Last updated: August 2026 · Effective: August 2026
Petit Lunch Inc. ("Petit Lunch", "we", "our") operates the Petit Lunch school portal at school.petitlunch.com. We process personal information — including student information on behalf of your school — in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy and education legislation.
Privacy inquiries: contact@petitlunch.com
For student data, Petit Lunch acts as a service provider to your school, not an independent data controller. Your school remains responsible for the accuracy of student records and for obtaining any parent/guardian consent required under its own board policies and applicable provincial education privacy legislation. We process student data only as instructed by your school, for the purposes described below.
| Category | Examples | Purpose |
|---|---|---|
| School staff accounts | Name, email address, role (manager, staff, kitchen) | Account access and administration |
| Student roster data | Student name, grade/class, guardian contact information | Meal ordering, delivery confirmation, and subsidy administration |
| Allergen and dietary data | Allergies, dietary restrictions, hardship-override flags | Safety-critical filtering of meal options and vendor communication |
| Meal order and delivery data | Order contents, QR check-in scans, delivery confirmations | Daily meal distribution tracking and compliance reporting |
| Subsidy and funding data | Program eligibility, provincial/federal funding source | NSFP and provincial program compliance reporting |
| Usage data | Pages visited, device type, IP address | Platform security and performance |
We do not sell personal information. We share information only as follows:
Vendors
Allergen data, dietary restrictions, and order details necessary to prepare and deliver a specific meal safely — vendors do not receive full student records.
Parents/guardians
Order status and delivery confirmation for their own child, via the parent-facing app.
Government / funding bodies
De-identified or aggregate participation and compliance data may be shared as required by NSFP or provincial program reporting obligations.
AWS (cloud infrastructure)
All data is stored on AWS ca-central-1 servers in Canada under our data processing agreement with AWS.
Legal requirements
We may disclose information if required by law, court order, or regulatory authority.
All data, including student records, is stored in Canada (AWS ca-central-1). We use HTTPS/TLS for all data in transit, BCrypt password hashing, and HTTP-only session cookies. Access to student data is restricted to authorized school staff at your school and authorized Petit Lunch staff on a need-to-know basis.
Parents/guardians seeking to access, correct, or request deletion of their child's information should contact their school directly, as the school controls the underlying student record. School staff can contact contact@petitlunch.com for platform-level requests. We respond within 30 days.
Student roster and order data is retained for the duration of the school's use of the platform, plus 90 days after account closure, unless a longer period is required for NSFP or provincial program record-keeping obligations.
We will notify registered schools by email at least 14 days before any material change. Continued use of the platform constitutes acceptance.
Contact our Privacy Officer
Petit Lunch Inc. · contact@petitlunch.com