Get OYY

Privacy Policy

How OYY handles your personal data

Large Box Consulting Pvt Ltd · Effective 2026-10-01

What we collect

OYY (operated by Large Box Consulting Pvt Ltd, CIN: U74999KA2022PTC162194) is the Data Fiduciary for personal data processed through the Platform. We collect the following categories of personal data:

  • Account data: name, email address, phone number, password (encrypted), and preferred language.
  • Business data (Owners): business name, category, address, operating hours, menu or catalogue, and payment details for billing.
  • Interaction data: messages sent to and from OYY Teammates, chat transcripts, session timestamps, and order or booking records.
  • Device and usage data: IP address, browser type, device identifiers, pages visited, and event logs — used for security and service improvement.
  • Payment data: transaction references processed by our payment providers. We do not store full card details.

We collect only what is necessary for the purposes described below, consistent with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the IT Act, 2000.

How we use it

We use your personal data to:

  • create and manage your account and authenticate you securely;
  • enable businesses to configure OYY Teammates and for customers to discover and interact with those businesses;
  • process payments and manage subscriptions;
  • run AI Teammate conversations — your interaction data is used to generate relevant responses and is subject to our AI provider contracts;
  • send transactional communications (confirmations, reminders, service notices);
  • ensure platform security, detect fraud, and comply with legal obligations;
  • improve the Platform through aggregated, anonymised analytics.

Our primary legal basis under the DPDP Act is your consent, which is specific, informed, and freely given. Where permitted by law, we may also rely on legitimate interests for security and fraud prevention, balanced against your rights.

Your personal data is never used for third-party advertising without separate consent.

Who we share with

We share personal data only as necessary and under contract with the following categories of recipients:

  • Businesses on OYY: when you interact with a business, your messages and order details are shared with that business so they can serve you.
  • AI model providers: interaction data is processed by AI model providers under contracts that restrict use to service purposes only.
  • Payment processors: transaction data is shared with payment providers (UPI, card networks) to complete payments.
  • Infrastructure providers: hosting, storage, and communications providers operating under data processing agreements.
  • Government and regulatory authorities: when required by law, court order, or lawful direction from a competent authority.

We do not sell your personal data. All Data Processors are bound by contract to process data only on our instructions and to maintain reasonable security safeguards.

Data retention

We retain personal data for as long as your account is active or as needed to provide the Platform, plus any period required by applicable law (e.g., financial records for 7 years under the Companies Act / GST rules).

When data is no longer needed, we securely delete or anonymise it. If you close your account, we initiate deletion within 30 days of your request, subject to any legal retention obligations.

Businesses that delete their OYY for Business account will have their business data deleted within 30 days; customer interaction records may be retained for the applicable legal period.

Your rights

As a Data Principal under the DPDP Act, 2023, you have the following rights:

  • Access: obtain a summary of your personal data and how it is being processed.
  • Correction and erasure: correct inaccurate data or request deletion, subject to legal retention requirements.
  • Withdraw consent: as easily as consent was given; withdrawal does not affect lawfulness of prior processing.
  • Grievance redressal: raise a complaint with our Grievance Officer (see Grievance Redressal).
  • Nominate: designate another person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact our Grievance Officer at largebox.working@gmail.com or write to admin.in@tryoyy.com. We will respond within the timelines required by law.

If your grievance is not resolved to your satisfaction, you may escalate to the Data Protection Board of India under the DPDP Act, 2023.

Cookies

We use cookies and similar technologies to maintain your session, remember preferences (language, region), and measure service performance through aggregated analytics.

  • Strictly necessary: required for the Platform to function (session, security).
  • Functional: remember your preferences and settings.
  • Analytics: aggregated, anonymised data to understand how the Platform is used and to improve it.

You can manage or disable cookies in your browser settings. Disabling strictly necessary cookies may prevent the Platform from working correctly.

Children

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children (persons under 18) without verifiable parental consent, as required by the DPDP Act, 2023.

We do not engage in tracking, behavioural monitoring, or targeted advertising directed at children.

If you believe a child's data has been collected without appropriate consent, please contact us at admin.in@tryoyy.com and we will promptly investigate and delete any such data.

Contact us

For privacy matters, data requests, or complaints, contact:

We may update this Policy from time to time. Material changes will be communicated through the Platform or by email. The updated Policy will be published on tryoyy.com/privacy with the revised effective date.

This Policy is governed by the laws of India. Disputes are subject to the jurisdiction of the courts at Bengaluru, Karnataka, India.