Privacy Policy
YOHOTT PRIVATE LIMITED · CIN: U62011GJ2026PTC176170
Vadodara, Gujarat, India
1. Introduction
YOHOTT PRIVATE LIMITED (“YoHott”, “we”, “us”, or “our”), a company incorporated under the Companies Act, 2013, and registered in Vadodara, Gujarat, India (CIN: U62011GJ2026PTC176170), operates an AI-powered personal concierge service accessible on WhatsApp (the “Service”).
The Service is delivered through Nysaa, YoHott’s AI-powered concierge interface. Nysaa is a product feature of YOHOTT PRIVATE LIMITED and not a separate legal entity. YOHOTT PRIVATE LIMITED is the Data Fiduciary for all personal data processed through the Service, however it is delivered to you.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data. It has been prepared in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) made thereunder.
By subscribing to or using the Service, you acknowledge that you have read and understood this Privacy Policy. The consents on which we rely are described in Section 5.
2. Definitions
“User” or “You” means the individual who messages YoHott to use the Service.
“Payer” means the individual who subscribes to the Service and bears the cost of the subscription.
“Nysaa” means YoHott’s AI-powered concierge interface.
“Platform(s)” means the third-party merchants, marketplaces and service providers whose prices and availability we search and report.
“Request” means an instruction from you asking YoHott to look into an item or service and report what we find.
“Sensitive Categories” means Requests relating to medicines, pharmacy items and health.
“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
“Data Fiduciary” means YOHOTT PRIVATE LIMITED, as the entity that determines the purpose and means of processing your Personal Data.
“Data Principal” means you, the individual to whom the Personal Data relates.
3. Personal Data We Collect
3.0 In Short
We hold three kinds of information about you, and they are set out in full below:
Who you are and where you are — your name, your phone number and the delivery addresses you give us, including the labels you use for them.
What you have said to us — your WhatsApp conversations with Nysaa, including voice notes, images and any location you share.
What you have asked for — the items you asked about, the Platforms we searched, the prices we read, and when.
We do not hold your card details, and we do not hold the logins to your accounts with any Platform. Sections 3.1 and 3.4 explain both.
3.1 Information You Provide Directly
| Category | Examples | Purpose |
|---|---|---|
| Identity Information | Name, phone number (WhatsApp-enabled) | Account creation, user identification, communication |
| Delivery Information | Delivery addresses and the labels you give them | Obtaining prices and availability that are correct for where you live |
| Subscription Payment Information | The method used to pay the monthly Subscription Fee | Collecting the Subscription Fee only |
| Subscription & Payer Information | Payer name, email, phone number, relationship to User | Billing, payer notifications, account management |
| Preferences | Dietary restrictions, brand preferences, favourite restaurants, usual requests | Personalising recommendations, improving search accuracy |
| Invoicing Information | The state, or the country if outside India, of the person who pays the Subscription Fee; and their name and address only if they ask for these on the invoice | Issuing the GST tax invoice for each Subscription Fee and applying the tax that the law requires for that place |
| Invitations and Waitlist | Who invited you, and whom you invited; if you ask to join the waitlist without an invitation, your name, phone number, city and what you mainly want help with | Running invite-only access, holding a place for you, and telling you when a place opens |
| Area for a Coverage Check | The area and city you give if you ask us, while joining, which apps deliver near you | Carrying out that one check only. It is not kept once the check is complete |
We do not collect your card details. We do not ask for, receive or store your card number, CVV, expiry date, card type, network, or issuing bank. YoHott is never in the payment path for the goods you buy — you pay the Platform directly — so we have no need for them.
