Privacy Policy
Last updated September 4, 2026
This lunch ordering site is run by MDQ Academy (40 Kings Park Rd, Commack, NY 11725) so families and staff can order prepaid school lunches. This notice explains what we collect, why, who sees it, and how to reach us about it.
What we collect
- Your account: your name, email address, phone number and a password (stored only as a one-way hash by our sign-in provider).
- Your children: each child's first and last name and homeroom, so lunches reach the right classroom. We do not ask for birth dates, photos, medical information or any other details about a child.
- Orders: which lunches were chosen for which days, the amount paid, and the Square payment reference.
- Technical data: the standard server logs and cookies needed to keep you signed in and keep the site secure. We do not use advertising or analytics trackers.
Payments
Card payments are handled entirely by Square on Square's own checkout page. We never see or store your card number. Square's handling of your payment details is governed by Square's privacy policy.
Who can see what
- You see your own account, children and orders.
- Your child's teacher and teaching assistant see the lunches ordered for the students in their homeroom.
- School office and administrators see all orders, children and parent contact details in order to run the program, answer questions and handle refunds.
- Lunch vendors see only how many of each meal to prepare for each day. They never see student or family names.
We do not sell or rent personal information, and we do not share it with anyone outside the school and the service providers below.
Service providers
The site runs on Vercel (hosting), Supabase (database and sign-in), Square (payments) and Resend (email). Each processes data only to provide its service to the school. Data is stored in the United States.
We email you order receipts, cancellation notices, menu announcements and ordering-deadline reminders. To stop receiving lunch program email, reply to any message with the word unsubscribe or ask the office to close your lunch account. Receipts for orders you place are still sent.
How long we keep it
Order history is kept for the current and previous school year so the school can answer billing questions and reconcile vendor invoices, and is then deleted. An account and its children are removed when you ask the office to close it, or once the family has left the school.
Children's privacy
Accounts are created by parents, guardians and staff, not by students. The site is not directed at children and does not knowingly collect information directly from anyone under 13. Student information entered by a parent is education data belonging to the school and is handled under the school's student-privacy obligations, including New York Education Law §2-d.
Security
Access is limited by role, all traffic is encrypted, and student records are only visible to the people listed above. If we learn of a breach affecting your information we will notify you as New York law requires.
Your choices
You can update your name, phone and password on the Account page, and change or remove children on My Children. To see, correct or delete anything else, or to close your account, contact the school office at (631) 665-5036 or lunch@mdqacademy.org.
Changes
If this notice changes in a way that matters, we will update the date above and mention it in the next menu announcement.
See also the terms and refund policy.