Privacy

What I collect

• Buying a slot. Your company name, a link, the one thing you want promoted, your email, a mobile number (optional), and a logo if you upload one. This is what appears on the board and in the Sold email to me. It is never a secret between you and the site.
• Booking a session. The office address, who to ask for, and whether your team is preparing the lunch. I ask so that I and any crew can turn up at the right place. This goes into a private booking link that only you and I can see. Where connected, it also goes into a single event on my Google Calendar for that session. It never appears on the board.
• Paying for No. 20 (the Finale). The same as buying a slot. No. 20 never goes through the booking form, so the office address, who to ask for and a mobile number go on the winner's own page instead, so I can arrange the lunch. They are private in the same way: only you and I can see them, and they never appear on the site.
• Payment. A card payment is handled entirely by my payment processor, Airwallex. I never see or store your card, bank or wallet details. All I see and store is that a payment succeeded, its amount, and an internal reference I use to reconcile it. If you pay by bank transfer instead, the money goes to the bank account named on the payment page, and my bank's statement shows what your bank sends with it: your name or company, the amount and the reference. I keep the reference to match it to your order.
• The petition wall and offers. A petition submission or a Finale offer carries whatever you type into that form. It also carries a random ID I set in a cookie, so I can tell one signer from a resubmission on the same wish. That cookie holds no name or email (see “Addresses and cookies” below).
  • A Finale offer needs an email. I send a link there, and the offer only counts once you tap it.
  • I also use that email to reach you about the offer, including to tell you when a higher offer comes in.
  • An offer you never confirm is not shown anywhere. Its details are deleted a day after the link expires.

Addresses and cookies

• I never store your IP address itself. Wherever an IP matters, I store only a one-way salted hash of it. That is:
  • capping how long one connection can hold the front of the queue without paying;
  • one signature per petition per browser; and
  • every per-connection rate limit on checkout, offers, uploads and the site password.
  Rotating that salt makes every existing hash unmatchable to anything. The one exception is Cloudflare Turnstile, the bot check on checkout, petitions and offers. It needs your real IP to judge the challenge, and Cloudflare receives and handles it under its own privacy policy, not mine.
• A short-lived cookie proves you are the one holding a number mid-checkout. So a link you might have pasted somewhere can't be used by someone else to pay for or edit your order. It carries no personal details, only a random secret, and it expires with your hold.
• A petition-signing cookie is a random ID, nothing else. It is kept only so the same browser can't sign one wish twice, and so a petition's page can show you the share buttons once you have signed it. If you file a petition, your browser also keeps its company name and link in local storage for a week, on your device only, so the petition page can show you yours.
• I use no third-party advertising or tracking cookies, and no cross-site tracking pixel. The live viewer count on the board uses a random ID kept in your tab's session storage. My server keeps that ID for up to 15 minutes, then deletes it. It is never a cookie, and never your IP.

Analytics

• Page views are measured by Vercel Web Analytics. It is cookieless and does not build a profile of you across sites.
• I separately record a handful of named events on the buying journey (a slot held, a checkout step, a petition signed or shared). Each one can carry only a slot number, a yes/no, or a word from a short fixed list. It never carries your name, company, email or the exact amount you paid or offered. Your private booking link and payment page addresses are stripped down to their general shape before anything is sent. So the token or order ID in them never leaves your browser.

Who else sees it

• Me. Every sale, booking and offer is visible to me and Adrian, who run this campaign together, behind a password-protected admin panel.
• Service providers. Each one receives only what its one job needs. None of them is free to use it for its own purposes.
  • Upstack Studio Sdn. Bhd.: builds and runs this site on my behalf, and collects its payments. So it can see everything above that passes through it.
  • Airwallex: Upstack Studio Sdn. Bhd.'s payment processor. It processes your payment, and receives your email address for the receipt.
  • Resend: sends every email I send you (sale confirmation, booking link, reminders). So it necessarily sees your email address and whatever that email contains. For a booking, that includes the office address and day contact you gave me, in the message and its calendar attachment.
  • Neon: hosts the database everything above lives in.
  • Vercel: hosts the site itself and runs the cookieless Analytics above. It does not host the database.
  • Cloudflare (Turnstile): the bot check on checkout, petitions and offers. It receives your IP address to judge the challenge (see “Addresses and cookies” above).
  • Sentry: collects error reports when something breaks on the site, so I can fix it. A report says what failed and which page it was on. Email addresses, order and booking codes, cookies and anything you typed into a form are taken out before it is sent, and it is set up not to store IP addresses.
  • WhatsApp (Meta): only if you message me there for help. I see your number, the name on your WhatsApp and what you write, and Meta handles the chat under its own terms. I don't take calls.
  • Google: the calendar event for your session, if connected, with the details in “What I collect” above.
  • Reading the public view counts on Eat At Your Office's own Instagram and TikTok accounts is done through those platforms' APIs. Nothing about you passes through this.
• Your board listing (company, link, promoted thing, logo) is public by design, as part of what you bought. Nothing else about you is published.
• I do not sell your data, and I do not use it for advertising.

Where it comes from, and what you must give

• Where it comes from. You give me almost all of it, on the forms on this site. Airwallex tells me whether your payment went through. Cloudflare tells me whether you passed the bot check.
• What you must give. To buy a slot I need your company name and email. Without them I can't sell you one or send your booking link. To book a session I need the office address, who to ask for and a mobile number for the day. Without them I can't turn up. A mobile number at checkout and a logo are optional. A petition needs only a company name, and a Finale offer needs an email.
• Outside Malaysia. Some of the providers above store or handle data outside Malaysia. I use them only because I need them to sell and deliver your slot.

Your rights

• Email hello(@)eatatyouroffice.com to see what I hold about you, to correct it, or to ask me to delete what the law lets me delete. Even after a deletion request, I keep what the law requires: a paid slot's public board listing, and the tax records behind a completed purchase.
• Your choices. I don't send marketing. Email me to stop anything, and I'll tell you what it changes for your slot.
• If something goes wrong. If a breach of your data is likely to harm you, I'll tell you, and the Personal Data Protection Commissioner, as the law requires.
• This site is not directed at children, and I do not knowingly collect data from them.
• I may update this policy as the site changes. The version here is the one in force.