1. About this Privacy Policy

Yorkton Holdings Pty Ltd (ACN 166 481 616) (“Yorkton”, “we”, “us”, “our”) operates the MealStack meal-planning application and any related websites and services (together, the “App”). We respect your privacy and are committed to handling your personal information openly and transparently.

This Privacy Policy explains how we collect, hold, use, disclose and protect your personal information, and how you can access or correct it or make a complaint. It is designed to comply with the Privacy Act 1988 (Cth) (the “Privacy Act”), including the 13 Australian Privacy Principles (“APPs”) and the Notifiable Data Breaches (“NDB”) scheme.

Although the small-business exemption may currently apply to us, we have chosen to comply with the Privacy Act and the APPs in full as a matter of good practice, and in anticipation of the removal of that exemption and the registration of the Children’s Online Privacy Code. By creating an account or using the App, you agree to your personal information being handled as described in this Policy.

2. What is personal information?

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether or not it is recorded in a material form. “Sensitive information” is a special category of personal information (for example health, racial or religious information) that attracts higher protection under the Privacy Act.

MealStack is designed not to collect sensitive information. We do not require you to provide health, dietary-medical, religious or other sensitive information to use the App. Please do not enter sensitive information into free-text fields (for example list names or notes). If you choose to do so, you consent to us handling it in accordance with this Policy.

3. The personal information we collect

We collect only the personal information reasonably necessary to provide and improve the App (APP 3). The kinds of information we may collect include:

3.1 Account information

• Your name (or chosen display name) and email address;

• Your password (stored only as a securely hashed value – we never store it in plain text);

• Authentication identifiers if you sign in via Apple or Google (we receive a token and your basic profile, not your third-party password).

3.2 Content you create and save

• Saved meal sets, personal lists, recipe references (recipe name, protein type, and a source such as a cookbook + page or a web link), shopping lists, tags and notes;

• Your preferences and settings (for example the pantry-staples toggle).

Note on recipe content: MealStack stores references to where a recipe lives rather than full third-party recipe text. The lists and references you save are personal information to the extent they are linked to your account.

3.3 Purchase and subscription information

In-app purchases and subscriptions are processed by the Apple App Store and Google Play, not by us. We do not collect or store your full payment card details. We receive limited transaction and subscription-status information from those stores (for example whether you hold an active subscription, purchase and renewal dates, and a store-issued transaction identifier) so we can unlock paid features.

3.4 Technical, usage and device information

• Device type, operating system and app version;

• Log and diagnostic data such as IP address, crash reports, error logs and timestamps;

• Usage analytics about how features are used (for example which sets are opened), used in aggregated or de-identified form where practicable.

3.5 Communications

If you contact us for support or feedback, we collect the information in your message and our correspondence with you.

3.6 How we collect it (APP 3 & 5)

We collect personal information directly from you when you create an account, save lists, make a purchase, or contact us; and automatically through your use of the App. Where we collect information from a third party (such as an app store or sign-in provider), we take reasonable steps to ensure you are aware of the matters in APP 5 – including who we are, why we are collecting it, and how to access this Policy.

3.7 Unsolicited personal information (APP 4)

If we receive personal information we did not solicit, we will determine within a reasonable period whether we could have collected it under APP 3. If we could not, and the information is not contained in a Commonwealth record, we will destroy or de-identify it as soon as practicable if it is lawful and reasonable to do so.

4. Dealing with us anonymously or pseudonymously (APP 2)

You may browse the public, curated library of meal sets without creating an account. Where lawful and practicable, you may also deal with us using a pseudonym (for example a display name). However, to create an account, sync saved lists across devices, make a purchase or receive support, we generally need at least an email address, because it is impracticable to provide those features anonymously.

5. How we use your personal information (APP 6)

We use your personal information for the primary purpose for which it was collected and for related secondary purposes you would reasonably expect, including to:

• create, authenticate and manage your account;

• store and sync your saved meal sets, lists and recipe references;

• provide, personalise, maintain and improve the App and its features;

• verify your subscription status and provide paid features;

• respond to your enquiries and provide customer support;

• monitor, secure and troubleshoot the App, and detect and prevent fraud or misuse;

• comply with our legal obligations and enforce our Terms of Service; and

• with your consent, or where otherwise permitted, send you service and marketing communications (see section 7).

We will not use or disclose your personal information for an unrelated purpose without your consent, unless an exception under the Privacy Act applies (for example where required or authorised by law).

6. When we disclose your personal information

We do not sell your personal information. We may disclose it to:

• Service providers and contractors who help us run the App – for example cloud hosting and storage, application and database hosting, analytics, crash reporting, email delivery and customer-support tools – who are only permitted to use it to provide services to us;

• App stores and payment processors (Apple and Google) to the extent necessary to manage purchases and subscriptions;

• Professional advisers (such as lawyers and accountants) where reasonably necessary;

• A purchaser or successor if we sell or restructure all or part of our business (subject to this Policy);

• Law-enforcement agencies, regulators or others where required or authorised by law, or to protect the rights, property or safety of any person.

