Privacy Policy

Yes Sir Yes Mam (“we”, “us”, “our”) provides a menu, point-of-sale, order, kitchen, billing, Khata Book, subscription, and business-management platform for cafes, restaurants, food carts and other food businesses (“Vendors”). The Service is available through yessiryesmam.com, order.yessiryesmam.com, our related web applications, and the Yes Sir Yes Mam Vendor mobile app for Android and iOS (collectively, the “Service”). The Service is used by Vendors in India and in other countries (“International Vendors”); where something works differently for International Vendors, this policy says so.

This Privacy Policy explains what information we collect and process when Vendors, their authorized staff, and a Vendor’s customers interact with the Service, how that information is used and shared, how long it is kept, and the choices available.

1. Who this policy applies to

The Service is a business tool used by Vendors and their authorized staff to manage menus, create and manage orders, record how orders were paid, operate kitchen workflows, manage staff, keep customer credit (Khata Book) records, issue bills and invoices, and manage their subscription.

This policy also applies to information about a Vendor’s customers that the Vendor enters into the Service or that the Service creates when the Vendor issues a bill, records a credit sale, or sends a digital bill, and to customers who open a bill link. It also applies to people who submit a form on our website.

Yes Sir Yes Mam does not receive, hold, or settle money that a Vendor’s customer pays to the Vendor by cash, UPI, card, or any other method. Vendors only record those payments in the Service for their own records. Payments that Vendors make to us, such as subscription charges and WhatsApp credit purchases, are processed by Razorpay for Vendors in India and by PayPal for International Vendors, as described in section 9.

For customer information, the Vendor decides what to record and why. We process that information on the Vendor’s behalf to provide the Service, and as described in this policy.

2. Information we collect

Vendor account and business information

• Business name, owner name, mobile phone number, business type, country, state, city, pincode, business address, time zone, business logo, an internal business code, and account and onboarding status. The currency shown in the Service is set from the Vendor’s country.
• Where the Vendor enables GST billing: GST registration status, GSTIN, legal business name, billing address, billing pincode and state, invoice prefix, and FSSAI number.
• Vendors in India: we do not ask for an email address. The Service creates an internal account identifier from the registered phone number; it is not used to contact you.
• International Vendors: an email address, which is used to sign in, to verify the account, to reset the password, and for service-related communications. We also collect a contact phone number with its country code; this number is not verified and is not used to sign in.

Staff information

• Staff names, their assigned permissions (orders, menu, kitchen), active status, a staff login code, and a PIN. PINs are stored only as a secure hash.

Business and operational records

• Menu categories, menu items, variants, prices, images, GST rates, and menu ordering.
• Orders, order items, order numbers, order dates and times, order type (for example Dine In, Takeaway, Zomato or Swiggy), order and kitchen status, and notes.
• For orders received through third-party platforms such as Zomato or Swiggy, an optional order amount the Vendor enters for reference. These amounts are not counted as payments in the Service.
• How an order was paid: payment method, split-payment amounts, Khata Book entries, and payment dates.
• Cash Received: when a Vendor uses the change calculator for a cash payment, the amount of cash the customer handed over may be saved with the order for the Vendor’s reference. It is not counted as a payment or sale.
• Expenses, expense categories, unrecorded sales, and Account Statement reports and exports.

Customer information (entered or created by the Vendor)

See section 4 for details.

Subscription, payment and WhatsApp credit information

• Subscription plan, billing period, status, renewal and AutoPay mandate status, subscription invoices, and Razorpay or PayPal references and payment details as described in section 9.
• WhatsApp credit balances, credit purchases, and a ledger of credits used.

Authentication and security information

• Passwords and PINs, stored only as secure hashes.
• One-time passcodes (OTPs) for registration, password reset, and account deletion requests made on our website. Codes are stored only as hashes, together with the phone number or, for International Vendors, the email address, and the IP address, number of attempts, and expiry time used to prevent abuse.
• Sign-in tokens for the mobile app and staff sign-in, which record the device name supplied by the app and when the token was last used.

