Privacy Policy

Lunchbox OS is an internal operations tool for staff of Lunchbox Pte Ltd (“Lunchbox”, “we”). It is not a consumer product and is not available to the public. The website at lunchbox.heymag.app, the Lunchbox OS iPhone app and the Lunchbox OS Android app are all covered by this policy.

You need an account created by Lunchbox to use it. There is no sign-up, and no way to use the app without one.

Your account. Your name, work email address, role, job title, department and time zone, so the system knows who you are and what you may see. You can add a profile photo, and a phone number or Telegram account if you want alerts sent there.

Work you do in the app. Projects, tasks, notes, messages, documents and the other business records you create. This is company data, not personal data, though your name is attached to what you create so colleagues know who did what. Some of it describes other people — a business card you scan at an exhibition, a merchant contact you record — and we hold that on the same terms.

Your devices, so alerts can reach you. When you turn on notifications, we store an identifier for that device, its operating system version, the app version and the device name it reports. We use these only to deliver notifications and to show you which of your devices are registered.

Usage and errors. Page views, and technical details when something goes wrong, so we can find and fix faults.

We do not sell your data. We do not share it with advertisers. We do not use it to build advertising profiles, and the app contains no advertising or tracking for marketing purposes.

The iPhone and Android apps both display the Lunchbox OS website, and collect nothing beyond the device details above. Neither reads your contacts, and neither asks for your location.

Some features do use the camera and the microphone, and only when you start them: recording a meeting, scanning a QR code or a business card, and taking a photo for an expense claim or an inventory item. Your phone asks your permission first, and a recording you make is saved to Lunchbox OS and transcribed so it can be searched.

We use a small number of service providers to run the software. They process data on our instructions only: Supabase (database, sign-in and file storage), Vercel (hosting and page-view analytics), Sentry (error reporting), Apple (delivering notifications to iPhones) and Google (delivering notifications to browsers and Android phones).

The AI features send content to a model provider. What you type into Business Copilot, the recent history of that conversation and anything you attach to it are sent to Anthropic or to OpenAI, depending on which model the system is set to use. Knowledge Base articles are sent to OpenAI to be indexed for search, and a meeting recording is sent to OpenAI to be transcribed. Neither provider trains a model on what we send.

Some Lunchbox features send messages on your behalf through email, Telegram or WhatsApp when you ask them to. Those providers receive the message you send.

Business records are kept for as long as Lunchbox needs them, and are subject to our normal record-keeping obligations. Device registrations are removed when you remove the device, when you sign out of the app, or automatically when Apple or Google tells us the device no longer exists.

You can turn notifications off at any time, on the device or in Settings inside Lunchbox OS. You can see every device registered to you under Settings → Devices receiving alerts.

Because this is a workplace tool, your employer controls your account and the records in it. To see, correct or delete your personal data, contact us using the details below.

To have your account closed and your personal data deleted, email hello@lunchbox.asia from your work address, or ask your administrator. We act on the request within 30 days and confirm when it is done.

When an administrator removes you from the team your access stops at once: the account is deactivated and sign-in is blocked. That step on its own does not erase your details.

On request we erase them too — your profile, photo, phone number, messaging accounts and every device registration — within 30 days. Business records you created stay: projects, tasks, documents and the like belong to Lunchbox, colleagues rely on them, and we have record-keeping obligations.

Uninstalling the app does not delete anything. It only stops notifications reaching that device.

Lunchbox Pte Ltd, 21 Keppel Road, Singapore 089067.

Questions about this policy or your data: hello@lunchbox.asia.