Privacy Policy
1 Introduction
YOHOTT PRIVATE LIMITED ("YoHott", "we", "us", or "our"), a company incorporated under the Companies Act, 2013, and registered at 10, Kings Villa, Kalali-Talasat Road, Kalali, Vadodara – 390012, Gujarat, India, operates an AI-powered personal concierge service accessible via telephone calls and WhatsApp (the "Service").
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our Service. It has been prepared in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules made thereunder.
By subscribing to or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
2 Definitions
In this Privacy Policy, the following terms carry specific meanings:
- "User" or "You" means the individual who calls or messages YoHott to place orders or use the Service (the person who calls and orders).
- "Payer" means the individual who subscribes to the Service and bears the cost of orders placed by the User. A Payer and User may be the same person, or the Payer may be a family member (for example, an NRI child paying for a parent in India).
- "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
- "Data Fiduciary" means YOHOTT PRIVATE LIMITED, as the entity that determines the purpose and means of processing your Personal Data.
- "Data Principal" means you, the individual to whom the Personal Data relates.
3 Personal Data We Collect
We collect only the personal data necessary to provide the Service. The categories are as follows:
3.1 Information You Provide Directly
| Category | Examples | Purpose |
|---|---|---|
| Identity Information | Name, phone number (WhatsApp-enabled) | Account creation, user identification, communication |
| Delivery Information | Delivery addresses, address labels (e.g. "office wala address") | Fulfilling orders on third-party platforms |
| Payment Information | Preferred payment method (UPI, COD), credit/debit card details shared for offer optimisation | Processing payments, applying card-specific offers and cashback |
| Subscription & Payer Information | Payer name, email, phone number, relationship to User | Billing, payer notifications, account management |
| Preferences | Dietary restrictions, brand preferences, favourite restaurants, usual orders | Personalising recommendations, improving order accuracy |
3.2 Information We Collect Automatically
| Category | Examples | Purpose |
|---|---|---|
| Voice Call Recordings | Audio recordings of calls made to the YoHott number | Order processing, quality assurance, training AI models, dispute resolution |
| WhatsApp Conversation Data | Text messages, voice notes, images, and location data shared via WhatsApp | Order processing, confirmation, tracking, customer support |
| Order History | Items ordered, platforms used, prices, timestamps, delivery status | Service delivery, preference learning, billing reconciliation |
| Usage Patterns | Frequency of calls, order times, category preferences | Service improvement, personalisation |
3.3 Information from Third Parties
We may receive limited information from the third-party platforms on which we place orders on your behalf (e.g. order confirmation numbers, delivery status updates, and pricing information from Swiggy, Zomato, Blinkit, Zepto, BigBasket, BookMyShow, and similar platforms).
4 How We Use Your Personal Data
We process your personal data for the following purposes, each grounded in a lawful basis under the DPDP Act:
- To provide the Service — receiving your orders via call or WhatsApp, comparing prices across platforms, placing orders, processing payments, and sending confirmations.
- To optimise your savings — matching your credit/debit cards with platform-specific offers, cashback deals, and promotional pricing.
- To personalise your experience — learning your preferences, dietary needs, favourite brands, and ordering patterns over time.
- To notify the Payer — sending order confirmations, billing summaries, and account updates to the Payer's phone number or email.
- To improve and train our AI systems — using anonymised or de-identified call recordings and conversation data to improve speech recognition, language understanding, and service quality.
- To communicate with you — service updates, subscription reminders, promotional offers (with your consent), and responding to your queries.
- To comply with legal obligations — maintaining records as required by applicable Indian law, responding to lawful requests from authorities.
- To resolve disputes and enforce our terms — investigating complaints, processing refunds, and enforcing our Terms of Service.
5 Consent
Under the DPDP Act, we process your personal data on the basis of your consent, which you provide when you subscribe to the Service and agree to this Privacy Policy. Specific consent mechanisms include:
- Voice call consent: At the start of your first call, we inform you that the call is being recorded and that your data will be processed in accordance with this Privacy Policy. Continued use of the Service constitutes consent.
- WhatsApp consent: When you first interact with our WhatsApp business number, we share a link to this Privacy Policy and request your acknowledgement before proceeding.
- Payer consent: Where the Payer and User are different individuals, both must provide consent. The Payer consents during subscription; the User consents upon first interaction.
You may withdraw your consent at any time by contacting us (see Section 12). Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal but may result in our inability to continue providing the Service to you.