7. Direct marketing (APP 7)

We may use your email address to send you information about new meal sets, features and offers. Every marketing message will include a simple way to opt out (unsubscribe), and we will action opt-out requests promptly. You can also opt out at any time by emailing admin@yorktonholdings.com.au. We do not use sensitive information for direct marketing, and we do not provide your personal information to third parties for their own direct-marketing purposes.

8. Overseas disclosure (APP 8)

Some of our service providers (including cloud hosting, storage, analytics and crash-reporting providers) may store or process personal information outside Australia. Depending on the providers we use from time to time, this may include the United States, the European Union, the United Kingdom and other countries where reputable cloud providers operate.

Before disclosing personal information overseas, we take reasonable steps to ensure the overseas recipient handles it in a way consistent with the APPs – for example by using providers with recognised security and privacy certifications and by putting appropriate contractual protections in place. We will update this section as our providers change. If you would like to know the current countries in which your information may be stored, please contact us.

9. Government related identifiers (APP 9)

We do not use a government related identifier (such as a tax file number, Medicare number or driver licence number) as our own identifier for you, and we will not adopt, use or disclose such identifiers except where permitted under the Privacy Act. We do not ask you to provide these to use the App.

10. Data quality (APP 10)

We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date, complete and relevant. You can review and update much of your account information directly in the App, and you can ask us to correct information that is inaccurate (see sections 12 and 13).

11. Security of your information (APP 11)

We take reasonable technical and organisational steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• encryption of data in transit (for example HTTPS/TLS) and, where appropriate, at rest;

• hashing of passwords and use of secure authentication;

• access controls so that staff and contractors only access information on a need-to-know basis;

• use of reputable hosting providers with strong security practices; and

• regular review of our security practices and prompt application of updates.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security; however, we work to protect your information and to respond quickly if an issue arises.

11.1 Data breaches (Notifiable Data Breaches scheme)

We maintain a data breach response plan. If we suspect a data breach, we will assess it promptly (within 30 days). If an eligible data breach occurs that is likely to result in serious harm to an affected individual, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with Part IIIC of the Privacy Act.

12. How long we keep your information, and deletion

We keep personal information only for as long as it is reasonably necessary for the purposes set out in this Policy, or as required by law. Your account information and saved lists are retained while your account is active.

You may delete individual lists at any time in the App, and you may ask us to delete your account. When you close your account, we will delete or de-identify your personal information within a reasonable period, except where we are required or permitted by law to retain it (for example records of transactions for taxation purposes), in which case we will securely store it and limit access until it can be deleted. Where we no longer need information and are not required to keep it, we take reasonable steps to destroy or de-identify it (APP 11.2).

13. Accessing and correcting your information (APP 12 & 13)

You have a right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Much of this is available directly in the App. For other requests, contact us at admin@yorktonholdings.com.au.

We will respond to access and correction requests within a reasonable period (we aim for 30 days). We may need to verify your identity first. Access is usually free; if a charge applies for a more complex request, we will tell you in advance. If we decline a request, we will explain why in writing and how you can complain.

14. Cookies, analytics and tracking

Our website and App may use cookies and similar technologies, and analytics and crash-reporting tools, to keep you signed in, remember your preferences, understand usage and improve the App. You can manage cookies through your browser or device settings; disabling them may affect some features. Where required, we will seek your consent for non-essential cookies and analytics.

15. Children and young people

The App is intended for general audiences and is not directed at children under 15. We do not knowingly collect personal information from a child in circumstances that would require parental consent without taking appropriate steps. If you are under 18, you should review this Policy with a parent or guardian, and you must have their consent before making any in-app purchase.

We are monitoring the development of the Children’s Online Privacy Code (to be registered by 10 December 2026) and will update our practices to comply with it as it applies to the App. If you believe we hold information about a child that should not have been collected, please contact us and we will take appropriate steps to delete it.

16. Third-party links and services

The App contains references and links to third-party websites and services (for example recipe source pages and, in future, supermarket or grocery services). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with personal information.

17. Complaints and how to contact us (APP 1)

If you have a question, a request, or a complaint about how we handle your personal information, please contact our Privacy Officer:

Privacy Officer

Yorkton Holdings Pty Ltd

Email

admin@yorktonholdings.com.au

Post

PO Box 2486, Geraldton WA 6531

 

We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au  •  Phone: 1300 363 992

18. Changes to this Policy

We may update this Privacy Policy from time to time. The current version will always be available in the App and on our website, with the effective date shown at the top. If we make a significant change, we will take reasonable steps to notify you (for example by in-app notice or email). Your continued use of the App after a change takes effect means you accept the updated Policy.