Privacy Policy

1. Who we are

YesChef is a food ordering platform that connects customers with food vendors at markets, festivals, and pop-up events across South Africa. The platform is operated by YesChef Holdings (Pty) Ltd, a private company registered in South Africa, trading as YesChef (“YesChef”, “we”, “us”, or “our”).

We are responsible for the personal information you provide to us or that we collect when you use our platform. Under the Protection of Personal Information Act 4 of 2013 (POPIA), we are the Responsible Party in respect of your personal information.

If you have any questions about this Privacy Policy or how we handle your personal information, you can contact us at privacy@yeschefapp.co.za.

2. Who this policy applies to

This Privacy Policy applies to anyone who interacts with the YesChef platform. Under POPIA, “Personal Information” means information relating to an identifiable, living, natural person or an existing juristic person, which includes information such as your name, contact details, and transaction history.

• Customers: people who scan a vendor’s QR code, browse a menu, and place orders through the YesChef platform.
• Vendors: food stall operators who register and use the YesChef vendor portal to manage their menu, orders, and payments.
• Visitors: anyone who browses the YesChef website or platform without placing an order or registering as a vendor.

Different information is collected from each group depending on how you interact with the platform. Where a section of this policy applies to a specific group only, we say so clearly.

If you are a vendor, this policy covers the personal information we collect about you and your staff in the course of operating your account. The terms governing how we handle your customers’ personal information on your behalf are set out separately in the Vendor Agreement you sign with us.

By continuing to use the YesChef platform, you acknowledge that you have read and agree to this Privacy Policy. If you do not accept this policy, you may not use the platform.

3. What personal information we collect

We collect only the personal information necessary to provide the YesChef platform and its services. The information we collect depends on how you interact with us.

3.1 Customers

When you place an order through the YesChef platform, we collect:

• Your name
• Your mobile number
• Your email address, if you choose to provide it at checkout
• Your order details (items ordered, quantities, modifiers, total amount)
• Your payment transaction reference. We do not store card details, these are handled directly by your chosen payment provider
• Your device and browser information (type, operating system, browser version)
• Your IP address and approximate location at the time of ordering
• Any coupon codes you apply
• Your notification preference (WhatsApp, SMS, or none)
• Where you use the YesChef app and switch notifications on, a device notification token, which category of notification you have agreed to receive, and the date you agreed
• Any tip amount you choose to add
• Your marketing preferences, where you opt in to receive news and offers from YesChef or from the vendor you ordered from
• Where you have accepted marketing cookies, the advertising source that brought you to the platform, recorded against your order so we can measure the performance of our own advertising

3.2 Customer accounts

If you choose to create a customer account, we collect additional information to provide and maintain it. You may sign in using your Google or Apple account, or with your mobile number using a one-time PIN sent to you by WhatsApp or SMS. When you create an account, we collect:

• Your name and mobile number, or the account details shared by Google or Apple where you sign in with one of those. If you use Apple’s “Hide My Email” option, Apple gives us a private relay address instead of your real one
• Your order history associated with your account
• Any additional profile information you choose to provide

Your account allows you to view your past orders. You are not required to create an account to use the platform, account creation is optional.

3.3 Vendors

When you register and operate as a vendor on the YesChef platform, we collect:

• Your trading name and registered business name
• Your name and contact details (email address and mobile number)
• Your business description and operating location
• Your payment provider API credentials (API keys and webhook secrets only, we do not store banking details)
• Your logo, hero image, and brand assets
• Your menu items, pricing, and catalogue configurations
• Your order history and transaction records
• Staff names and roles, where you add staff to your account
• Your billing and invoice records

3.4 Visitors

When you browse the YesChef platform without placing an order or registering, we may collect your IP address, your browser type and device information, the pages you visited and time spent on the platform, and the source from which you arrived (for example a QR code scan or a direct URL).

Where you have accepted analytics cookies, this information is linked to a visitor identifier so we can understand how the platform is used. Where you have not, we collect only what is necessary to serve and secure the page.

4. Why we collect it (purpose and lawful basis)

We collect and process personal information only for specific, lawful purposes. Under POPIA we are required to have a lawful basis for processing your personal information. We rely on the following bases:

4.1 Contractual necessity

We process personal information where it is necessary to perform our services. Without this information we cannot provide the platform. This includes processing and managing customer orders, notifying customers of order status updates, enabling vendors to manage their menus, orders, and payments, generating vendor invoices and billing records, and enforcing per-customer coupon limits.

