LiveByLunch Privacy Policy

Who we are: LiveByLunch ("LiveByLunch," "we," "us"), operated by Jon Shaffer, a sole proprietor d/b/a LiveByLunch, 14433 Colorado Place, Canyon Country, CA 91387 · [email protected]

Effective date: October 17, 2026 · Last updated: October 30, 2026

1. Who this policy covers

Business owners who use our website builder ("Clients").
Visitors to livebylunch.com (our marketing pages).
Visitors to websites we host for Clients (*.livebylunch.com). For those visitors, the Client is the business responsible for its site and its own privacy notice. We process that data on the Client's behalf as a service provider (see §8).

2. Information we collect (notice at collection)

Category (CCPA)	Examples	Source	Why we use it
Identifiers / contact info	Your email address (used to log in), business email and phone you add to your site	You	Account, login links, notifications, support
Business and site content	Business name, services, hours, service areas, text, logos and photos you upload, and past versions of your site	You	Build, host and edit your site; let you undo changes
Chat content	Messages you type in the builder chat	You	Build and edit your site with AI; safety; fixing problems.
Usage and technical data	AI usage per session (amount and cost), error logs (we try to remove emails and phone numbers), rate-limit counters	Automatic	Security, preventing abuse, cost limits
Messages you send us	Emails you send to hello@ or [email protected], and anything you include in them	You	Answer you, fix problems, keep a record of what we told you
Client-site visitor submissions (as service provider)	Name, phone, email, service requested, message	Site visitors	Saved to the Client's inbox and emailed to the Client
Payment info (when billing launches)	Processed by Stripe. We receive limited details (e.g., card brand, last 4 digits, billing status), never full card numbers	You / Stripe	Subscriptions, receipts, records of auto-renewal consent

Sensitive personal information: we don't intentionally collect it and don't use any information to infer characteristics about you.

3. Cookies and analytics

Essential cookies only:
- sid keeps you logged in (up to 30 days).
- lbl_invite holds your invite code, if you use one (15 minutes).
- Admin-only session cookies are used by our operator.
We use no advertising or cross-site tracking cookies, so we don't show a cookie banner.
Marketing pages (livebylunch.com): Cloudflare Web Analytics, which Cloudflare adds automatically. It is cookieless and gives us page-view and performance totals. It doesn't use cookies or local storage to identify you.
Client sites: our own visitor counter stores only a daily page-view count per site. No cookies, no IP addresses, no device identifiers.
Do Not Track / Global Privacy Control: we don't track you across other websites, so there is nothing for DNT to turn off. We treat a GPC signal as a request to opt out of sale/sharing. We already don't sell or share.

4. Who we share information with (service providers)

Cloudflare: hosting, database and storage, security, web analytics, and email forwarding for hello@ and [email protected].
OpenAI: processes chat messages and site content to write and edit your site, and to check content against our Content Policy.
Resend: sends our emails (login links, lead notifications, invites, account notices).
Google (Gmail): our email account. Messages sent to hello@ or [email protected] are forwarded there.
Unsplash / Pexels: we send search words only (e.g., "bakery") to find stock photos. No personal information.
Stripe (when billing launches): payment processing.
Other cases: when required by law, or to protect rights, safety and security; to a successor if the business is sold or reorganized (including into an LLC).

We do not sell or "share" personal information (for cross-context behavioral advertising), and have not done so in the past 12 months. We have no actual knowledge of selling or sharing data of anyone under 16.

5. Your privacy rights

California residents (and residents of other states with similar laws) can ask us to:

know/access the personal information we have about them
delete it
correct it
give them a portable copy (site owners can also download their site and its data themselves; see §6)
opt out of sale or sharing (we do neither)
limit use of sensitive personal information (we don't use it beyond what's necessary)

We won't discriminate against you for using these rights.

How to make a request:

Email [email protected] with the subject "Privacy request".
We verify your identity through a confirmation sent to your account email.
An authorized agent may submit a request with your signed permission.
We confirm receipt within 10 business days and respond within 45 days. We may extend once by 45 more days, and we'll tell you if we do.

Client-site visitors: contact the business whose site you used. If you contact us, we'll pass your request to that business.

6. How long we keep information

Data	Retention
Active account and site (content, versions, leads)	While your account is active
Canceled site: site content, all versions, and leads, plus members, orders and bookings on sites that have them	You keep full access until the end of your paid period. The hosted site stays online 30 days after that. The site's owner can download a copy (pages, images, app files, and contacts/members/orders/bookings as CSV, with passwords and keys excluded) for 1 year after access ends. We're building automatic deletion; until it's live, we keep this data until you ask us to delete it (email [email protected]), and we'll delete it within 45 days of your request.
Builder chat logs	While your account is active, or until you ask us to delete them. We're building automatic deletion after 12 months.
Records of auto-renewal consent (when billing launches)	At least 3 years, or 1 year after your subscription ends, whichever is longer (required by Cal. Bus. & Prof. Code §17602)
Billing and tax records (when billing launches)	As long as tax law requires

Backups may hold data for a short time after deletion, until they are overwritten.

7. Children

Our service is for businesses and people 18 and older. We don't knowingly collect information from children under 13. If you believe we have, email [email protected] and we'll delete it.

8. Our role for Client sites

For information that visitors submit on a Client's site, the Client decides how it's used and is responsible for its own privacy notice and legal compliance. We process that information only to provide our service to the Client, under our Terms of Service (§5, service-provider terms). We don't sell it, share it, or use it for our own purposes, except for security and legal obligations. When a Client downloads its site, the CSV files contain its customers' personal information; from then on, the Client is responsible for that copy.

9. Security

Data is encrypted in transit (HTTPS) and stored with Cloudflare. Logins use one-time email links instead of passwords. No system is perfectly secure; we'll notify you of a breach as the law requires.

10. Changes to this policy

We'll change the "Last updated" date at the top of this policy. For material changes, we'll email account holders and/or show a notice in the app before the change takes effect.

11. Contact

[email protected] · LiveByLunch (Jon Shaffer, sole proprietor), 14433 Colorado Place, Canyon Country, CA 91387.