The system your brand picked, built so it is worth your time too

What breaks now

• The day’s takings go out as a WhatsApp message. Nobody can reconcile that message six weeks later, and the royalty computed from it inherits every typo.
• You count the till after reading what the till says you should have, so the count agrees with the machine and finds nothing.
• A royalty invoice arrives with one number on it. The only way to question that number is to argue about it.
• Attendance is a paper register. When a shift is disputed there is nothing to point at, and the labour line on your P&L is a guess.
• A request to head office — a discount, a broken chiller, a supply shortage — sits in a group chat with no owner and no due date.
• The trade licence renewal is remembered late, and the inspection that follows is a surprise.
• The brand asks for numbers you already typed into two other places.

Everything below is one workspace you log into, on a phone at the counter or a laptop in the back. Records are unlimited; what the brand pays for is an outlet that has its own logins, which is what switches trading on.

Double entry is the thing we treat as the enemy. Every screen here either replaces a message you were already sending or produces a number you were already being asked for.

The trading day

• One screen for the whole day Module ↗

  One request returns the guided steps, the KPI strip with 14-day sparklines, the day itself and its evidence — no navigating between screens to answer “how are we doing” and “am I done”.

  The screen you use forty times a day loads once and stays useful, instead of costing you four page loads on outlet wifi.

• The guided rail: open → trade → handover → cash up → close Module ↗

  The server decides which step is now and which steps exist at all for your kind of business, so an outlet that does not run shifts never sees a handover step.

  A new person can close the day correctly on their second shift without being trained on a sequence.

• Opening the day cannot fork it Module ↗

  Opening finds or creates the day for that outlet and date, with a unique index on (outlet, date) in the database behind it.

  A double tap on a slow phone cannot produce two half-recorded days — which is the single most common way an evening’s takings get lost.

• Quick entry: amount, tender, done Module ↗

  One line per sale with how it was paid and where it came from, recomputing the day as it goes.

  A counter that is not running a POS still produces a day record you can stand behind at month end.

• Retry-safe entry from a dropped connection Partly built Module ↗

  The entry API accepts a caller-supplied id and a unique index makes a replay return the same entry instead of a second one. The console form does not send one yet and there is no offline queue in the app, so a retry from the browser today creates a duplicate.

  The protection is in the database rather than in an app check — but until the console sends the id, treat a failed tap as something to check before you tap again.

• Your declaration is the record; entries are the evidence Module ↗

  While nobody has stated a figure the day mirrors the sum of its entries exactly. The moment you declare a number, entries stop steering it and the gap is stored as variance.

  An outlet that taps in every sale never has to “also declare”, and an outlet that declares a different number has that disagreement on the record instead of smoothed away by software.

The surface itself

• The whole console in Hindi

  Each person picks their own language in account settings; anything not yet translated shows in English rather than as a blank, and the page switches to a Devanagari-capable face when Hindi is on.

  The manager can work in English and the person closing the day can work in Hindi, on the same record, without either of them being the one who compromises.

• Install it on the counter tablet like an app

  The console adds to the home screen with its own icon and opens full-screen with the shell already cached, so it loads on a bad connection; sales data is never served from cache, and an update asks before it reloads.

  The screen you use forty times a day is one tap from the home screen and does not reload the whole app every time you open it.

• A form and a QR for anything you need answered Module ↗

  You build a form with your own fields, mark it a survey or a checklist rather than an enquiry form, publish it to its own link with a printable QR, and read the submissions back. Only an enquiry-purpose form creates a lead.

  A counter feedback card, a shift opening checklist or a staff form is something you make in ten minutes instead of asking head office for.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• Your till feeds the day Not built yet Module ↗

  The POS you already run posts each day’s sales, tender split and item mix into the trading day, and the declaration is pre-filled from it.

  You stop typing a number into a second system at eleven at night, which is the whole reason day capture gets skipped.

• Stock and supply ordering Not built yet Module ↗

  You order from the brand’s approved suppliers in the same app, against par levels, and the goods received post to cost of sales.

  One place for the order, the receipt and the cost, so the number you argue about with the supplier is the same one on your P&L.

• An app in the store, with notifications Not built yet

  A native app for the counter and the owner’s phone, with push notifications for a licence about to expire, a royalty due and a decision from head office.

  The things that cost you money when you miss them find you, instead of waiting on a screen for you to open it.

• The rest of the Indian languages Not built yet

  Tamil, Telugu, Marathi, Kannada, Bengali and Gujarati join English and Hindi, picked per person rather than set for the outlet.

  The person closing the day works in the language they think in, which is what decides whether the day gets closed properly at all.

