Privacy Policy

This Privacy Policy explains how Pan & Plates, Inc. (“Pan & Plates,” “we,” “us”) collects, uses, shares, and protects personal information when you use panandplates.com, the Pan & Plates iOS and Android apps, and related services (together, the “Service”). We built Pan & Plates to help you prep five weekday meals in under an hour—not to monetize your data. We don’t sell personal information, and we don’t share it for cross-context behavioral advertising.

Who we are

Pan & Plates, Inc. is a Delaware corporation located at 2261 Market Street #5182, San Francisco, CA 94114, USA. For purposes of the EU and UK General Data Protection Regulation (“GDPR”), Pan & Plates is the controller of the personal data described in this policy. Questions about privacy can be sent to privacy@panandplates.com.

Information we collect

Information you give us

• Sign-up details: your name, email address, main goal (build muscle, fat loss, feeding a family, or saving time), the plan you chose, and a timestamp recording your consent.
• Account and profile data: password (stored hashed), household profiles on Family plans, and your preferences and saved recipes.
• Health-adjacent data (optional): height, weight, activity level, macro targets, dietary preferences, and allergy filters. We treat this as sensitive data—see “Sensitive data” below.
• Payment information: handled directly by Stripe. We receive limited details such as card brand, last four digits, expiration date, and billing country; we never see or store your full card number.
• Communications: messages you send us by email or through in-app support chat, plus any photos you choose to submit.

Information collected automatically

• Usage and device data: pages and features used, videos watched, app version, device type, operating system, IP address, and log data needed to run and secure the Service.
• Analytics: if you choose “Accept all” in our cookie notice, we use Plausible Analytics to count aggregate visits. Plausible doesn’t use cookies or build individual profiles.
• Cookies and local storage: described in our Cookie Policy.

Sensitive data

Height, weight, activity level, macro targets, dietary preferences, and allergy filters can reveal information about your health. We only collect and process this data with your explicit consent, and only to personalize your menus, portions, and nutrition plans. It is never used for advertising. You can edit or delete any of it at any time in your account settings, and you can withdraw consent without affecting the rest of your account—you’ll simply get non-personalized plans.

How we use your information

• To create and manage your account and deliver weekly menus, shopping lists, nutrition plans, masterclasses, and the cook-along timer.
• To personalize recipes and portions to your goal, household, and dietary filters.
• To process payments, start and end free trials, send renewal reminders, and handle refunds.
• To provide customer support and respond to your requests.
• To send service emails (receipts, security alerts, policy changes) and, if you opt in, product news and tips. You can unsubscribe from marketing at any time.
• To understand aggregate usage and improve the Service.
• To detect and prevent fraud, abuse, and security incidents, and to comply with legal obligations.

Legal bases for processing (EU/UK)

If GDPR applies to you, we rely on the following legal bases:

• Contract: to provide the Service you signed up for, including billing and support.
• Explicit consent: for health-adjacent data, optional analytics, and marketing emails. You may withdraw consent at any time.
• Legitimate interests: to secure the Service, prevent fraud, and improve features, balanced against your rights.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.

How we share information

We share personal information only with service providers that process it on our behalf under written contracts, and only as needed to run the Service:

• Stripe — payment processing and fraud prevention.
• Postmark — transactional and account email delivery.
• Mux — video streaming for masterclasses.
• Amazon Web Services — hosting and storage (us-west-2 region, Oregon, USA).
• Plausible Analytics — privacy-friendly, cookieless analytics, only if you accept “all” in our cookie notice.
• Intercom — customer support chat.

If you subscribe through the Apple App Store or Google Play, those companies process your payment under their own privacy policies. We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data. We do not sell personal information and do not “share” it for cross-context behavioral advertising as those terms are defined under California law.

Cookies and similar technologies

We use a small number of essential cookies to keep you signed in and to protect checkout, and optional technologies only if you choose “Accept all.” Your choice is stored in your browser for 12 months. Full details, including a list of every cookie we use, are in our Cookie Policy.

Data retention

• Account data: kept while your account is active and for 24 months after it becomes inactive or is closed, unless you ask us to delete it sooner.
• Billing records: kept for 7 years to meet tax and accounting obligations.
• Sign-up leads (people who start sign-up but never activate an account): deleted after 18 months of inactivity.
• Health-adjacent data: deleted promptly when you remove it or withdraw consent.

When retention periods end, we delete or irreversibly anonymize the data.

International data transfers

Pan & Plates is based in the United States, and our primary hosting is in the U.S. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. For transfers from the EU, EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with supplementary safeguards.

Security

We protect your data with encryption in transit (TLS) and at rest, hashed passwords, role-based access controls with least-privilege permissions, multi-factor authentication for staff, logging and monitoring, and vendor security reviews. No system is perfectly secure, so we can’t guarantee absolute security, but if a breach affects your personal information we will notify you and regulators as required by law.

Your privacy rights

Everyone

You can view and update most of your information in your account, delete health-adjacent fields at any time, unsubscribe from marketing emails, and delete your account by contacting us.

EU and UK residents

Under GDPR and UK GDPR you have the right to access, correct, delete, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority. For any request, contact us directly at privacy@panandplates.com.

California and other U.S. states

Under the CCPA/CPRA and similar laws in states such as Colorado, Connecticut, Virginia, Utah, and Texas, you may have the right to know what personal information we collect and how we use it, to access and correct it, to delete it, and to opt out of the sale or sharing of personal information and of targeted advertising. Because we don’t sell or share personal information, there is nothing to opt out of—but you may still contact us to confirm. Where required, you may limit our use of sensitive personal information; we already use it only to provide the Service. We will not discriminate against you for exercising these rights. You may use an authorized agent, and you can appeal a denied request by replying to our decision.

How we respond

We’ll verify your identity, usually by confirming control of your account email, and respond within 30 days (45 days for CCPA requests, extendable where permitted by law—we’ll tell you if we need more time).

Children’s privacy

The Service is intended for people 16 and older. Account holders on Family plans may create household profiles for minors; those profiles are created and controlled by the account holder, who is responsible for the information added. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided us information, contact privacy@panandplates.com and we will delete it.

Changes to this policy

We may update this policy as the Service or the law changes. If we make material changes, we’ll notify you by email or in the app before they take effect. The date at the top of this page shows when it was last revised.

Contact us

Pan & Plates, Inc.
2261 Market Street #5182
San Francisco, CA 94114, USA

Privacy questions and requests: privacy@panandplates.com. General support: support@panandplates.com.