Notification and device information

• For the mobile app: an Expo push token, device platform, device name as set on the device, app version, and the last time the device was seen.
• In-app notifications: title, message, linked screen, time, and read status.

Technical information

• At registration: the IP address, browser or device user agent, and registration source (for example web or app).
• For web sign-in sessions: the IP address, browser user agent, and last activity time, stored on our server.
• Server and application logs, including errors, which may contain request details, used for security and troubleshooting.

Website forms

• When you request early access to the app on our website, we collect your name, mobile number, business name, and city, along with the IP address and browser user agent of the request. We use this only to contact you about access to the app.

3. Phone numbers, email addresses, OTPs and password reset

When a Vendor in India registers or resets their password, we send a one-time passcode to the phone number provided using Meta’s WhatsApp Business Platform (WhatsApp Cloud API). To do this, Meta receives the phone number and the passcode message.

When an International Vendor registers or resets their password, we send the one-time passcode by email to the email address provided, from support@yessiryesmam.com using our email provider, Zoho Mail. Zoho receives the email address and the passcode message. We use the email address to verify that the Vendor controls it, to sign in and reset access, to send security, subscription, billing and other service-related communications, and to provide support. We do not use it for marketing unless the Vendor has separately agreed, and we do not sell email addresses.

We use the Vendor’s phone number to:

• Verify that the Vendor controls the phone number;
• Sign in, reset access, and help secure the account;
• Send security, subscription, billing, or other service-related communications; and
• Provide support and respond to account requests.

To prevent abuse, we limit how many passcodes can be requested per phone number or email address and per IP address, and we record the IP address and attempt count with each request. Where enabled, we may also use Cloudflare Turnstile to check that a request comes from a person rather than an automated script; in that case Cloudflare receives the check token and your IP address.

We do not use a Vendor’s phone number for marketing or promotional messages unless the Vendor has separately agreed to receive them, and we do not sell phone numbers.

4. Customer information, visit history and Khata Book

What Vendors can record about their customers

• Customer records: a customer’s mobile number and name, saved per Vendor. A phone number is saved once per Vendor; the same customer is never duplicated within that Vendor’s account.
• Bills and invoices: when a Vendor issues a GST bill, the invoice stores the Vendor’s business details, the items, amounts and taxes, and, where provided, the customer’s name and mobile number.
• Khata Book (credit sales): for credit sales on the Starter plan, the customer name the Vendor enters, an optional note, the amount due, and when and how it was paid.
• Khata Book (Restaurant Pro): a customer-wise record of credit orders linked to the customer’s record, the outstanding balance, and each payment received, including the amount, payment method, date and time, an optional note, and which orders each payment cleared. Vendors can rename a Khata Book customer; the phone number does not change.

Visit and spending history

Each time a Vendor issues a bill that is linked to a customer’s mobile number, the Service updates that customer’s record with the first and most recent visit, the number of visits, and the total amount spent with that Vendor. Khata Book balances are calculated from the customer’s credit orders and the payments recorded against them.

Who can see customer information

• The Vendor: a Vendor can see only their own customers, bills and Khata Book or Khata Book records. One Vendor can never see another Vendor’s customers. Khata Book screens are available only to the Vendor’s owner account; staff who can view orders may see the customer name shown on a credit order.
• Platform administrators: a limited number of authorized Yes Sir Yes Mam administrators can view customer records across Vendors (customer name, mobile number, the Vendor, and visit and spending totals) to operate, support, and secure the Service. Administrators do not use this information for marketing.
• The customer: a customer who receives a digital bill can open that bill through its link (see section 5). Customers do not have accounts in the Service.

We do not sell customer information or use a Vendor’s customer list for advertising.

5. Digital bills, WhatsApp messages and bill links

Restaurant Pro Vendors can send a digital bill to a customer on WhatsApp. When a Vendor sends a bill, we send a pre-approved WhatsApp message through Meta’s WhatsApp Cloud API. Meta receives the customer’s mobile number, the order number, the Vendor’s business name, and a link to the bill.

