Privacy Policy

Who Is Responsible

Masala Meats & Grill (1489 Merivale Rd, Unit B, Ottawa, ON K2E 5P3) is the business collecting and responsible for your personal information from 12 October 2026. NutriBox is the name it sells under.

The privacy officer at Masala Meats & Grill is accountable for how we handle personal information and answers every privacy question, access request and complaint.

What We Collect

We collect what an order needs, and we ask for each thing when it is needed:

• Your first and last name, your email address (verified with a one-time code) and your phone number.
• Your birthday, month and day only, used for birthday offers.
• Your delivery address and postal code, and any delivery notes you give us.
• Your agreement to our allergen statement, with its wording and the time you gave it.
• If you join our waitlist, by our form or our Google Form: your name, email address, phone number, your answers and the access code we send you.
• The plan and diet you choose.
• A dietary flag, if you give one. It is used only to flag your box for the kitchen and to leave out the Chef's Surprise, and only our kitchen staff and administrators see it.
• Your agreement to this policy and the terms, and your marketing choice, each with the time you gave it.
• Every postal code entered at the delivery check, whether or not you go on to order. We use these to see where people want delivery.
• A photograph of each delivery, taken by our driver as a record that it arrived.
• Payment details, handled entirely by Stripe. We never see or store your card number; we keep a Stripe customer reference.
• Site use: first-party page views (the page, the referrer and a random visit id), kept only if you allow analytics in the cookie banner. The Meta Pixel, which measures whether our ads led to a visit, loads only if you accept marketing cookies; with that consent our server also tells Meta which page you visited, with your IP address and browser.
• What you send through the contact form: your email address, the topic and the message.

Where It Is Stored

Your information is stored on infrastructure that may be outside Canada (Supabase and Cloudflare in the United States and Canada, Stripe, Resend, Twilio and Meta in the United States).

How We Use It

To run your order: cook and pack the right box, deliver it, take payment, and send the emails an order needs, such as your sign-in codes, your order confirmation and your cancellation confirmation. Optional updates, such as tomorrow's menu, stay off until you switch them on in your account.

We send one renewal reminder by email before each renewal, and, once our text messaging is switched on, the same reminder as a text or WhatsApp message to the phone number on your account.

To keep your leaves ledger. There is no referral programme yet: the nb_ref cookie remembers the referral link you arrived through, for attribution only during the pilot.

We send marketing email or SMS only if you ticked the box for it. Every marketing message identifies us, carries our mailing address and has a working unsubscribe link, as Canada's Anti-Spam Legislation (CASL) requires.

To answer your messages, and to meet our legal and tax obligations.

Who Sees It

We do not sell personal information. The people and services that handle it are:

• Masala Meats & Grill kitchen and delivery staff, who see names, addresses, dietary flags and delivery notes for the day's boxes.
• Stripe (payments and card storage).
• Supabase (database and sign-in) and Cloudflare (hosting and bot protection).
• Resend (email delivery).
• Twilio and WhatsApp (text and WhatsApp messages: your order confirmation, your renewal reminder, delivery updates you switch on and, if you joined our waitlist, your access code).
• Meta Platforms (advertising measurement), only if you accept marketing cookies.
• Authorities, when the law requires it.

Cookies

We use a handful of first-party cookies and browser storage, and advertising cookies only with your consent:

• A session cookie that keeps you signed in.
• nb_consent (stored in your browser): remembers the choice you made in the cookie banner. You can change it at any time.
• nb_start (stored in your browser): remembers the answers you have given while ordering, so a refresh does not lose them.
• nb_td (30 days): remembers a device you chose to trust, so you are not asked for a code every time.
• nb_ref (30 days): remembers the referral link you arrived through, for attribution only during the pilot.
• A random visit id, kept only if you allow analytics in the cookie banner, used only for our own page-view counts.
• Meta's cookies, only if you accept marketing cookies: they measure whether our ads led to a visit or an order.

How Long We Keep It

Order, payment and delivery records are kept for seven years for tax purposes. Delivery photographs are kept for 90 days. Contact-form messages are kept for twelve months, then deleted. Your leaves ledger is kept while your account exists.

When you delete your account, we revoke your sessions, detach your payment details from Stripe and, 30 days later, anonymize your name, phone, address, notes and birthday. Records we must keep by law are kept in anonymized form.

Your Rights

You can see and correct most of what we hold from your account. You can withdraw marketing consent at any time with the unsubscribe link or in your profile. You can ask us for a copy of your personal information or ask us to correct it, and you can delete your account from the profile page. We answer access requests within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Contact

Privacy questions go to the privacy officer at Masala Meats & Grill, reachable through the Contact page or by mail at 1489 Merivale Rd, Unit B, Ottawa, ON K2E 5P3. We will tell you about material changes to this policy by email.