What the brand sees, because the agreement says so

• Your declared sales for the period, and the report you submitted as the royalty basis.
• Your royalty statements and the invoices raised against them, including what is outstanding.
• Your compliance register — a brand’s network portfolio shows a register per unit alongside its own head-office one.
• Audit and visit scores, findings, and the corrective actions raised from them.
• Whether you filed this month’s report at all — missing reports are a board, not a surprise at close.
• Opening sign-offs: only the brand can approve a gate on an opening project.

Where the product holds a line

• Staff go up as an aggregate, not as punch histories Module ↗

  The staff summary endpoint returns headcount, total minutes, shift count and the share of shifts that were self-evidenced for an outlet and a date range. It carries no names and no punch rows.

  A franchisor gets the labour figure it needs to read a P&L without holding an individual’s attendance history, which is personal data under the DPDP Act that they have no need to hold. Note this holds because your staff records live in your workspace — it is a property of where the rows sit as much as a rule in the code.

• Area developers see rows, not amounts Module ↗

  An area-developer workspace has royalty and sales amounts redacted while the rows still list, and the audit queue, clearing splits and local-spend breakdown are refused outright.

  A territory developer can do the development job without being handed every unit’s P&L.

• Every action is behind a named capability

  Forty-seven named capabilities, default-deny, with role defaults per workspace type — an outlet’s roles use outlet words: manager, senior staff, staff, support, trainee — and per-person grants or revocations on top.

  You give one person the money screens by name instead of promoting them to admin and handing over everything else with it.

• A refusal says why, and who can fix it

  A refused action returns the reason — capability, desk, operator scope, feature off, AI budget — the capability needed, and the names of the people in the workspace who can grant it. The button greys out and says so rather than disappearing.

  Nobody raises a ticket saying “the button is missing”. They read who to ask and ask them.

• Support access is bounded and recorded

  Platform support can only enter a workspace with a stated reason, for sixty minutes, in a mode chosen at the time — and a denylist blocks settings writes, access grants, member management, password changes and the whole control plane even in full mode.

  When you call for help somebody can see what you see without being able to change your permissions or your team while wearing your name.

• An append-only audit log that survives impersonation

  One write path appends action, actor, subject, evidence and IP to a table with no update, and automatically stamps the real admin when someone is impersonating and the seat plus the on-behalf organisation when an operator is acting.

  “Who actually did this” survives support access and outsourced operations, which is exactly when you want to be able to ask it.

Two things we will not overstate

Compliance records carry a brand-only visibility flag. It is stored and returned, and it does not currently filter anything — today’s separation comes from your workspace being a separate workspace, not from that toggle.

A visit’s report can be released to you as a recorded act. Withholding one is not settable through the API today, and the flag does not itself hide a report from you.

• Staff records at the outlet Module ↗

  Name, phone, role, employment type — full time, part time, contract, trainee — joining date, monthly CTC and an opaque payroll reference, held against the outlet they work at.

  Who works here is a record rather than a WhatsApp group, and the labour line on your P&L has names behind it.

• One open shift per person, refused by the database Module ↗

  A punch-in writes the person into a column carrying a unique index, so a second open session is refused by the storage layer rather than by an application check.

  Two taps on a laggy phone, a retried request, or a shared kiosk plus a personal device cannot open two sessions — the race that actually happens in an outlet is closed where it cannot be worked around.

• How presence was evidenced Module ↗

  Each punch records its method — GPS, selfie, QR kiosk or manager mark — with coordinates, the selfie reference, and the user who marked somebody else present.

  A manager marking the team in is legitimate and common. Recording that it was a manager mark rather than a self-punch is what makes the attendance record arguable later.

• Forgotten punch-outs are surfaced, never guessed Module ↗

  Any session still open past sixteen hours is listed with how long it has run, and is never auto-closed.

  Guessing an end time puts invented hours into your labour cost. The manager who was there knows what happened, so the product asks instead of assuming.

• Leave as an append-only ledger Module ↗

  Entitlement, days taken and corrections are all rows in quarter-days across casual, sick, earned and unpaid. The balance is their sum — there is no balance column anywhere to edit.

  Leave is exactly the number staff dispute. “You took two days on the 14th” survives in the record instead of in somebody’s memory.

• Overdrawing paid leave is refused; unpaid always goes through Module ↗

  The ledger refuses to overdraw a paid leave type, but never refuses to record an unpaid day, and an adjustment without a reason is rejected.

  Refusing to record a day somebody actually took would make the ledger a fiction, which is how leave records stop being trusted.