For each bill message we keep a record of the customer mobile number the bill was sent to, the delivery status, Meta’s message identifier, the number of attempts, any error returned, and when the message was accepted. Each bill message uses one of the Vendor’s WhatsApp credits.

A bill link opens the bill page and a downloadable PDF without requiring the customer to sign in. The page shows the Vendor’s business and GST details, the items, amounts and taxes. It does not show the customer’s name or mobile number. Each link contains a long random token that cannot be guessed from other bills. Bill links currently do not expire, so anyone who has the link can open that bill while it exists. Customers should not forward a bill link to people who should not see it.

6. How we use information

• To create, operate, secure, and support Vendor and staff accounts;
• To provide menu, ordering, payment recording, kitchen, staff, billing, invoice, Khata Book, expense, and reporting features;
• To maintain customer records, visit history, and Khata Book balances for the Vendor;
• To generate and deliver digital bills when the Vendor sends them;
• To manage subscriptions, renewals, AutoPay mandates, WhatsApp credits, and Vendor purchases;
• To send OTPs, push notifications, in-app notifications, service notices, and support replies;
• To respond to early-access requests made on our website;
• To maintain, troubleshoot, protect, and improve the Service;
• To prevent abuse, unauthorized access, and fraud; and
• To comply with legal, tax, accounting, and regulatory obligations.

We do not use Vendor, staff, or customer information for third-party advertising, and the Service does not include advertising, analytics, or crash-reporting software.

7. Recorded customer payments and business records

Vendors record how an order was paid, including cash, UPI, card, custom online methods, split payments, and Khata Book. These are business records created by the Vendor. Yes Sir Yes Mam is not the payment processor, bank, wallet, or settlement provider for payments made by a Vendor’s customers.

Account Statement, dashboard, sales, expense, Khata Book, and related reports are generated from these records as bookkeeping tools for the Vendor. Vendors can export an Account Statement as a PDF and share it using their device’s share options.

8. Staff accounts

Vendors can add staff and choose what each staff member can do. Staff sign in with the business code, their staff login code, and a PIN. Actions staff take in the Service, such as creating orders or updating kitchen status, are saved as part of the Vendor’s business records. The Vendor can deactivate a staff member at any time.

9. Vendor subscriptions, AutoPay, PayPal and WhatsApp credit purchases

For Vendors in India, subscription payments, UPI AutoPay mandates, and WhatsApp credit purchases are processed by Razorpay. Payment details are entered in Razorpay’s checkout, which the web app loads from Razorpay and the mobile app opens through Razorpay’s software. We do not receive or store full card numbers, CVV, UPI PINs, or banking passwords.

We store Razorpay customer, order, payment, subscription and mandate identifiers, amounts, status, billing periods, and timestamps. When Razorpay notifies us about a payment or subscription event, we store the notification it sends. Depending on the payment method, these notifications can include the payer’s email address or phone number, UPI ID, card network and last four digits, bank or wallet name, and payment status. We use this to confirm payments, manage subscriptions, prevent duplicate processing, and resolve disputes.

See Razorpay’s Privacy Policy for how Razorpay handles your information.

International Vendors: PayPal subscriptions

International Vendors subscribe to a monthly plan billed in US dollars through PayPal. The Vendor approves the subscription on PayPal’s own pages (in the web app, or in a secure browser window opened by the mobile app) and pays with their PayPal account or a card added there. We do not receive or store card numbers, CVV, or PayPal passwords.

We store the PayPal subscription, plan and transaction identifiers, amounts, currency, status, billing dates, and the payer’s name, email address and PayPal payer ID as returned by PayPal. When PayPal notifies us about a payment or subscription event, we store the notification it sends. We use this to confirm payments, keep the subscription up to date, issue invoices, prevent duplicate processing, and resolve disputes. Invoices for International Vendors are issued in US dollars and do not include Indian GST.

See PayPal’s Privacy Statement for how PayPal handles your information.