6 Sharing of Personal Data
We do not sell your personal data. We share your data only in the following circumstances and only to the extent necessary:
6.1 Third-Party Platforms
To fulfil your orders, we share relevant information (such as your name, delivery address, and order details) with the platforms from which we place orders on your behalf, including but not limited to Swiggy, Zomato, Blinkit, Zepto, BigBasket, and BookMyShow. These platforms have their own privacy policies that govern their use of your data.
6.2 Payment Processors
We share payment-related information with payment gateways to process transactions. We do not store your complete card details on our systems; card information is handled by PCI-DSS compliant payment processors.
6.3 Technology Service Providers
We use third-party technology providers for telephony, WhatsApp Business API, voice AI (speech-to-text and text-to-speech), large language models, and cloud infrastructure. These providers process data on our behalf and are bound by contractual obligations to protect your data and use it only as instructed by us.
6.4 Payer Visibility
Where the Payer and User are different individuals, the Payer will have visibility into order confirmations, order history, and billing summaries relating to the User's account. Both parties are informed of this arrangement at the time of subscription.
6.5 Legal and Regulatory
We may disclose your data if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
7 Data Storage and Retention
Your personal data is stored on secure servers hosted in India (AWS Asia Pacific — Mumbai region). We retain your data as follows:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account & identity information | Duration of subscription + 3 years | Legal compliance, dispute resolution |
| Order history & transaction data | Duration of subscription + 3 years | Tax, audit, refund verification |
| Voice call recordings | 90 days from date of call (unless dispute is pending) | Quality assurance, dispute resolution |
| WhatsApp conversation data | Duration of subscription + 1 year | Service continuity, dispute resolution |
| AI training data (anonymised) | Indefinite (de-identified, non-personal) | Service improvement |
Upon expiry of the retention period, or upon your request for erasure (where applicable), we will delete or irreversibly anonymise your personal data within 30 days, unless retention is required by law.
8 Data Security
We implement reasonable technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:
- Encryption of data in transit (TLS/SSL) and at rest.
- Access controls limiting data access to authorised personnel only.
- Secure cloud infrastructure hosted within India (AWS Mumbai region).
- Regular review of security practices proportionate to our stage of operations.
While we take commercially reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.
9 Your Rights Under the DPDP Act
As a Data Principal, you have the following rights under the DPDP Act, 2023:
- Right to access: You may request a summary of your personal data that we hold and the processing activities performed on it.
- Right to correction: You may request correction of inaccurate or misleading personal data, or completion of incomplete data.
- Right to erasure: You may request deletion of your personal data, subject to our legal obligations to retain certain records.
- Right to withdraw consent: You may withdraw consent for data processing at any time. This does not affect the lawfulness of processing before withdrawal.
- Right to grievance redressal: You may raise a complaint with us. If you are not satisfied with our response, you may approach the Data Protection Board of India.
To exercise any of these rights, please contact us using the details in Section 12.
10 Children's Data
The Service is not directed at individuals below the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided personal data to us, please contact us and we will take steps to delete such data.
Where a User is a minor (under 18), the Payer or parent/legal guardian must provide verifiable consent for the processing of the minor's personal data, in accordance with the DPDP Act.
11 Cross-Border Data Transfers
Your personal data is primarily stored and processed in India. However, some of our technology service providers (such as AI model providers and cloud sub-processors) may process data in jurisdictions outside India. Any such transfer will be conducted in compliance with the DPDP Act and applicable rules, including transfer only to jurisdictions not restricted by the Central Government.
Where the Payer is located outside India (e.g. NRI families), we ensure that communications sent to the Payer comply with applicable data protection requirements.
12 Grievance Officer and Contact Information
In accordance with the DPDP Act, we have appointed the following officer to address your data protection queries and grievances:
Name: Dr. Sheetal Nair, Chief Culture Officer
Email: dsn@yohott.com
Address: YOHOTT PRIVATE LIMITED, 10, Kings Villa, Kalali-Talasat Road, Kalali, Vadodara – 390012, Gujarat, India
We will acknowledge your query within 48 hours and endeavour to resolve it within 30 days. If you are dissatisfied with our resolution, you may file a complaint with the Data Protection Board of India, once constituted under the DPDP Act.
13 Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes, we will notify you via WhatsApp message or during your next call. The updated policy will also be available at yohott.com/privacy.
Your continued use of the Service after we post changes constitutes acceptance of the updated Privacy Policy.
14 Governing Law
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 (to the extent applicable), and rules made thereunder. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts in Vadodara, Gujarat, India.