Privacy Policy

1. Who we are

Mendu (eatmendu.com) is a meal-planning subscription service operated by Hawaiian Breeze Realty LLC dba Mendu, a Hawaii limited liability company ("Mendu," "we," "us"). This policy explains what personal information we collect when you use our website, quiz, app and emails (the "Service"), why we collect it, who we share it with, and the choices you have.

Mailing address: 512 Kaha St, Kailua, HI 96734

2. What we collect, and why

We only collect information we need to run the Service. Here is everything, in plain English:

We collect this information from you (when you take the quiz, sign up or contact us), automatically (through cookies and similar tools, see section 5), and from partners (Stripe for payment status, and Meta for lead-form sign-ups).

3. Your health data and your consent

Your eating-pattern goals, and diet or allergy details that could reveal a health condition, are consumer health data. We handle all of it as sensitive. That means:

• We ask first. We collect health-related answers only after you give clear, separate consent in the quiz. You can still use Mendu without picking eating-pattern goals: you'll simply get a menu from your diet styles, allergies and household.
• One purpose only. We use this data only to build and adjust your meal plans and grocery lists, and to provide the features you've asked for.
• Never sold. Never used for ads. We do not sell consumer health data. We do not share it with Meta, Google, TikTok or any other advertising or analytics platform, and we do not use it to target ads to you. It is never placed in pixel events, ad parameters, page addresses (URLs) or page titles that ad tools can read.
• Limited sharing. It is stored with our hosting and database providers, which process it only on our instructions. Health answers are not sent to a grocery store. If you connect a Kroger account, we send item names and quantities so Kroger can put them in your cart. If you copy your list into an app yourself, that app receives only what you paste, under its own terms.
• You're in control. You can review or change your answers at any time, withdraw consent, or delete them (see section 9).

The consent request you'll see in the quiz reads:

If you withdraw consent, we'll stop using your health answers and delete them. Your menus will switch to general recommendations.

4. How we use your information

• To provide the Service: create your account, generate your 7-day menu (3 options per meal; ready in 5 / 10 / 20 minutes on the day; some are made ahead on your prep day), household scaling, and zero-waste grocery lists you can print or copy.
• To run your subscription: start your free trial, process payments through Stripe, send receipts, trial-ending reminders and renewal notices.
• To communicate with you: service messages (which you can't opt out of while you have an account), and, if you agree, tips, recipes and offers (which you can unsubscribe from at any time).
• To improve Mendu: understand which features and recipes are used, using aggregated or de-identified data wherever we can.
• To measure our advertising: using non-health information only (see section 5).
• To keep things safe and legal: prevent fraud and abuse, enforce our Terms, and meet tax, accounting and legal obligations.

We don't make decisions about you that have legal or similarly significant effects based solely on automated processing. Your menu is generated automatically, but it's a recommendation you can change.

5. Cookies, analytics and the Meta pixel

Cookies are small files stored by your browser. We use:

• Essential cookies to keep you signed in, remember your settings and protect against fraud. These are needed for the Service to work.
• Retailer cookies. If you follow a paid Walmart link, Walmart and its affiliate network may set cookies on your browser under their own policies. We put a "Paid link" note next to that button. Those links are not included in Mendu emails. If you sign in to Kroger from Mendu, Kroger may set its own cookies while you review and pay for the order.
• Affiliate cookies. The Kitchen tools we like page may later include Amazon Associates links. If you follow one, Amazon may set cookies on your browser under Amazon's own policy. Mendu does not set those cookies, does not show Amazon prices, and does not put Amazon links in email. While that setting is off, the page lists the tools with no buy links. When the links are on, the page says: "As an Amazon Associate, Mendu earns from qualifying purchases."
• Analytics: on our public marketing pages we use Cloudflare Web Analytics. Cloudflare says this product does not collect or use visitors' personal data, and that it does not use cookies or localStorage to collect usage metrics. Cloudflare also says it does not track individual visitors over time by IP address, browser string, or other fixed attributes for the purpose of displaying analytics. The dashboard shows aggregate page views with dimensions such as page path, referrer, browser, device type, and country. This script is not loaded in the members area, on the quiz, or on any page that collects diet, allergy, goal, or other health answers.
• The Meta pixel and Meta Conversions API to measure whether our Facebook and Instagram ads work and to reach people likely to be interested in Mendu. Not active yet: we haven't added the Meta pixel to our website. When we do, these tools may receive: that a page was viewed, that someone joined the waitlist, created an account, started a trial or subscribed (with the plan value), your browser and device information, IP address, Meta cookie identifiers, and, where you've allowed it, a hashed (scrambled) version of your email address.

Your choices: Cloudflare Web Analytics does not set a cookie. Our website still doesn't set a non-essential analytics cookie. Before we add any cookie-based tool (such as the Meta pixel), we'll add cookie settings so you can turn them off. You can also block cookies in your browser or adjust your ad preferences in your Facebook or Instagram settings. We honor the Global Privacy Control (GPC) signal as a request to opt out of sale and sharing (see section 7). Our site does not currently respond to "Do Not Track" signals, because there is no common standard for them; GPC is the signal we honor.