3.2 Information We Collect Automatically
| Category | Examples | Purpose |
|---|---|---|
| WhatsApp Conversation Data | The full content of your conversations with us — text messages, voice notes, images, and any location you share | Understanding your Request, reporting results, continuity between conversations, customer support |
| Request and Results History | Items you asked about, Platforms searched, prices read, timestamps | Service delivery, preference learning, investigating anything that goes wrong |
| Service Records | The records our systems create when carrying out your Request, including the delivery location used, what you asked for, and the information obtained | Carrying out your Request, and checking what we reported to you against what was published |
| Usage Patterns | Frequency of use, request times, category preferences | Service improvement, personalisation |
| Price Difference Records | For each Request counted under Section 7.4 of our Terms: the item, pack size, prices and Platforms Nysaa showed you, and the resulting Price Difference | Working out your Monthly Total, sending you your monthly note, and removing any line you dispute |
Your conversations with us are retained, not merely processed and discarded. We keep them so that Nysaa remembers what you told her last time, so that we can investigate any complaint about what was said, and for the periods set out in Section 7.
3.3 Information from Third Parties
To answer your Requests, we obtain pricing, availability and delivery information from the Platforms. We do not receive personal data about you from the Platforms.
3.4 Your Accounts with the Platforms
This section is included because it is a question customers reasonably ask, and because the answer matters.
We do not ask for, receive, store or use your login details, passwords, one-time passwords or session access for any Platform. We do not sign in as you and we do not operate your accounts.
You place your own orders, signed in as yourself, on your own device. We are not part of that step and we cannot see it.
When we search a Platform to answer your Request, we do so ourselves and not as you. Your account with that Platform is not used and is not involved. To make sure the prices we report are the ones available where you live, we provide a delivery location — see Section 6.1.
Any account you hold with a Platform, and anything you do on it, is governed by that Platform’s own privacy policy and not by this one.
If this ever changes, we will update this Policy before it does, and we will ask for your consent afresh rather than relying on your continued use of the Service.
4. How We Use Your Personal Data
We process your personal data for the following purposes, each grounded in a lawful basis under the DPDP Act:
To provide the Service — receiving your Requests on WhatsApp, looking into them for your delivery location, and reporting the results to you.
To remember you between conversations — so that Nysaa knows your usual addresses, your preferences and what you have asked for before, and you do not have to repeat yourself.
To personalise your experience — learning your preferences, dietary needs, favourite brands, and request patterns over time.
To keep the Payer informed — sending billing information and account updates, and information about your Requests only to the extent you have permitted under Section 6.4.
To collect the Subscription Fee — processing the monthly subscription payment and issuing a GST tax invoice for each payment.
To keep our Price Difference Commitment — working out your Monthly Total under Section 7.4 of our Terms and sending you your monthly note.
To run invite-only access — sending and counting invitations, holding a place while you join, and keeping the waitlist.
To investigate and resolve complaints — checking our records of what we read and what we reported, as described in Section 8 of our Terms.
To communicate with you — service updates, subscription reminders, and responding to your queries. Promotional messages are sent only with your separate marketing consent.
To comply with legal obligations — maintaining records as required by applicable Indian law, including the tax invoices and accounting records that GST law requires us to keep, and responding to lawful requests from authorities.
Improving and training our AI systems is not included in the purposes above. It is carried out only under the separate Improvement Consent described in Section 5, which you may decline or withdraw at any time without any effect on the Service you receive.
5. Consent
5.1 The consents we ask for, and how they are separated
We ask for your consents separately, and you may give some and not others.
Service Consent — processing the personal data needed to deliver what you asked for. Required; without it we cannot provide the Service.
Improvement Consent — using your interactions to improve and train our speech recognition, language understanding and service quality. Optional. You may decline it, or withdraw it later, and the Service you receive does not change in any way.
Marketing Consent — receiving promotional offers. Optional and separately withdrawable.
5.2 How and when we ask
We ask for these consents at signup and again at your first contact with the Service, in the language in which you signed up. We record which consents you gave and when, and you may ask us at any time which consents are recorded against your Account.
5.3 Payer and User
Where the Payer and User are different individuals, both must provide their own consents. The Payer consents during subscription; the User consents at first interaction. Neither person’s consent is treated as given on the other’s behalf.
5.4 Withdrawing consent
You may withdraw any consent at any time, as easily as you gave it — a message on WhatsApp, or an email to our Data Protection Contact (see Section 12), is enough.
Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
Withdrawing Improvement Consent or Marketing Consent has no effect on the Service.
