Free Lunch

Privacy Policy

Effective date: 1 September 2026

Free Lunch is an online platform operated by Dactor Limited. Businesses and individuals can create accounts and may connect third-party accounts for promotional activities. This Privacy Policy explains how Dactor Limited (“we”, “us”) processes personal data for Free Lunch. It is the privacy policy for the Free Lunch application and website.

We handle personal data in line with the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and other laws that apply.

1. Who we are

Dactor Limited
FLAT/RM 09, G/F, YUE SHUN HSE, YUE WAN EST, CHAI WAN, HK
Email: business@dactor.ai

2. Personal data we process

We process these categories of personal data:

  • Account and sign-in data — identifiers used to create and sign in to a Login, including email, phone number, and identity data from Google or Apple sign-in (such as name, email, and profile photo when the provider supplies them).
  • Data you provide — profile and other information you submit on the service.
  • Connected third-party account data — when you connect an account from Google (including YouTube) or Meta (Facebook, Instagram, and Threads), we process the account identifiers, public profile or page data, and related metrics those APIs make available, plus tokens needed to keep the connection. You may be asked to choose optional fields before we fetch them.
  • Identity-verification and payment data — when you use verification or paid services, we process the documents and payment details needed to complete those services.
  • User content — content you upload or send on the service, including messages and media.
  • Technical data — device, log, and IP information used for security, fraud prevention, and operating the service (including approximate region).
  • Communications we send you — such as one-time verification codes by email or SMS.

3. How we use personal data

We use personal data to:

  • create and authenticate your account, and keep it secure;
  • operate Free Lunch, including connecting third-party accounts you choose;
  • process verification and payments when you use those services;
  • communicate with you about the service;
  • prevent fraud, abuse, and security incidents; and
  • comply with law and enforce our Terms of Service.

4. Google user data

When you sign in with Google, we receive basic identity information from Google to create or authenticate your Login.

When you connect a YouTube or other Google account to Free Lunch, we access Google user data through Google APIs (including the YouTube Data API with read-only scope) to display and operate the connected-account features you request. We store access and refresh tokens as needed to maintain that connection until you disconnect or delete your data.

Free Lunch's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Google user data obtained via those APIs:

  • is used only to provide or improve user-facing features that are prominent in Free Lunch;
  • is not transferred except to provide those features, for security, to comply with law, or as part of a merger, acquisition, or sale of assets with required consent;
  • is not used or transferred for serving ads, including retargeting, personalised, or interest-based advertising;
  • is not sold or used to determine credit-worthiness or for lending; and
  • is not read by humans except with your affirmative agreement, for security, to comply with law, or in aggregated form for internal operations.

How we protect Google user data. Security procedures are in place to protect the confidentiality of Google user data. We use encryption to protect this information in transit and at rest.

  • Access and refresh tokens are stored on our servers, not in the user's browser, and are used only to operate the connected-account features you request.
  • We transmit Google user data over HTTPS/TLS.
  • Access is limited to systems and personnel who need it to operate, secure, or legally support the service.
  • When you disconnect a Google or YouTube account, or when we delete your Free Lunch Login, we delete the associated tokens and Google user data we hold, except where we must retain information for law, security, or dispute resolution.

5. Meta platform data

When you connect Facebook, Instagram, or Threads, we process Meta platform data that you authorise (for example public profile, email, pages you manage, and related engagement data where the API provides it) solely to connect those accounts and operate the corresponding user-facing features. We do not sell Meta platform data. We process it only as described in this policy and in line with Meta's terms.

6. Processors

We use these processors to help us run Free Lunch:

  • Google — sign-in, YouTube APIs, Cloud document processing, and place lookup when you provide an address;
  • Meta — Facebook, Instagram, and Threads APIs for connected accounts;
  • Apple — sign-in;
  • Supabase — authentication, database, and storage;
  • Vercel — hosting, including connection-region signals;
  • AirWallex — payments;
  • Resend — email; and
  • Twilio — SMS, via our authentication provider.

These parties process personal data on our instructions or as independent controllers where their own terms apply (for example when you sign in with Google or Apple). Some processors are outside Hong Kong. We only disclose personal data as needed to operate the service, as described here, or as required by law.

7. How to request deletion

You may request deletion of your personal data in the service (Delete account in account settings) or by emailing business@dactor.ai.

Disconnecting a third-party account is not the same as deleting your Free Lunch Login. After we receive a valid request, we delete or anonymise personal data we hold about you, except where we must retain it for law, security, or dispute resolution.

If you remove Free Lunch from Facebook's Apps and Websites settings, you may also request deletion by using this page or the email above. Instructions: https://free-lunch.net/privacy#deletion.

8. Retention, security, and cookies

We keep personal data only as long as needed to operate the service, meet legal obligations, or resolve disputes, then delete or anonymise it.

Security procedures are in place to protect the confidentiality of personal data, including sensitive data such as Google user data, identity-verification documents, and payment-related data. We use encryption to protect this information in transit (HTTPS/TLS) and at rest. Access and refresh tokens for connected accounts are stored server-side with access limited to authorised backend systems.

We use cookies and similar technologies that are necessary to sign you in and run the service.

9. Children

Free Lunch is not directed at children under 13. We do not knowingly collect personal data from children under 13.

10. Changes

We may update this Privacy Policy. The effective date above will change when we do. If we use Google user data in a new way, we will update this policy and obtain any consent required before that new use.

11. Contact

For privacy questions or requests, contact Dactor Limited at business@dactor.ai. See also our Terms of Service.