This policy explains how Yoorie handles personal data in Billowa, in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000. Contact: hello@yoorie.com.
1. Our two roles
- Account holders (restaurant owners and their staff): Yoorie is the Data Fiduciary for the data we need to run your account.
- Your customers (people who order, pay or are billed at an outlet that uses Billowa): the outlet is the Data Fiduciary; Yoorie processes that data only on the outlet’s instructions, as its Data Processor.
2. What we collect
- Account data: name, email, phone, business name, address, GSTIN, staff names, roles and PINs (stored hashed).
- Business data you enter: menu, prices, stock, bills, payments, reports.
- Customer data entered by outlets or by guests ordering online: name, phone, delivery address, order history, and buyer GSTIN for B2B bills.
- Technical data: device identifiers for paired tills, IP address, browser type, and logs needed for security and troubleshooting.
- We do not store card or UPI credentials; payments are handled by the payment gateway.
3. Why we use it
To provide and secure the Service, sync your tills, send transactional messages (password resets, daily summaries, order updates), bill you for your plan, meet legal and tax obligations, and give support. We do not sell personal data and do not use your customers’ data for our own marketing.
4. Consent and legitimate uses
We process account data on the basis of your consent given at signup and for the legitimate uses allowed by the DPDP Act (such as performing the service you asked for and complying with law). You may withdraw consent at any time by writing to us; this may mean we can no longer provide the Service.
5. Sharing
Only with service providers who help us run Billowa (hosting, email delivery, payment gateways, the GST e-invoice system if you enable it), under contracts that require them to protect the data; and with authorities when required by law. Data is hosted with our hosting provider; where it is processed outside India, we follow any restrictions notified under the DPDP Act.
6. Retention
We keep account and business data while your account is active. Tax records may need to be kept for the period required under GST law (generally at least 6 years); otherwise we delete or anonymise data within 90 days after an account is closed, except backups which expire on their normal cycle.
7. Your rights
Under the DPDP Act you can ask to access a summary of your personal data, correct or update it, erase it (subject to legal retention), nominate another person to exercise your rights, and raise a grievance. Customers of an outlet should contact that outlet first; we will help the outlet respond. Write to hello@yoorie.com; we aim to respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
8. Security
We use encrypted connections (HTTPS), hashed passwords and PINs, per-business data separation, role-based access and audit logs. No system is perfectly secure; if a personal data breach occurs we will notify affected users and the Data Protection Board as the law requires.
9. Children
The Service is for businesses and is not directed at children. We do not knowingly process the data of children under 18 except as incidental customer records entered by an outlet.
10. Grievance officer
Grievance Officer, Yoorie: hello@yoorie.com.
11. Changes
We will post updates here with a new date and notify account owners of significant changes.