This policy is designed for users in India and aligns with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable Information Technology laws, to the extent they apply to Yuvavi POS.

1. Introduction

Yuvavi POS ("we," "our," or "us") operates https://pos.yuvavi.ai, a cloud restaurant management platform (POS, kitchen, QR ordering, optional CRM, Social Hub, WhatsApp Business tools, and related features). This Privacy Policy explains how we collect, use, disclose, store, and protect personal data.

By creating an account or using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

2. Who is responsible for data

2.1 Your restaurant account (you)

When you (a restaurant owner, staff user, or business) collect personal data from your guests, diners, WhatsApp contacts, or end customers (for example names, phone numbers, orders, loyalty, reservations), you are responsible for that collection under applicable law — including providing any notices/consent your guests need. We process such data on your instructions to provide the features you enable.

2.2 Platform account data (us)

For personal data of account holders and staff who register on Yuvavi POS (login phone/email, KYC you upload, billing contacts, support tickets), we act as the organization determining purposes of processing for operating the Service, billing, security, and legal compliance.

2.3 End customers of restaurants

If you are a diner who only used a restaurant's QR menu or WhatsApp, please contact that restaurant first. We can assist with deletion of data stored on our systems when the restaurant or you make a verified request (see Section 8).

3. Information We Collect

3.1 Information you provide

Account details (name, email, phone / WhatsApp number)
Restaurant / business details (name, address, GSTIN if provided, KYC documents)
Payment and subscription information (processed via third-party payment gateways; we do not store full card numbers on our servers)
Operational data you or your staff enter: menu, orders, tables, inventory, CRM, loyalty, bookings, messages, and similar business content
Support communications and feedback

3.2 Automatically collected information

Usage and feature analytics
Device, browser, IP address, and approximate location derived from IP
Authentication, session, and security logs
Cookies and similar technologies (Section 10)

3.3 Information from Meta (Facebook & Instagram)

When you use Social → Connected accounts and complete Facebook Login, we receive Platform Data from Meta only for Pages / Instagram Business accounts you authorize. We do not access personal friend lists or unrelated consumer profiles.

Page and Instagram identifiers, names, and profile metadata
Access tokens (stored encrypted) to call Meta APIs on your behalf
Posts, comments, and engagement managed in Social Publisher / Comment inbox
Insights and analytics for connected accounts
Webhook events for connected assets

3.4 WhatsApp Business (optional)

If you connect WhatsApp Business, we may store business phone identifiers, message metadata and conversation content you manage in our inbox, contacts you upload, templates/campaigns, and encrypted API credentials for Meta WhatsApp Cloud API or your configured gateway.

3.5 Google Business Profile (optional)

If you connect Google Business, we may store location identifiers, profile metadata, posts, reviews, and performance metrics for locations you authorize.

4. Purpose of processing & legal bases

We process personal data for:

Providing and securing the Service (accounts, POS, kitchen, QR, integrations)
Billing, invoices, GST-related records where applicable, and fraud prevention
Customer support and service communications
Improving reliability, performance, and product features
Complying with Indian law, tax, accounting, and lawful requests
Marketing about Yuvavi POS only with consent or as otherwise permitted by law (you may opt out)
Operating Social / WhatsApp / Google features you connect

Under the DPDP Act, processing is generally based on consent and/or legitimate uses necessary to provide the Service you request. You may withdraw consent where processing is consent-based; some features may then stop working.

We do not sell personal data. We do not use Meta Platform Data to build unrelated advertising profiles or for resale.

5. Data sharing

We may share data only as needed with:

Infrastructure and service providers (hosting, email/SMS/OTP, analytics subprocessors) under confidentiality obligations
Payment gateways to process subscription fees
Meta Platforms, Google, or WhatsApp infrastructure when you connect those integrations
Professional advisers (legal, accounting) under confidentiality
Government or law-enforcement agencies when required by Indian law or valid legal process
A successor entity in a merger or acquisition, with notice where required

6. Storage, security & cross-border transfer

We use technical and organizational measures appropriate to the risk (encryption in transit, access controls, credential hashing/encryption where applicable). No method of internet transmission or storage is 100% secure.

