Privacy policy

Mesa runs this marketplace and decides how the site handles personal information. Sellers are separate businesses: when you order from one, they receive the contact details they need to fulfill that order, and they handle that information as their own.

We collect what you give us and what the site needs to run:

• Account: your name, email, password (stored only as a hash), and an optional phone number.
• How you sign in, if you choose to: two-step sign-in settings, passkeys (only the public half; the private key never leaves your device or password manager), and, if you sign in with Google or Facebook, the name, email, and account ID they share with us.
• Addresses you save for delivery or pickup.
• Orders: items, prices, how you're getting them, your receipt email, and the phone number you share with makers.
• Seller information: kitchen name, legal name, contact details, where the food is prepared, categories, listings, photos, documents, and confirmations.
• Messages, reviews, favorites, and notification preferences.
• Waitlist sign-ups: your email, the city you asked about, whether you'd like to sell there, and anything you told us you were hoping to find. We use them to decide where to open next and to tell you when we do.
• Technical records: IP address and browser details on signed-in activity and on compliance-related actions, kept in our audit log.
• Visits to kitchens' pages: which kitchen and page, and the site, app, or tagged link that sent you, tied to a random ID in a cookie rather than to you. If you order, the kitchen's order records where you came from. Kitchens see only totals, like “40 visits from Instagram”, never who visited.
• A starting city, estimated from your IP address (see “Who we share it with”). If you choose “Use my location,” we use your coordinates only to find the nearest city with kitchens, then discard them. Opening a city page saves that city until you pick another.

We don't see or store full card numbers. Card details go straight to our payment provider, Stripe.

We use a small number of first-party cookies to run the site:

• mesa_session keeps you signed in. Not readable by scripts; lasts 30 days and renews as you use the site.
• mesa_csrf is a token your browser sends back with forms, so another site can't act as you. It's useless without the session cookie, and lasts as long as it does.
• mesa_cart remembers a basket before you sign in. Not readable by scripts; lasts 30 days.
• mesa_city is the city you're browsing, set from your network, your device location, a saved address, or a city you pick. Lasts a year. Coordinates are never stored.
• mesa_city_source records whether that city was estimated, taken from your device, or chosen by you. Lasts a year.
• mesa_visitor is a random ID that tells one visit to a kitchen from the next, so a kitchen can see where its customers come from. Not readable by scripts; lasts a year.
• mesa_flash carries a one-time message, like “Saved,” to the next page after you submit a form. It's deleted as soon as it's shown, and within a minute either way.
• mesa_kitchen remembers which kitchen your dashboard shows, if you work in more than one. Not readable by scripts; lasts a year.
• mesa_sign_in, mesa_passkey, and mesa_oauth carry a sign-in from one step to the next: to your two-step code, to your passkey, or to Google or Facebook and back. Not readable by scripts; each lasts ten minutes at most, and is removed when the sign-in finishes.

Earlier versions of the site stored the city in cookies named mesa_place and mesa_place_source; we delete those when we see them.

When you pay, the card form comes from Stripe, which may set its own cookies to prevent fraud. Those are covered by Stripe's privacy policy. Otherwise we don't use third-party analytics or advertising cookies, and we don't sell personal information.

We use personal information to:

• Create and secure your account, and keep you signed in.
• Show listings, take orders, send receipts, and pay sellers.
• Check listings and orders against the rules for each state, and keep a record of those decisions.
• Let customers and sellers message each other about an order.
• Send email and on-site notifications about orders, requirements, and account activity.
• Detect abuse, fix problems, and meet legal obligations.

We don't use your information to train public AI models, and we don't sell it.

We share personal information only as needed to run the marketplace:

• Sellers, when you order from them: your name, receipt email, phone number if you gave one, and the pickup or delivery details for that order.
• Customers, when they order from you: the kitchen details you chose to publish, plus the pickup or delivery arrangements for that order.
• Stripe, our payment provider, to charge customers and pay sellers: the amount, your email, and the card and billing details you enter in its form. For sellers who set up payouts, we open a Stripe account with their email; they give Stripe their identity and bank details directly, and Stripe tells us only whether payouts are ready.
• Stripe Tax, to calculate, collect, and file sales tax: the address an order is taxed at (your delivery address, or the kitchen’s pickup address), the kitchen’s address, and what was bought and for how much.
• Our hosting provider, which runs the site and estimates an approximate city from your IP address with each request. When it can’t, we send your IP address to a geolocation service, ipwho.is, which returns an approximate city and coordinates. We use them to pick the nearest city with kitchens and don’t store them.
• File storage, for photos and seller documents. Seller documents, such as permits and certificates, aren’t public.
• Email delivery, to send receipts and notifications.
• Google or Facebook, only if you sign in with them: they tell us your name and email address, and we tell them nothing else. We never post anything or read anything else from those accounts.
• Authorities, if the law requires it, or if we need to protect someone from serious harm.

Public kitchen pages and listings show what you publish: kitchen name, city and state, photos, product details, and reviews. They never show a street address, legal name, or private contact details.

We keep account and kitchen information while the account is open. Order, payment, payout, and compliance records are kept as long as we need them to run the marketplace, handle disputes, and meet record-keeping obligations, including after an account is closed, where those records still matter.

When you delete your account, we remove what identifies you and keep the records others still rely on: a kitchen's record of an order you placed (including the address it was delivered to), your reviews, shown as “Former customer,” and messages you exchanged with kitchens, without your name.

Our audit log records who changed what, from where, and under which version of the rules. It's part of how we can show why a listing or an order was allowed.

You can update your name, addresses, and kitchen details while signed in, and you can sign out at any time, which ends the session cookie.

You can delete your account yourself, under Delete account in your account settings. It asks for your password, then removes your name, email, phone number, photo, saved addresses, favorites, basket, notifications, and waitlist sign-ups, disconnects Google or Facebook and removes your passkeys, and signs you out everywhere. What we keep is described under “How long we keep it.” If you own a kitchen, have admin access, or have a paid order still in progress, the page says what to settle first.

There isn't a self-serve export yet. To ask for a copy of your information, or a correction you can't make yourself, contact us from the email on your account.

Depending on where you live, you may have more rights under state privacy law, including the right to appeal a refusal. Use the same email to exercise them.

Passwords are hashed. Sessions are stored as hashes too; the cookie carries only a random value. Uploads and changes go through checks on our servers. No way of sending or storing data is perfect, and we don't claim otherwise.

Mesa isn't meant for children, and you must be 18 or older to create an account or place an order. If we learn we've collected information from someone under 13, we'll delete the account.

We may update this policy as the marketplace changes. The date at the top is the effective date, and we'll note material changes on this page.

Privacy questions? Contact us, writing from the email on your account.