1. OTP program and consent
When you actively select the OTP consent checkbox and press Continue, you ask Lunchly to send one transactional security code to the mobile number you provide. The code is sent through WhatsApp using Twilio Verify. SMS may be offered separately where available.
Consent applies only to the verification request you initiate. It does not enroll you in marketing or recurring promotional messages and is not a condition of purchasing food.
2. Message frequency, charges and delivery
Message frequency is one verification message per request, with additional messages only when you request a resend. Message and data rates may apply. Mobile carriers and messaging platforms are not liable for delayed or undelivered messages.
3. Help and stopping messages
For help, reply HELP where that keyword is supported or email support@lunchlys.com. To stop SMS messages, reply STOP. For WhatsApp, you may block the sender or contact support. Because these are user-requested one-time codes, Lunchly does not send another code unless you make another request.
4. Information we collect
We collect the phone number, requested channel, consent wording/version, consent time, IP address and browser/device user-agent. When verification succeeds, the account may also contain your name, phone number, workplace delivery details, orders and support history.
Twilio and WhatsApp process message-routing and delivery information to deliver the OTP. Supabase processes authentication and account-session information.
5. OTP codes, browser cache and session storage
The OTP is short-lived and is validated by the authentication providers; Lunchly does not intentionally store the plaintext OTP in its application database. Essential authentication cookies or browser storage are used to keep you signed in, protect the session and remember necessary app state. Session data expires or is removed when you sign out, clear browser data or the authentication session expires.
6. Purpose and retention
We use this information to send and validate the requested OTP, prevent fraud, secure accounts, provide delivery services and demonstrate legally required proof of consent. Consent records are retained only as long as reasonably necessary for compliance, disputes, security and applicable legal requirements. Account and order records follow the retention needed to provide the service and meet accounting or legal obligations.
7. No sale or sharing of mobile opt-in data
Lunchly does not sell, rent or share mobile numbers, text-messaging originator opt-in data or messaging consent with third parties or affiliates for their own marketing or promotional purposes. Messaging consent is not transferred to another sender. Service providers may process limited data only to operate authentication, security and message delivery for Lunchly.
8. Your choices and rights
You may decline the checkbox and no OTP will be requested. You may request access, correction or deletion of applicable personal data, object to or restrict certain processing, or raise a privacy question by contacting support. Rights may be limited where retention is legally required.
9. Related terms and contact
The general Lunchly Terms and Conditions also apply. Contact: support@lunchlys.com.