Data may be processed on servers in India and/or other countries where our providers operate. Where personal data is transferred outside India, we take reasonable steps consistent with applicable law to protect it.

7. Retention

We retain account and operational data while your subscription is active and as needed to provide the Service. After a verified deletion request, we delete or anonymize applicable data within 90 days, except where Indian tax, accounting, dispute, fraud-prevention, or other legal obligations require longer retention (we retain only what is necessary for that purpose).

8. Your rights (Data Principal)

Subject to the DPDP Act and other applicable law, you may request:

Access to personal data we hold about you
Correction of inaccurate personal data
Erasure / deletion (see Section 9)
Withdrawal of consent where processing is based on consent
Grievance redressal via the contact in Section 13

We may need to verify your identity before fulfilling requests. Some requests may be limited where law requires us to keep records or where data is needed to complete a transaction.

9. Data Deletion Instructions

Request deletion of data we hold about you or your business (including Meta-related data) using:

Email privacy@yuvavi.ai with subject Data deletion request — Yuvavi POS
Standalone page: https://pos.yuvavi.ai/data-deletion

You can delete data we hold about you or your business — including Meta (Facebook / Instagram) Platform Data and optional Google / WhatsApp connection data — by following these steps. Deletion removes data from our systems; it does not create any right to a refund, credit, or cash payment.

Step 1 — Disconnect Facebook / Instagram

Sign in at https://pos.yuvavi.ai
Open Social → Connected accounts (or the equivalent Social Hub screen)
For each Facebook Page or Instagram Business account, choose Disconnect

This revokes our access tokens and stops new collection from Meta for those assets.

Step 2 — Remove the app in Meta (recommended)

On Facebook: Settings & privacy → Settings → Apps and Websites → remove Yuvavi POS (or the app name shown). If Meta offers an in-product data-deletion request for the app, submit it; we process verified requests under this policy and our Privacy Policy.

Step 3 — Disconnect Google / WhatsApp (if used)

Google Business Profile: disconnect the location in Social Hub / Google settings in the product, and revoke access in your Google Account → Security → Third-party access if listed.
WhatsApp Business: disconnect the number / WABA link in Social Hub or WhatsApp settings in the product so we stop receiving new webhook/events.

Step 4 — Request deletion of your Yuvavi POS account / stored data

Email privacy@yuvavi.ai (or support@yuvavi.ai)
Subject: Data deletion request — Yuvavi POS
Include: legal/business name, registered phone or email, restaurant id if known, and scope (Meta only / Google only / WhatsApp only / full account)

We confirm receipt after identity verification and complete verified deletion or anonymisation within 90 days, except where Indian tax, accounting, dispute, fraud-prevention, or other law requires longer retention of limited records.

What we delete

Account and restaurant profile data you provided to us
OAuth / API tokens and social channel connections
Cached posts, comments, insights, and media metadata from Meta and other connected platforms
WhatsApp conversation/media we store for your inbox (where in scope of the request)
Tenant operational data as applicable to a verified full-account request

Minimal billing, tax, security, and legal records may be retained as required by law. Deletion of data does not entitle you to any refund, credit, compensation, or cash payment under our Terms or Cancellation & Refund Policy.

Full policy: Privacy Policy · Cancellation & Refund Policy

10. Cookies & similar technologies

We use essential cookies for login/security and may use analytics cookies to understand product usage. You can control cookies in your browser; disabling essential cookies may break the Service. Marketing pixels/tags on our marketing site (if any) are described in platform settings and can be controlled via browser tools where available.

11. Children

The Service is for businesses and users aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us for deletion.

12. Changes

We may update this Privacy Policy. The "Last updated" date will change. Material changes may be notified by email or in-product notice. Continued use after the effective date constitutes acceptance, except where Indian law requires a different process.

13. Grievance / contact

For privacy questions, Data Principal requests, or grievances under applicable Indian law:

Privacy / Grievance: privacy@yuvavi.ai
Support: support@yuvavi.ai
Address: Indore, Madhya Pradesh, India

We aim to acknowledge grievances promptly and resolve them within timelines required by applicable law.