Privacy Policy
Effective May 30, 2026
This Privacy Policy explains what information TeamLunch AI collects, how we use and share it, how we process text through our AI provider, and the choices and rights you have. We designed the Service to minimize the data we hold and to keep each team’s data isolated.
1. Scope and our role
This Privacy Policy explains how TeamLunch, Inc. (“TeamLunch,” “we,” “us”) collects, uses, discloses, and protects personal information in connection with TeamLunch AI (the “Service”).
For account, billing, and website information, we act as a controller. For the content you and your team submit into a workspace (“Customer Content”), we act as a processor (or service provider) on behalf of the workspace, which is the controller of that content. If you use the Service through an organization, that organization’s policies also apply, and requests about workspace content should be directed to your workspace administrator.
2. Information we collect
Information you provide
- Account data: your name, email address, role, and authentication details.
- Workspace and Customer Content: notes, action items, projects, team notes, meeting text, member names and roles, and similar materials you submit.
- Billing data: subscription, plan, and seat information. Payments are processed by Stripe; we do not store full payment-card numbers.
- Communications: messages you send us, such as support requests.
Information collected automatically
- Usage and log data needed to operate, secure, and improve the Service, such as feature usage, AI token usage for metering, timestamps, and limited technical information.
- Strictly-necessary cookies and local storage used for authentication and to remember your theme preference.
3. How we use information
- To provide, maintain, and secure the Service and your account.
- To provide the AI features by processing the relevant text you submit and returning generated output to you.
- To process payments, manage subscriptions and seats, and meter AI usage.
- To communicate with you about the Service, including transactional messages such as sign-in links and notifications.
- To monitor, prevent, and address security incidents, abuse, and violations of our policies.
- To comply with legal obligations and enforce our agreements.
We do not sell personal information, and we do not use Customer Content for advertising.
4. AI processing and Anthropic
When you use the AI notetaker or weekly summary, the relevant text is transmitted to our AI provider, Anthropic, to generate structured output for you. This content is not used to train Anthropic’s models. AI calls are made server-side, and AI provider credentials are never exposed to your browser. We send only the text needed to perform the requested task and apply rate limits to protect the Service.
5. Legal bases for processing (EEA/UK)
Where the EU or UK GDPR applies, we process personal information on the following bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service and prevent abuse); compliance with legal obligations; and, where required, your consent. Where we act as a processor for Customer Content, we process it under the controller’s instructions as set out in our agreement.
6. How we disclose information; subprocessors
We share personal information with service providers (subprocessors) who process it on our behalf to operate the Service, under contracts that require appropriate safeguards:
- Supabase — database, authentication, and storage.
- Anthropic — AI notetaker and summary generation.
- Stripe — payment processing (card data is handled by Stripe and does not touch our servers).
- Vercel — application hosting and delivery.
- Email provider — transactional email such as sign-in links and notifications.
We may also disclose information to comply with law or valid legal process, to protect the rights, safety, and security of TeamLunch, our users, or the public, and in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
7. International data transfers
We and our subprocessors may process information in the United States and other countries. Where we transfer personal information across borders from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent mechanisms.
8. Data retention and deletion
We retain personal information for as long as your account or workspace is active and as needed to provide the Service, then for the period necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Workspace administrators can export a workspace’s data from Settings at any time. To delete a workspace, an administrator can request deletion by contacting support@teamlunch.ai; we verify the request and complete deletion within 30 days, with deletions cascading to associated records. Residual copies may persist in backups for a limited period before being overwritten.
9. Security
We use technical and organizational measures designed to protect personal information, including encryption in transit (TLS) and at rest, per-workspace isolation enforced by row-level security, least-privilege access controls, and minimization of logging of message bodies and personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent. Under U.S. state privacy laws (such as the CCPA/CPRA), you may have rights to know, access, correct, and delete personal information and to opt out of its “sale” or “sharing”; we do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.
To exercise your rights, contact privacy@teamlunch.ai. If your information is part of a workspace, we may direct your request to the relevant workspace administrator (the controller) or act on their instructions. We may need to verify your identity before responding.
11. Cookies and tracking
We use only strictly-necessary cookies and local storage for authentication and to remember your theme preference. We do not use advertising or third-party tracking cookies, so no consent banner is required; by using the Service you consent to these strictly-necessary cookies.
12. Children’s privacy
The Service is intended for use by businesses and their personnel and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will delete it.
13. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated policy with a new effective date and, for material changes, provide additional notice where appropriate. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
14. Contact us
For privacy questions or requests, contact privacy@teamlunch.ai. For general support, contact support@teamlunch.ai.