4.2 Legitimate interest

We process certain personal information where we have a legitimate business interest in doing so, provided that interest is not overridden by your right to privacy. This includes improving platform performance and reliability, capturing technical error reports so we can diagnose and fix faults, detecting and preventing fraudulent or abusive use of the platform, and maintaining security logs and audit trails.

4.3 Legal obligation

We may process personal information where we are required to do so by law, including retaining transaction records for tax and accounting purposes and responding to lawful requests from regulatory authorities.

4.4 Consent

Where we rely on consent as a lawful basis, we ask for it explicitly and separately, and you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. We rely on consent for:

• Analytics cookies and similar technologies, which are off until you accept them
• Marketing and advertising technologies, which are off until you accept them
• Sending you marketing emails from YesChef, where you tick the option at checkout
• Sharing your contact details with a vendor for that vendor’s own marketing, where you tick the option at checkout

No core ordering function depends on any of these. You can place and collect an order without accepting any of them.

5. How we use your information

5.1 Customers

We use your personal information to:

• Process and manage your food orders
• Send you order status notifications via WhatsApp, SMS, or email
• Send order updates to the YesChef app on your phone, where you have switched notifications on
• Identify you across the platform to enforce coupon and promotion limits, using your mobile number as a unique identifier
• Send you a receipt and order confirmation by email, where you have given us an email address
• Maintain your customer account and order history, where you have created an account
• Send you marketing emails, only where you have opted in
• Send promotional notifications to the YesChef app, only where you have switched that specific category on. Offers and app news are off by default and are separate from order updates, so you can receive one without the other. You can switch them off at any time under Notifications in your profile, and every promotional notification links there
• Detect and prevent fraudulent or abusive use of the platform
• Improve platform performance and reliability, and measure the performance of our own advertising, where you have accepted the relevant cookies

5.2 Vendors

We use your personal information to:

• Create and manage your vendor account
• Process your orders and make order data available to you through the vendor portal
• Generate and issue monthly invoices for platform fees
• Send you operational notifications including daily order summaries
• Send alerts to devices you have registered in the vendor app, covering new orders, your stall going offline, and items selling out
• Send occasional trading tips to those devices, only where you have switched that category on. It is off by default and separate from your order alerts
• Verify your identity and business details during the approval process
• Communicate with you about your account, platform updates, and support queries
• Detect and prevent fraudulent or abusive use of the platform

5.3 All users

We use information collected from all users to maintain the security and integrity of the platform, comply with our legal obligations, respond to data subject requests under POPIA, and enforce our Terms and Conditions and the Vendor Agreement.

5.4 What we do not do

We do not:

• Sell your personal information to any third party
• Send you marketing you have not asked for
• Share your personal information with third parties for their own commercial purposes, other than the vendor marketing opt-in described in Section 6.5, which only happens if you ask for it
• Use your personal information for any purpose not described in this Privacy Policy or Section 4

6. Who we share your information with

We do not sell or rent your personal information to third parties. We share it only where necessary to provide the platform, and only with the following categories of recipients.

6.1 Payment processors

When you make a payment through the YesChef platform, your payment is processed by the payment provider your vendor uses. Depending on the vendor and the payment method you choose, this may be Yoco Technologies (Pty) Ltd, SnapScan, iKhokha, or Zapper. Each provider receives only the information necessary to process your transaction. YesChef does not see or store your card details at any point. Each payment provider’s own privacy policy governs how they handle your payment information.

6.2 Infrastructure and hosting providers

We use Supabase as our database and backend infrastructure provider. All customer, vendor, and order data is stored and processed through Supabase. We use Vercel to host and serve the platform itself, which means Vercel processes network-level information such as your IP address and the requests your browser makes.

Both act as data processors on our behalf and are contractually prohibited from using your data for any purpose other than providing services to us. Supabase in turn uses a number of sub-processors including Amazon Web Services, Google, and Cloudflare for hosting and infrastructure purposes. A full list of Supabase’s sub-processors is available at supabase.com/privacy.

6.3 Communication providers

• Resend: email communications including order confirmations, receipts, and operational notifications.
• SMSPortal: SMS messages sent to South African mobile numbers.
• Twilio: WhatsApp messages, and SMS messages sent to international mobile numbers.

These providers process only the information necessary to deliver the relevant communication and are contractually bound to handle your data securely.