6. Who we share information with

We share personal information only as described here:

7. Do not sell or share my personal information

We do not sell your personal information for money. We never sell or share health data or other sensitive information.

However, some privacy laws, including California's (the CCPA, as amended by the CPRA), count letting ad platforms like Meta collect information through a pixel, for advertising across different sites, as "sharing," and in some cases as a "sale." Mendu does this only with the non-health information described in section 5. Under those laws you have the right to opt out, and we extend that choice to everyone, wherever you live.

Sensitive personal information: we use sensitive information (such as health data) only to provide the Service you asked for, and as otherwise allowed by law. We don't use it to infer characteristics about you or for advertising.

We don't knowingly sell or share the personal information of anyone under 16.

8. How long we keep information

• Account, quiz and menu data: while your account is open. If you delete your account, we delete it (including all health answers) within 30 days. Copies in backups are overwritten within 35 more days.
• If your subscription ends but you don't delete your account: we keep your account so you can come back. If it stays inactive for 24 months, we'll email you and then delete it.
• Payment and tax records: transaction records (not card numbers) for up to 7 years, as required for tax and accounting, including Hawaii general excise tax.
• Lead and newsletter emails: until you unsubscribe or ask us to delete them. We keep a minimal "do not email" record so we don't contact you again by mistake.
• Support emails: up to 3 years after the conversation ends.
• Security and server logs: up to 12 months.

9. Your rights and choices

Whatever state you live in, you can ask us to:

• Access the personal information we have about you, and get a copy in a portable format
• Correct information that's wrong (you can also edit your quiz answers and settings yourself)
• Delete your information or your whole account
• Withdraw consent for us to use your health data
• Opt out of marketing emails (use the "unsubscribe" link in any email), and of sale, sharing or targeted advertising (see section 7)
• Know which categories of information we collect, why, and who we share it with (this policy), and the list of third parties and affiliates that received your health data

How to make a request: email hello@eatmendu.com from the email address on your account, or use the privacy options in your account settings once they're available. We'll confirm your identity (usually by confirming your email), then respond within 45 days. If we need more time, we'll tell you why (up to 45 more days where the law allows). You can use an authorized agent; we may ask for proof that they're allowed to act for you.

Appeals: if we decline your request, you can appeal by replying to our decision or emailing hello@eatmendu.com with the subject "Privacy appeal." We'll respond within 45 days. If you're still unhappy, you can contact your state attorney general.

No discrimination: we won't charge you more, give you a worse service, or deny you the Service for exercising your privacy rights.

10. Washington's My Health My Data Act and other state health-data laws

Because some of the information you give us is consumer health data, laws such as Washington's My Health My Data Act (and similar laws in Nevada, Connecticut and other states) may apply. This section is our Consumer Health Data Privacy Policy, and it is linked from every page of our site.

• Consumer health data we collect: optional eating-pattern goals you select in the quiz (more fiber, more vegetables, less added sugar, lower sodium (DASH-style), more plant protein, or balanced meals), and diet styles, allergies or intolerances that could reveal a health condition.
• Sources: you, directly, when you answer the quiz or update your settings.
• Why we collect and use it: only to provide the personalized meal plans and grocery lists you ask for.
• Who we share it with: only the service providers (processors) that host and run the Service on our behalf, under contracts that limit their use to our instructions. We do not share it with any other third parties or affiliates, and we do not sell it.
• Consent: we collect it only with your consent (see section 3). We'd ask for separate consent before ever sharing it for another purpose, and we would need your signed authorization before ever selling it. We have no plans to do either.
• Your rights: you can confirm whether we collect, share or sell your consumer health data; access it, and get a list of all third parties and affiliates it has been shared with (including contact details); withdraw consent; and have it deleted, including from our processors. Make requests and appeals as described in section 9.
• No geofencing: we don't set up virtual boundaries around health care facilities to track or message people.

11. Children

Mendu is not for children under 13, and we don't knowingly collect personal information from them. You must be 18 or older to create an account and subscribe. If you tell us your household includes children, we only record how many people eat and their portion size, not their names, ages or health information. If you believe a child under 13 has given us personal information, email hello@eatmendu.com and we'll delete it.

12. Security

We protect your information with measures appropriate to its sensitivity. These include encryption in transit (HTTPS) and at rest, hashed passwords, access limited to people who need it, and reputable providers. Card payments are handled by Stripe, so your full card number never reaches our servers. No system is perfectly secure, so please use a strong, unique password. If a breach affects your personal information, we'll notify you and the authorities as the law requires.

Mendu is based in the United States, and your information is stored and processed in the U.S.

13. Changes to this policy

We'll update this policy as Mendu changes, and we'll change the "Last updated" date above. If we make a material change, especially to how we use health data, we'll tell you by email or in the app before the change takes effect and ask for your consent again where required.

14. Contact us

Questions, requests or concerns about privacy:

Hawaiian Breeze Realty LLC dba Mendu
Email: hello@eatmendu.com
Mail: 512 Kaha St, Kailua, HI 96734