Where payroll stops

The product records the shift and holds a payroll reference. It does not compute pay, file returns or touch your salary run — that is deliberately a boundary, not a gap we are about to fill.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• Payroll export from the hours you already recorded Not built yet Module ↗

  Worked hours, leave taken and the payroll reference export in the format your payroll provider or accountant ingests, per pay period.

  The attendance ledger stops being evidence only for disputes and starts saving the hour someone spends retyping it into a salary sheet.

• Training and certification for your staff Not built yet

  Role-based modules and assessments with a certificate per person, tracked against the roster so you can see who is trained on what.

  A new hire is productive on a syllabus rather than on whoever was on shift, and you can show the brand your team is certified without a phone call.

• Four-wall P&L for the outlet Module ↗

  For your unit and a date range it builds net sales from the declared trading days, groups approved spend into cost of sales, labour, occupancy, marketing and other, keeps aggregator commission on its own line, and reports prime cost and four-wall EBITDA with each ratio scored against a band.

  You see the two numbers that decide whether the outlet survives this week, rather than getting a P&L from an accountant in March.

• Bands that are the accepted envelopes, not a grade Module ↗

  Ratios are scored against the usual QSR bands — cost of sales around 30–35%, labour 20–25%, prime cost at or under 60%, occupancy 10–15% — and read as unknown when there are no sales to divide by.

  You find out you are two points over on labour while you can still do something about the rota.

• Labour is your approved staff spend, and hours sit beside it Module ↗

  The labour line is built from approved expense claims in the labour category. Worked minutes from the attendance punches are recorded on the same daily rollup row, next to prime cost, but are not themselves costed into the P&L.

  Worth being precise about: the P&L reads your books, and attendance is the evidence beside it — not a payroll engine pretending to be one.

• Aggregator commission read from the settlement Module ↗

  Commission is taken from the aggregator’s own imported settlement rather than from a headline rate, because the money is netted at source and never reaches you. Where no settlement has been imported the line is simply zero.

  You learn what delivery actually costs you, and where the data is missing the gap stays visible instead of being invented.

• Approving an expense is what posts it Module ↗

  A claim is captured with date, category, vendor, invoice number, taxable amount and tax, then approved or rejected. Approval writes the balanced ledger entry, stamps who approved it, and links the entry to the claim.

  An approval that does not move the books is a rubber stamp. Here they are the same act, so what was approved and what was spent cannot diverge.

• Reimbursement and recharge are one object Module ↗

  Every claim carries who paid — brand or outlet — and whose cost it is. When they differ the cost lands on the other party’s khata instead of in the payer’s expenses, and reimbursing posts the entry that clears it.

  What you call “my reimbursement” and the brand calls “recharge” is one record, so the two of you cannot disagree at month end.

One thing to know about the insight stream

The rules are evaluated when a run is triggered for a period, and the rollups they read are rebuilt on demand. Nothing schedules either yet, and nothing pushes a notification — the stream is a screen you open, not an alert that finds you.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• Tally and Zoho Books export Not built yet

  Your sales, expenses and royalty invoices export in the format your accountant’s package imports, on a schedule rather than on request.

  Your CA stops billing you for data entry you already did once, at the counter, every night.

• What your customers actually think Not built yet

  Feedback captured at the counter and public review scores trend for your outlet against the network, beside your audit score and your prime cost.

  The number that predicts next quarter’s sales is the one nobody currently measures at the outlet, and it is the one you can still do something about.

Say this before anything else

Requests, chat and announcements are queues inside one workspace: everyone who can see them holds a membership in it. Routing a request automatically from a separate outlet console into a separate brand console is not built, so how you and head office share a queue is a setup decision to make together rather than something to assume.

The audience field on an announcement is stored but not yet honoured — v1 sends to every member of the workspace. And a channel per outlet is created by hand today; nothing provisions one automatically.

• Twenty typed request templates, split by who is asking Module ↗

  The catalogue is split into outlet-to-brand and brand-to-outlet queues — discount approval, royalty dispute, supply shortage, equipment repair, renovation approval on one side; document request, licence evidence, missing sales report, royalty chase, audit corrective action, inspection follow-up on the other — each with typed fields and a decision SLA in hours. Required fields are refused on the server.

  A discount request arrives with the percentage on it instead of as prose somebody has to read and re-key, and both sides can see who owes whom an answer.

• Delegated discount authority Module ↗

  A discount request’s approval level is computed from the percentage on it and stored on the record — up to 10% marked self-approve, up to 20% area manager, above that head office — and a percentage that is not a number is marked head office. The level is a label on the request: it does not route it and does not itself block a decision.

