Privacy Policy

Overview

This policy explains what personal information 100 Lunches collects, why we collect it, who we share it with, and the choices you have. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

It applies to everyone who uses the platform - visitors, guests, hosts and applicants - and should be read alongside our Terms & Conditions and Cookie Policy.

Information we collect

We collect the following, most of it directly from you:

• Account details. Your name, email address, password (stored hashed by our authentication provider), and optionally a phone number.
• Profile content. Username, headline, bio, occupation, city and country, interests, what you want out of a lunch, photos, cover image and social links. Your profile is public.
• Host application information. Your legal name, social links, and the result of an identity or background screening carried out by a third-party provider. We receive the outcome and a reference for it; we do not receive or store the underlying screening documents.
• Booking information. Lunches booked, times, whether virtual or in person, the location or meeting link you supply, the price and any offer, cancellation and no-show records, plus evidence text and photos you attach to a dispute.
• Messages and reviews. Messages exchanged with the other party to a booking, and reviews you write or receive.
• Payment and payout information. Card details are entered directly with our payments provider and never reach our servers. We store the amount, currency, status and a payment reference. For hosts we also store a payout account reference, payout country and currency, and the last four digits of the receiving bank account.
• Communication preferences. Which email categories you have enabled, and unsubscribe activity.
• Technical and usage data. IP address (stored hashed for contact-form abuse prevention), browser and device information, pages viewed, and cookie identifiers.
• Support and referral data. Messages you send us through the contact form, and referral codes, invitations you send, and who accepted them.

How we use your information

• To create and run your account and show your public profile.
• To operate bookings: matching guests and hosts, holding slots, taking payment, paying hosts, issuing refunds, and handling cancellations, no-shows and disputes.
• To assess host applications, including identity and background screening.
• To send service messages you cannot opt out of - booking confirmations, host responses, payment and payout outcomes, security and account notices - and optional emails in the categories you have enabled.
• To display reviews, completed-lunch counts and leaderboard positions built from completed bookings.
• To keep the platform safe: investigating reports, detecting fraud, spam and abuse, enforcing our terms, and moderating content.
• To provide support and respond to your enquiries.
• To improve the platform, understand how it is used, and fix problems.
• To meet legal, tax, accounting and regulatory obligations.

We do not sell your personal information, and we do not use your messages or booking content to advertise to you.

Sharing and third parties

We share personal information only where it is needed to run the platform, with service providers bound to protect it and use it only on our instructions:

• Payments and payouts provider. Processes card payments, refunds and host payouts, and carries out its own identity and anti-money-laundering checks on hosts.
• Identity and background screening provider. Verifies host applicants and returns a pass or fail result to us.
• Email delivery provider. Sends account, booking and notification emails on our behalf.
• Hosting, database and authentication providers. Store platform data and run the service.

We may also disclose information where required by law, to a court, regulator or law enforcement agency, to establish or defend a legal claim, to prevent serious harm to someone’s life, health or safety, or as part of a sale or transfer of the business (in which case this policy continues to apply to the transferred information).

What other users can see

• Public to anyone: your username, name, avatar and cover image, city and country, headline, bio, interests, photos, social links, host menu prices and availability, reviews about you, and your completed-lunch count.
• Visible to the other party to a booking: your booking messages, the meeting location or link, the price and offer, and any evidence you submit in a dispute.
• Never shown to other users: your email address, phone number, payout account details, screening results, and notification preferences.

Anything you choose to put on your public profile can be seen and copied by others. Do not include information you would not want to be public.

Overseas disclosure

Some of our service providers store or process personal information outside Australia, including in the United States, the European Union and other countries where their infrastructure operates. We take reasonable steps to ensure those providers handle your information in a way consistent with the Australian Privacy Principles.

How long we keep it

We keep personal information for as long as your account is open and for as long as we need it for the purposes above. When you delete your account we remove or de-identify your profile and personal details, but we retain:

• transaction, payment and payout records, for as long as required by tax and financial record-keeping law;
• booking, dispute and moderation records where we need them to resolve an ongoing matter, enforce our terms, or defend a legal claim;
• reviews you wrote about other people, shown without your name attached, so those hosts’ and guests’ records stay intact.

Security

We protect personal information with encrypted connections, encryption at rest with our infrastructure providers, database-level access rules that restrict each account to its own data, hashed passwords, and internal access limited to those who need it. Card details are handled by our payments provider and never stored on our systems.

No system is completely secure. If a data breach occurs that is likely to cause serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Your rights and choices

• Access and correction. Most of your information can be viewed and edited directly in your profile and settings. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it.
• Data export. You can download a copy of your account data from your settings.
• Deletion. You can request account deletion from your settings, subject to the retention rules above and to settling any open bookings, disputes or payouts.
• Email preferences. You can turn optional email categories on or off in your settings, or use the unsubscribe link in any optional email. Essential service emails about your bookings, payments and account security continue.
• Cookies. You can change your cookie choices at any time from the cookie preferences link in the footer.

We do not charge for reasonable access requests. We may need to verify your identity before acting on one, and in limited cases the law allows us to refuse - if so, we will explain why.

Cookies

We use a small number of cookies and similar browser storage, grouped into categories you control. See the Cookie Policy for the full list and the preferences dialog.

Children

100 Lunches is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

Changes to this policy

We update this policy as the platform changes. Material changes are published here with a new date, and where the change affects how we use your information we will ask you to review and accept the updated version.

Contact and complaints

For any privacy question, request or complaint, email support@100lunches.com or use the contact page. We aim to acknowledge privacy complaints within 7 days and respond substantively within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.