6.4 Analytics, error reporting, and advertising providers

• PostHog, our product analytics provider, which records how the platform is used. Only loaded once you accept analytics cookies.
• Sentry, our error reporting provider, which captures technical fault reports so we can fix them. Used under our legitimate interest in keeping the platform reliable, and does not rely on tracking cookies.
• Meta (Facebook and Instagram) and Google, our advertising providers, which measure the performance of our advertising. Only loaded once you accept marketing cookies. Where you have accepted marketing cookies and complete an order, we may also send a matching conversion event from our servers to Meta. Any personal identifiers in that event are hashed before they are sent.

Full detail on each category, and how to change your choices at any time, is set out in our Cookie Policy.

6.5 Vendors

When you place an order as a customer, your name, mobile number, and order details are shared with the relevant vendor so they can prepare and fulfil your order. Vendors are bound by the Vendor Agreement they sign with YesChef, which includes obligations to handle your personal information responsibly and only for the purpose of fulfilling your order.

Separately, if you tick the option at checkout to receive news and offers from that vendor, we share your email address, and your name and mobile number where available, with that vendor so they can market to you directly. From that point the vendor is an independent Responsible Party for that information and is responsible for it, including giving you a way to unsubscribe. This is entirely optional and separate from any YesChef marketing you opt in to. You can withdraw your consent at any time by contacting us or the vendor, or by unsubscribing from the vendor’s emails.

Loyalty programmes. Where a vendor runs a loyalty programme, that vendor can see the aggregate standing of their own programme, and the stamp balance held against the mobile number of a customer who is redeeming a reward with them. Your balance with one vendor is never visible to another vendor. YesChef operates the stamp ledger on the vendor’s behalf; we do not use your loyalty activity to market to you, and we do not sell or share it beyond the vendor whose programme you are collecting with.

6.6 Legal and regulatory disclosure

We may disclose your personal information to law enforcement, regulatory authorities, or other third parties where we are required to do so by law, or where we believe disclosure is necessary to protect the rights, property, or safety of YesChef, our users, or the public.

6.7 Business transfers

If YesChef is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and the privacy implications before it takes effect.

6.8 Loyalty stamps and your mobile number

If you collect loyalty stamps with a vendor, we record those stamps against the mobile number used at checkout, and against your YesChef account once you sign in with that number. The number is the identifier that makes the programme work at a counter, where you may have no account at all. When you first sign in with a number, stamps already sitting against it are claimed onto your account.

The ledger records the stamps earned or spent, the vendor, the order they relate to, and when they expire. It is retained on the same basis as your order history, described in Section 8, because it is a record of a transaction. Stamps are not a financial asset and hold no cash value; the commercial terms are set out in Section 7 of our Terms and Conditions.

7. Cross-border transfers

The YesChef platform is operated from South Africa. However, most of the third-party service providers we use are based outside South Africa, which means your personal information may be transferred to and processed in countries other than South Africa.

7.1 How we protect your information during transfers

Under POPIA we are required to ensure that any transfer of your personal information outside South Africa is subject to adequate safeguards. Where we transfer your personal information to third parties in other countries, we do so only where the recipient country has data protection laws that provide an adequate level of protection, or we have put in place appropriate contractual safeguards, such as a Data Processing Agreement, to ensure your personal information is protected to the same standard required by POPIA.

7.2 Supabase and Vercel

Our primary infrastructure providers are Supabase and Vercel, both US-based companies. All customer, vendor, and order data processed through the YesChef platform is stored and processed by Supabase on our behalf, and the platform itself is served by Vercel. We have executed a Data Processing Agreement with each that incorporates Standard Contractual Clauses as the transfer mechanism, adapted to apply to transfers from South Africa in accordance with POPIA. Both are contractually prohibited from using your data for any purpose other than providing services to us.

7.3 Communication providers

Resend and Twilio are based outside South Africa. SMSPortal, which carries our South African SMS traffic, is based in South Africa. These providers process only the minimum personal information necessary to deliver order notifications and email communications on our behalf, and are subject to appropriate data processing agreements.

7.4 Analytics, error reporting, and advertising providers

PostHog, Sentry, Meta, and Google are all based outside South Africa. Analytics and advertising providers receive information only where you have accepted the relevant cookies, and each is subject to appropriate data processing terms.

7.5 Your acknowledgement

By using the YesChef platform, you acknowledge that your personal information may be transferred to and processed in countries outside South Africa as described in this section. We take all reasonable steps to ensure that such transfers are subject to appropriate safeguards and that your personal information is treated securely and in accordance with this Privacy Policy.

8. How long we keep your information

We retain your personal information only for as long as is necessary for the purposes described in this Privacy Policy, or as required by applicable law.