  Asking for 8% arrives already marked as your own call rather than as prose head office has to read — and what level it carried, plus who actually decided it, are both on the record.

• A decision clock separate from the resolution clock Module ↗

  Templated requests carry their own decision due date, and the decision endpoint records the approval or rejection with who decided and when — once, and only on approval-kind requests.

  “We answered you” and “we finished the work” are two different promises, and they are tracked as two.

• An SLA that pauses when it is waiting on you Module ↗

  Per-priority first-response and resolution targets drive a clock; moving a case to pending banks the paused minutes and slides the resolution date forward.

  The clock measures the answer rather than punishing whoever is waiting for a photograph, which is the only way anyone keeps using it.

• A daily sweep that says when something went late Module ↗

  Each morning a command walks open and pending cases with a policy and writes a note when the first response target is missed and when resolution breaches — each firing at most once, and re-armed if the case is reopened.

  A late request is visible as late rather than as silence, without the system sending the same nag every day.

• A thread, with private handling notes Module ↗

  Replies append to the case, can be marked internal so they stay out of the shared thread, and can be pasted from a saved canned response that the message then cites. The first non-internal reply stamps the first-response time.

  The clock is stopped by an actual answer rather than by somebody claiming they called.

Reading and being read

• Unread counts that are yours, not the outlet’s Module ↗

  Each channel shows an unread count computed from your own read position, and reading a thread advances your cursor alone.

  Your manager opening the channel does not clear your badge, so what you have not read stays what you have not read.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• WhatsApp from head office, in one thread Not built yet Module ↗

  Announcements, reminders and replies run over WhatsApp against your outlet record, so a brand message reaches you where you already are and your reply lands back on the record.

  Nothing important stays buried in a group chat where nobody owns it and nobody can find it again.

• The brand’s marketing assets, ready to use Not built yet Module ↗

  Approved creatives, campaign kits and local-store templates download from one library, always the current version.

  Local marketing that does not get you a compliance finding, without waiting two days for somebody at head office to email a file.

• A seeded India statutory library Module ↗

  Every workspace seeds a brand pack — trademark, GST registration, FSSAI central, EPR plastic packaging, POSH committee, Udyam — plus one of five outlet packs for F&B, pharmacy, salon, education or retail, each item carrying its authority, cycle, validity, renewal window, alert ladder, whether it is mandatory, and a paragraph of guidance.

  It arrives knowing that FSSAI renewal opens 180 days ahead, that the ₹100-a-day late fee bites inside the last 30 and escalates to 3× and then 5× after expiry before the licence dies at +180, plus the municipal trade licence’s April–March year and the drug licence’s five-year retention fee — instead of asking you to type them.

• Required versus held, worst first Module ↗

  The register compares what your unit must hold against what it does hold and sorts by severity — lapsed, expired, missing, due, flagged, ok, not tracked — so a mandatory obligation with no record at all is a row rather than an absence you have to notice.

  You open the screen to find the thing you never had, not to browse the filing cabinet you already know is fine.

• Licence clocks that behave differently Module ↗

  Fixed-year, annual, perpetual-with-retention, no-expiry and state-variable cycles are modelled separately, and an expiry is derived from the issue date where the statute implies one.

  A pharmacy’s Form 20/21 tracks its retention due date rather than a fake expiry, and a GST registration never appears on a renewal ladder it has no business being on.

• A daily sweep on a 60/30/15 ladder Module ↗

  Each morning a scheduled command recomputes every licence against a 60/30/15-day ladder and writes a note on the unit’s timeline the day it crosses into expiring or expired.

  You hear about a lapse from the system before you hear about it from an inspector, and it costs nobody a diary reminder.

• An append-only review trail per licence Module ↗

  Each record stamps who filed it and, on review, the reviewer, timestamp and note; every decision — approve, comment, flag renewal, reject evidence — is written to a separate append-only table with its from and to state. Flagging never erases where the record had got to.

  A renewal that was queried in March can be shown to have been queried in March.

• An external inspection is its own kind of record Module ↗

  A regulator’s visit is filed with the authority, the notice or reference number, the outcome, the penalty amount and the statutory deadline — completed with no score, because you are recording what somebody else decided.

  The scoring is left empty rather than set to zero: a zero would read as a catastrophic audit when nothing was scored at all.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• Upload the certificate itself Not built yet Module ↗

  The licence scan, the renewal receipt and the inspection notice attach to the register entry they belong to, versioned, so the record holds the document and not only its number.

  When an inspector asks, the certificate is on the phone in your hand rather than in a folder in the back office.