10. Push notifications and notification inbox

The mobile app can send push notifications about subscriptions, renewals, WhatsApp credit purchases, low-credit alerts, and other service notices. To do this, we register the device with Expo’s push notification service and store the Expo push token and device details listed in section 2. Expo delivers the notification title and message through Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS).

Notifications are also kept in an in-app inbox with their title, message, linked screen, time, and read status. You can turn off push notifications in your device settings.

11. Mobile app permissions and on-device storage

• Photo library: used only when you choose a picture, such as a business logo. Only the picture you select is uploaded. The app does not use your camera or microphone.
• Face ID, fingerprint or device passcode: used only if you turn on App Lock. Authentication is done entirely by your device; we never receive or store biometric data.
• Notifications: used to show push notifications if you allow them.
• On-device storage: the app stores your sign-in token, App Lock setting, and display preferences (such as the Orders theme and screen layout) in your device’s secure storage. Signing out removes the sign-in token.
• Advertising measurement (Meta): the mobile app includes the Meta (Facebook) SDK so we can measure which of our Facebook and Instagram ads bring Vendors to the app. On Android it runs only if you tap Allow on the in-app notice. On iPhone, your device’s advertising identifier is used only if you allow tracking when the app asks; if you choose “Ask App Not to Track”, Meta receives only limited, non-identifying measurement as permitted by Apple.
• Crash reports: if the app crashes or hits an error, it sends us the error message and technical details (the screen it happened on, device model, operating system and app version, and the business ID if you are signed in) so we can fix the problem. Each error is sent at most once a day. Crash reports do not include customer details, orders, payments or passwords, are not used for advertising, and are not shared with anyone.
• Payments: Razorpay’s payment software may use device capabilities it needs to complete or secure a payment, as described in Razorpay’s policy. For International Vendors, PayPal opens in a secure browser window and returns to the app when the subscription is approved.

The app does not access your location, contacts, camera, or microphone. It uses your device’s advertising identifier only for the advertising measurement described above, and only with your permission. Uninstalling the app removes its on-device data but does not delete your account or business records.

12. Cookies, sessions and browser storage

Our web applications use cookies that are needed to sign you in, keep your session active, and protect against cross-site request forgery. Session details, including IP address, browser user agent, and last activity time, are stored on our server.

The web app also stores preferences in your browser, such as theme, list view and sort order, dismissed notices, and an unsaved order draft for the current browser session. It can be installed as a web app and stores app files in your browser so it loads quickly. Our websites do not use advertising, analytics, or cross-site tracking cookies.

13. Service providers and data sharing

We do not sell Vendor, staff, business, or customer information. We share information only with service providers that help us run the Service, and only what they need:

• Meta (WhatsApp Cloud API): phone numbers, OTP messages, and digital-bill messages (customer mobile number, order number, business name, and bill link).
• Meta (Facebook SDK, mobile app only, with your permission): your device’s advertising identifier (where allowed), device and app information (such as model, operating system, language and app version), and app events: installing and opening the app, completing registration, starting a free trial, your first order, and your first subscription payment (amount and currency). We use this only to measure and improve our advertising. We do not share your menu, orders, customers, Khata Book or payment details with Meta. Meta processes this data under its own privacy policy.
• Razorpay: Vendor subscription, AutoPay, and WhatsApp-credit payments for Vendors in India, and the payment details described in section 9.
• PayPal: subscription payments for International Vendors, and the payment details described in section 9.
• Zoho Mail: sending email passcodes and service emails to International Vendors (email address and message content).
• Expo, Google and Apple: push tokens and notification content, to deliver push notifications.
• Cloudflare: bot-protection checks during OTP requests, where enabled.
• Hosting providers: our websites are hosted on Vercel, and our application server and database are hosted by our infrastructure provider. They store and process data only to run the Service.

International Vendors: our application server and database are operated from India, and some of our service providers process information in other countries. If you use the Service from outside India, your information is transferred to and processed in India and in the countries where these providers operate, with the safeguards described in this policy.