Withdrawing Service Consent means we will no longer be able to provide the Service to you.
6. Sharing of Personal Data
We do not sell your personal data and we do not share it for advertising. We share your data only in the following circumstances and only to the extent necessary:
6.1 Third-Party Platforms
We do not create accounts, place orders, or tell a Platform who a search is for. We do not share your name or your phone number with any Platform.
To make sure the prices and availability we report are correct for where you live, we use your delivery location — which may be the locality, the pincode, the full address, or coordinates, in the form the Platform requires in order to return accurate results.
When you place an order yourself, you deal with that Platform directly and its own privacy policy governs the data you give it.
6.2 Subscription Payment Processors
We share the information needed to collect the monthly Subscription Fee with payment processors, currently Razorpay. This includes the Invoicing Information needed for the tax invoice. We are not involved in payment for goods: you pay the Platform directly, and YoHott neither sees, handles, holds nor routes that payment.
6.3 Technology Service Providers
We use third-party technology providers for messaging, for speech and language processing, and for cloud infrastructure. This means the content of your conversations with us is processed by those providers on our behalf. They are bound by contractual obligations to protect your data and to use it only as instructed by us, and they may not use it for their own purposes.
A current list of the categories of provider we use, and the countries in which they process personal data, is available on request from our Data Protection Contact.
6.4 What the Payer Sees
Where the Payer and the User are different individuals, what the Payer receives is set by the User.
By default the Payer receives billing information only — what was charged, when, and confirmation that the subscription is active.
The User may permit the Payer to receive, in addition: (a) Full Access — full Request history, including Sensitive Categories; or (b) Standard Access — the same, excluding Sensitive Categories.
Requests in Sensitive Categories — medicines, pharmacy items and health — are never disclosed to the Payer at any permission level below Full Access.
The User may change these permissions at any time. We will tell the Payer that a permission has changed, without telling them what it was.
The Payer cannot change the User’s permissions, cannot require us to disclose what the User has not permitted, and is not given access to the content of the User’s conversations with Nysaa at any permission level.
When a Payer pays for someone else, we tell the Payer when that person has joined and the number they joined from, so that the Payer can confirm the right person joined. This is part of the billing information the Payer receives.
Section 12 of our Terms and Conditions sets out the same arrangement in contractual terms.
6.5 Legal and Regulatory
We may disclose your data if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
6.6 Invitations
The Service is by invitation. When you join through a member’s invitation, we tell you that member’s name. If you try to join when all of that member’s invitations are in use, we tell the member your name so they know you tried. We never tell a member anything you ask Nysaa.
7. Data Storage and Retention
Your personal data is stored on secure servers located in India. We retain your data as follows:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account & identity information | Up to the duration of subscription + 3 years | Legal compliance, dispute resolution |
| Delivery addresses and preferences | Up to the duration of subscription, then deleted within 30 days of termination | Service delivery and continuity; no reason to keep them once you leave |
| Request and results history | Up to the duration of subscription + 3 years | Tax, audit, and investigating complaints about what we reported |
| Service records — the records our systems create when carrying out your Request, including the delivery location used, what you asked for, and the information obtained | Up to 12 months from the date of the Request | Checking what we reported against what was published, and resolving any complaint about it. Kept no longer than needed for that purpose. |
| WhatsApp conversation data | Up to the duration of subscription + 1 year | Service continuity, so Nysaa remembers what you told her; dispute resolution |
| AI training data | Indefinite, but only where irreversibly de-identified so that it can no longer be linked to you, directly or indirectly. Data that cannot be de-identified to that standard is deleted on the schedule for its original category. | Service improvement, under Improvement Consent only |
| Tax invoices, and the Invoicing Information on them | As long as tax law requires. Under GST law this is currently until 72 months after the due date of the annual return for the year of the invoice, or longer while an appeal or proceeding about that year is open | Keeping the records that GST law requires |
| Price Difference Records | Up to the duration of subscription + 1 year | Your Monthly Total, your monthly note, and resolving any dispute about a counted line |
| Invitation records (who invited whom) | Up to the duration of subscription + 1 year | Running invite-only access and invitation counts |
| Waitlist entries | Until you join, until you ask us to remove you, or 12 months after you joined the waitlist, whichever comes first | Telling you when a place opens |
| Area for a Coverage Check | Not kept once the check is complete | Used only for that check |
Upon expiry of the retention period, or upon your request for erasure (where applicable), we will delete or irreversibly anonymise your personal data within 30 days, unless retention is required by law.