8.1 Deletion

When your personal information is no longer required, we will delete or anonymise it in a secure manner. Where anonymisation is not possible, we will ensure the information is securely stored and isolated from further processing until deletion is possible.

8.2 Account closure

If you close your vendor account, delete your customer account, or request deletion of your personal information, we will action your request within a reasonable time, subject to any legal obligation we have to retain certain information for the periods set out above.

8.3 Supabase retention

Our infrastructure provider Supabase retains data for the duration of our agreement with them. Upon termination of that agreement, we have 30 days to export our data before Supabase permanently deletes all stored information.

9. How we protect your information

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, loss, or destruction. However, no system is completely secure, and we cannot guarantee the absolute security of your personal information.

9.1 Technical measures

We implement appropriate technical measures to protect your personal information, including encryption at rest and in transit, access controls, database row-level security so that users can only reach their own data, and regular security testing. The specific measures in place are reviewed and updated regularly in line with industry standards and legal requirements. Our third-party service providers, including Supabase and Vercel, are contractually bound to maintain appropriate technical security measures under the terms of our agreements with them.

9.2 Organisational measures

• Access to the YesChef vendor portal requires authenticated login, and access to specific functions such as menu and pricing changes can be restricted by the vendor to designated staff
• Vendor admin accounts are protected by password-based authentication, with additional safeguards applied as the platform matures
• All significant platform actions are recorded in an audit log
• Our infrastructure provider Supabase maintains a formal breach response plan that is regularly tested and updated

9.3 Payment security

We do not store your card details at any point. All payment information is handled directly by the relevant payment provider and is subject to their own security standards and compliance obligations. YesChef receives only a transaction reference upon successful payment.

9.4 Vendor payment credentials

Vendor payment credentials, including payment provider API keys and webhook secrets, are stored encrypted at rest using AES-256-GCM encryption and are decrypted only at the moment they are needed to call the relevant payment provider.

9.5 Data breach notification

In the event of a security breach affecting your personal information, we will notify you and the Information Regulator as required by POPIA. Our infrastructure provider Supabase is contractually required to notify us of any confirmed security incident within 48 hours of becoming aware of it, which allows us to fulfil our notification obligations promptly.

10. Your rights under POPIA

Under POPIA you have the following rights in respect of your personal information. To exercise any of them, contact us at privacy@yeschefapp.co.za. We will respond to all requests within 30 days of receipt as required by POPIA.

• Right of access: request confirmation of whether we hold personal information about you, and request a copy of it. We may charge a reasonable fee for providing access where permitted by law.
• Right to correction: request that we correct or update any personal information we hold about you that is inaccurate, misleading, or out of date.
• Right to deletion: request that we delete personal information we hold about you where we no longer have a lawful basis to retain it. We may be required to retain certain information for the periods set out in Section 8, notwithstanding a deletion request.
• Right to object: object to processing where we rely on legitimate interest as our lawful basis. We will consider your objection and cease processing unless we have compelling legitimate grounds that override your right to object.
• Right to withdraw consent: withdraw consent at any time where we rely on it. You can change your cookie choices using the Cookie Settings link in our footer, and unsubscribe from marketing emails using the link in any marketing email we send. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to complain. If you are unsatisfied with how we have handled your personal information, or with our response to a request, you have the right to lodge a complaint with the Information Regulator. We encourage you to contact us directly in the first instance and we will do our best to resolve your concern before you escalate.

11. Cookies and local storage

11.1 What we use

The YesChef platform is a Progressive Web App. Alongside cookies, we use browser storage technologies that work in similar ways:

• Session storage: temporary data stored in your browser for the duration of your session, for example your cart contents and order status. Cleared automatically when you close your browser tab.
• Local storage: small amounts of data stored on your device to improve your experience, for example remembering your notification preference and your cookie choices between visits. Persists until cleared by you or by the platform.
• Service workers: background scripts that allow the platform to load faster and function reliably on poor network connections. They do not collect or transmit personal information.
• Cookies: used to keep you signed in, hold your order state, record your cookie choices, and, where you have accepted them, to support analytics and advertising.

11.2 The three categories

• Strictly necessary: required for the platform to work. These keep you signed in, hold your cart, process your order, and store your cookie choice itself. They cannot be turned off.
• Analytics: off until you accept them. These help us understand how the platform is used so we can improve it. Our analytics provider is PostHog.
• Marketing: off until you accept them. These measure the performance of our advertising and let us reach the right people with it. Our advertising providers are Meta (Facebook and Instagram) and Google Ads.

We do not use cookies to build profiles for third parties, and we do not participate in cross-site advertising networks beyond measuring our own campaigns.

