptions.
- Opt out of sale, sharing and targeted advertising, including by Global Privacy Control.
- Limit the use of sensitive personal information, such as precise geolocation.
- Be free from retaliation or discriminatory service or pricing for exercising these rights.
- To exercise these rights, use Settings, email privacy@amealio.com, or call +1 (888) 263-2546. We verify requests and respond within 45 days, with one 45 day extension where permitted. An authorized agent may submit a request with written permission.
9. Children
amealio is intended for adults 18 and over. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act. If you believe a child provided information, email privacy@amealio.com and we will delete it.
10. Security
We follow a written information security program aligned to the NIST Cybersecurity Framework and SOC 2 controls, including encryption in transit and at rest, role based access, audit logging, secure development and periodic testing. No system is perfectly secure, and you are responsible for keeping your credentials confidential. If a breach affects your information, we notify you as required by your state's breach notification law.
11. Cookies and analytics
We use cookies and similar technologies for authentication, preferences and analytics. You can manage cookies in your browser settings and manage advertising preferences in Settings. We honor browser based opt out signals such as Global Privacy Control.
12. Contact our privacy team
- Privacy Team, amealio
- Email: privacy@amealio.com
- Phone and text: +1 (888) 263-2546
- Californians may appeal a denied request by replying to our decision, and may contact the California Privacy Protection Agency or their state attorney general.
13. Changes to this Policy
We will post material changes in the app or email you at least 30 days before they take effect. Continued use of amealio after the effective date means you accept the updated Policy.