We may also disclose information where reasonably necessary to comply with law, legal process, or lawful government requests; to protect the rights, security, and integrity of the Service, our users, or others; or to investigate fraud, abuse, or security incidents.

14. Data retention

We keep Vendor account and business information, including orders, payments, invoices, customer records, Khata Book records, expenses, and reports, for as long as the Vendor’s account exists. Many of these are financial and tax records that the Vendor may be required to keep.

• OTP records, WhatsApp message records, registration IP and device details, push device records, and in-app notifications are currently kept while the account exists and are removed when the account is deleted.
• Razorpay and PayPal payment notifications are kept as records of payments made to us, including after an account is deleted, where needed for tax, accounting, and dispute purposes.
• App crash reports are kept only as long as needed to find and fix the problem.
• Signed-out or expired web sessions are removed from our server periodically.
• Registrations that were started but never completed may be removed by our team.
• Early-access requests from our website are kept until we have handled the request, or until you ask us to delete them.
• Account deletion requests are kept as a record that the request was received and handled.

After an account is deleted, we may keep limited records where the law requires it or where needed to resolve disputes, prevent fraud, or meet tax and accounting obligations, for example records of payments made to us.

15. Your rights and choices

Vendors can view and update their business profile, GST and billing details, staff, menu, and operational records in the Service. Vendors can also ask us for a copy of, correction to, or deletion of personal information in their account by contacting us.

Customers of a Vendor: if you are a customer and want your name, mobile number, visit history, bills, or Khata Book records corrected or deleted, please contact the Vendor first, as they manage these records. You can also contact us at the address below; we will work with the Vendor to handle your request, subject to records the Vendor must keep by law, such as tax invoices.

You can turn off push notifications and App Lock at any time in your device or app settings.

Advertising measurement: on Android you can choose No thanks on the in-app notice, and reset or delete your advertising ID in your phone’s settings (Settings → Google → Ads). On iPhone you can turn off tracking at any time in Settings → Privacy & Security → Tracking.

16. Account deletion

The business owner can request deletion of their Vendor account in either of these ways:

• In the mobile app: Account > Delete Account > Request Account Deletion.
• On our website at yessiryesmam.com/delete-account, after verifying the registered mobile number with a WhatsApp code.
• International Vendors can request deletion in the mobile app, or by emailing support@yessiryesmam.com from their registered email address.

We record each request with the business name, registered phone number or email address, the date, where it was made, and any reason given. Submitting a request does not immediately deactivate or delete the account; the account keeps working while our team reviews the request. The owner can cancel a request until our team starts processing it.

Our team reviews and processes valid requests within 30 days, subject to applicable legal record-retention obligations. When a request is processed, we delete the Vendor’s account and the personal and business information linked to it, including staff accounts, menu, orders, customer records, Khata Book records, notifications, and push devices. Some information may be kept where the law requires it or for legitimate purposes such as tax, accounting, fraud prevention, or resolving disputes, for example invoices and records of payments made to us. We confirm completion on the registered phone number, or by email for International Vendors. An active PayPal subscription is cancelled when the account is deleted. We keep a record of the deletion request itself as evidence that it was handled.

Deleted information cannot be recovered, so Vendors should export any records they need, such as Account Statements, before the request is processed. Uninstalling the app does not delete an account.

17. Security

We use reasonable safeguards to protect information, including HTTPS encryption in transit, hashed passwords, PINs and passcodes, limits on OTP requests, access controls that keep each Vendor’s data separate, and secure on-device storage for sign-in tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

18. Children’s privacy

The Service is intended for adults operating or working in a food business. It is not directed to children, and we do not knowingly create accounts for children.

19. Changes to this policy

We may update this Privacy Policy as the Service or our practices change. We will update the “Last updated” date when we publish a revised version.

20. Contact us

For questions about this Privacy Policy or to make a privacy, correction, or deletion request, contact us at info@yessiryesmam.com or support@yessiryesmam.com.