11.3 Managing your choices

The first time you visit a YesChef page you will see a cookie banner with Accept, Reject, and Customize options. Your choice is recorded for up to 13 months, after which we ask you again. You can change your choice at any time using the Cookie Settings link in our footer, or on our Cookie Policy page.

You can also clear local storage and session storage at any time through your browser or device settings. Note that clearing this data may affect your experience on the platform, for example by resetting your notification preferences and re-showing the cookie banner.

On vendor-operated self-service kiosks the cookie banner does not appear, because kiosks are shared devices and per-customer consent is not meaningful. Only strictly necessary cookies are used on those surfaces.

11.4 Error reporting

We use Sentry to capture technical error reports so we can fix faults. Error reporting does not rely on tracking cookies and is carried out under our legitimate interest in keeping the platform reliable.

11.5 Third-party technologies

Some third-party services we use, including our payment providers, may set their own cookies or use their own storage technologies when you interact with their services through our platform. These are governed by each provider’s own privacy and cookie policies, which we encourage you to review.

12. Children and age-restricted products

The YesChef platform is not directed at or intended for use by persons under the age of 18. We do not knowingly collect personal information from anyone under the age of 18.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at privacy@yeschefapp.co.za. We will take prompt steps to delete the information from our records. If we become aware that we have collected personal information from a person under the age of 18 without appropriate parental or guardian consent, we will delete that information as soon as reasonably practicable.

Age-restricted products. Certain vendors may sell age-restricted products, including alcoholic beverages and nicotine products, where they hold the applicable licence required by South African law. The platform does not perform any age verification. The vendor retains full responsibility for verifying the age of the customer at the point of collection and for complying with all applicable licensing and age restriction laws. YesChef accepts no liability for a vendor’s failure to comply with these obligations. Where a vendor is not authorised to sell age-restricted products on the platform, such products are excluded from the platform entirely.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our business, the platform, or applicable law. The most current version will always be available on our website.

Where we make a material change, for example a change to the purposes for which we use your personal information, the third parties we share it with, or your rights, we will notify vendors by direct email to the address registered to the vendor account before the change takes effect, and will display a notice on the platform for customers and visitors the next time they use it. Where a change affects which cookies we set or how we use them, we will ask you for your cookie consent again. We will give you reasonable notice of any material change before it takes effect.

For minor or administrative changes that do not affect your rights or how we use your personal information, such as clarifications, corrections, or formatting updates, we will update the policy without individual notification. The version and updated date at the top of this policy reflect when the most recent change was made.

Your continued use of the platform after a change takes effect constitutes your acceptance of the updated policy. If you do not agree with any change, you should stop using the platform and contact us at privacy@yeschefapp.co.za to request deletion of your personal information.

14. How to contact us

Information Officer
Under POPIA we are required to designate an Information Officer responsible for ensuring our compliance and handling requests and complaints relating to personal information. Our Information Officer is Matthew Reid.
Email: privacy@yeschefapp.co.za

Data subject requests. To exercise any of your rights under Section 10, contact us at privacy@yeschefapp.co.za. Please include your full name, the mobile number or email address associated with your account, and a description of your request. We will respond within 30 days of receipt as required by POPIA. Where we require additional time, we will notify you and provide a reason for the delay.

Complaints. If you are dissatisfied with how we have handled your personal information or with our response to a data subject request, please contact us in the first instance at privacy@yeschefapp.co.za. If you remain unsatisfied, you have the right to lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa)
Telephone: +27 (0) 10 023 5207
Email: enquiries@inforegulator.org.za
Website: inforegulator.org.za
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

15. Electronic communications and transactions

This Privacy Policy and your use of the YesChef platform are subject to the Electronic Communications and Transactions Act 25 of 2002 (“ECT Act”). Electronic communications sent by you to YesChef will be deemed to have been received only when we have responded to them. Electronic communications sent by us to you will be deemed to have been received in accordance with section 23(b) of the ECT Act.

You acknowledge that electronic signatures, encryption, and authentication are not required for valid electronic communications between you and YesChef, unless specifically required by law or expressly agreed between the parties. You warrant that any electronic communication sent to us from any device used or owned by you was sent and authorised by you personally.

In accordance with section 43(1) of the ECT Act, the following information is provided:

Full legal name: YesChef Holdings (Pty) Ltd
Registration number: 2026/596253/07
Physical address: 17 Warren Street, Tamboerskloof, Cape Town, 8001
Email address: hello@yeschefapp.co.za
Website: yeschefapp.co.za