8. Data Security
We implement reasonable technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:
Encryption of data in transit (TLS/SSL) and at rest.
Access controls limiting data access to authorised personnel only.
Secure cloud infrastructure located within India.
Regular review of security practices proportionate to our stage of operations.
While we take commercially reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.
Data breach notification. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in accordance with the DPDP Act and the DPDP Rules, 2025, within the timeframes prescribed, together with a description of the breach, its likely consequences, and the measures we are taking to address it.
9. Your Rights Under the DPDP Act
As a Data Principal, you have the following rights:
Right to access: You may request a summary of your personal data that we hold and the processing activities performed on it.
Right to correction: You may request correction of inaccurate or misleading personal data, or completion of incomplete data.
Right to erasure: You may request deletion of your personal data, subject to our legal obligations to retain certain records. This includes asking us to forget a particular address, preference or conversation without closing your Account.
Right to withdraw consent: You may withdraw consent at any time, as described in Section 5.4.
Right to nominate: You may nominate another person to exercise your rights on your behalf in the event of your death or incapacity.
Right to grievance redressal: You may raise a complaint with us. If you are not satisfied with our response, you may approach the Data Protection Board of India.
How to exercise them. Tell us on WhatsApp, in the language you normally use with us. You do not need to write in English, and you do not need to send a formal letter. Our contact details are in Section 12.
10. Children’s Data
The Service is intended for adults. The person who creates and holds an Account, and the Payer, must be at least 18 years of age. We do not knowingly create Accounts for, or directly collect personal data from, individuals under the age of 18. If we become aware that we have collected a minor’s personal data without verifiable parental or guardian consent, we will delete it.
Where the Service is in future provided to a User who is a minor (under 18), we will obtain verifiable consent from the User’s parent or legal guardian before processing the minor’s personal data, and we will not carry out tracking, behavioural monitoring, or targeted advertising directed at children, in accordance with the DPDP Act and the DPDP Rules, 2025.
11. Cross-Border Data Transfers
Your personal data is primarily stored and processed in India. However, some of our technology service providers (such as AI model providers and cloud sub-processors) may process data in jurisdictions outside India. Any such transfer will be conducted in compliance with the DPDP Act and applicable rules, including transfer only to jurisdictions not restricted by the Central Government.
Where communications are sent outside India, we ensure that they comply with applicable data protection requirements.
12. Grievance Officer and Data Protection Contact
Data Protection Contact — for queries and grievances relating to your personal data under the DPDP Act:
Dr. Sheetal Nair, Chief Culture Officer · dsn@yohott.com
Grievance Officer — appointed under the Information Technology Act, 2000 and the Consumer Protection Act, 2019:
Dr. Sheetal Nair, Chief Culture Officer · dsn@yohott.com
Address for both: YOHOTT PRIVATE LIMITED, Vadodara, Gujarat, India. Our full registered office address is on the public company record for CIN U62011GJ2026PTC176170, and we will give it on request to dsn@yohott.com.
We will acknowledge your query within 48 hours and endeavour to resolve it within 30 days. If you are dissatisfied with our resolution, you may file a complaint with the Data Protection Board of India.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes, we will notify you via WhatsApp message, and the updated policy will be available at yohott.com/privacy.
Material changes take effect no earlier than 30 days after we notify you. Where a change materially alters how we use your personal data, we will ask for your consent afresh rather than rely on your continued use of the Service.
14. Governing Law
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 (to the extent applicable), and rules made thereunder. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts in Vadodara, Gujarat, India, save that nothing in this Section affects the right of a consumer to bring proceedings before the consumer forum having jurisdiction where that consumer resides or works.