Privacy policy
Effective 14 November 2026 · Version 2026-11-14
LunchPass is operated by Six Paths Corporation. Contact: info@sixpathsscl.com.
Information used for signup
Signup uses your email, username, country, password and optional full name. Email verification uses a code and an expiring proof. LunchPass forwards signup details securely to the shared account service used by SuperNova, which creates and verifies the account and stores the account password as a protected hash. LunchPass does not keep a separate password database. Passwords and codes are used for their request; the verification proof is held encrypted for a limited period.
How information is used
We use account information to create and verify accounts, sign you in, check permissions, protect access and provide the features you use. Shared credentials do not grant automatic access to every service or make your account data public. Browser sessions use random references to protected information held on the server.
Cards, people and purchases
When you use enabled LunchPass features, information may include the names and relationships of people you manage, account and card references, spending controls, merchant details, purchases and refunds. Account holders can see records for the people and cards they are authorized to manage. Merchants and staff receive information according to their authorized role and the operation they perform. Do not add another person's information without authority to do so.
Device permissions
The iOS app uses the system browser for sign-in and the device Keychain to protect access credentials. Camera access is used to scan QR cards; camera frames stay on the device. The current iOS app does not request contacts, microphone or location access and does not include an advertising SDK.
Service providers and disclosures
Our shared account service and hosting providers process information needed to run and secure LunchPass. Authorized staff may access information to provide support, investigate problems or meet legal obligations. Information may also be disclosed when required by applicable law. A merchant receives the information needed for the purchase or refund you authorize.
Security and retention
We use encrypted connections, protected server storage and access checks. Verification codes and proofs expire; expiry does not necessarily erase related security journal entries. Account, support, security and transaction records may remain for operating the service, investigating issues and meeting applicable financial or legal obligations. Contact us for the retention and deletion arrangements that apply to your information.
Your requests
Contact info@sixpathsscl.com to ask about your information, request correction or deletion, or raise a privacy concern. We may need to verify your identity and authority before acting. Explain whether your request concerns LunchPass access or the shared account used in other services. We will explain any required retained records and the scope of a shared-account deletion before acting.
Changes
This notice identifies its effective date and version. We will update it when relevant practices change and communicate material changes as appropriate.