• Fifteen phases everyone uses the same names for Module ↗

  Signing, entity and finance, site selection, LOI and lease, design and fit-out, licensing, construction and equipment, tech activation, hiring, training, stock and supply, pre-launch marketing, soft launch, grand opening, stabilization.

  Head office, the field team and you are looking at one plan with one set of names for the same steps.

• Six industry packs with India licence durations built in Module ↗

  F&B/QSR, education centre, salon and wellness, pharmacy, retail store and premises-light services packs carry researched processing times — Shops & Establishment 5–10 days, GST registration 7, trade licence 7–15 (15–30 for health trades), fire NOC 15–30, FSSAI state 30–60, eating-house police licence 15–25 where your state requires one, drug licence 30–45 after inspection.

  The plan you are held to starts from real paperwork time rather than from an optimistic January.

• The pharmacy pack knows the pharmacist comes first Module ↗

  Hiring the registered pharmacist is a real predecessor of the drug-licence application, because the application cannot be made without one.

  The sequencing mistake that costs six weeks is already in the template rather than learned once per opening.

• Back-scheduling from the opening date Module ↗

  Each task declares an anchor, an offset and a duration, so setting the opening day tells you the week the site has to be signed. Moving the date recomputes every window from the plan’s own data.

  The date slips once and thirty dates move with it, instead of thirty dates going quietly stale.

• A projected open driven by real slip Module ↗

  The projected date is the target pushed out by the worst slip on a critical task — measured against today for an unfinished one, against when it landed for a finished one. Slippage on non-critical tasks is visible but never moves the date.

  The date on the screen is when you will actually open, which is the date you hire and order stock against.

• A phase stays locked until the earlier sign-off is approved Module ↗

  Every mutation — complete, block, approve — is checked against the gating on the server, so nobody works ahead by posting straight at the API. Only an approval task clears a gate, and only the brand can give it.

  No construction before the drawings are approved. That rule lives in the database rather than in a policy document — and yes, this one runs in the brand’s direction: you cannot sign off your own opening.

One honest note on setup: the opening project is created and the template applied by hand. Nothing provisions a journey automatically the moment a franchisee signs, whatever a roadmap slide may once have said.

• It is not a POS. The trading day is declared and can be reconciled against a POS export; it does not run a till, print a bill or manage a menu.
• It does not compute payroll. Attendance and leave are records with a payroll reference; pay is calculated somewhere else.
• WhatsApp is click-to-chat and scan-to-chat links only. There is no WhatsApp Business API inbox.
• There is no file upload for licence scans, visit photos or vault documents. The register stores metadata and a reference string; the only upload endpoint in the product is the organisation logo.
• Photo evidence on an audit checklist item is a column, not a feature — nothing uploads to it yet.
• E-invoicing (IRN) is schema-ready with no IRP integration, so the screen says “not connected” rather than implying it is done.
• Reminders and dunning are recorded on the timeline; outbound email is not wired, so a chase is visible in the system rather than landing in an inbox.
• There is no payment link for an invoice a brand raises on a franchisee. Pay links exist for platform subscription invoices only.
• Requests, chat and announcements live inside one workspace; automatic routing between a separate outlet console and a separate brand console is not built.
• A chat channel per outlet is created by hand — nothing provisions one automatically.
• An outlet-side screen for your opening journey is built and tested at the API but has no screen yet; today you read the plan from the brand’s board.
• Cash movements and shift handover are shipped at the API with typed client hooks, and have no controls on the day screen yet.
• Compliance records stamp who filed them; you cannot yet assign a renewal to a different owner.
• Insight runs and analytics rollups are triggered rather than scheduled, and nothing sends a push notification.
• The ledger cannot be corrected by reversing entry from any screen — the primitive exists but is not wired to a route.
• A discount request is labelled by percentage — self-approve, area manager, head office — and the label does not route it or decide it. Someone at head office still presses the button, so do not treat a small ask as automatically cleared.
• Your tax invoice carries almost all of the Rule 46 particulars. The supplier’s signature block is not printed on it, and your address line shows your city.
• The credit-note cutoff checks 30 November following the financial year. Section 34 is the earlier of that and the brand’s annual-return filing date, and only the first limb is enforced.
• A licence record has a visibility setting that nothing reads. It does not hide anything — your register is separate from the brand’s because it is a different workspace, not because of that switch.
• No gym-specific opening or compliance pack ships. A gym clones the premises-light services pack and edits it.

The same honesty applies to the tags earlier on this page. “Partly built” means it works but you cannot reach all of it from a button yet. “Not built yet” means there is nothing to show you — it is listed so you can tell us whether it is the thing that would make this worth your evening. Everything untagged is shipped, and you can ask to see it running now.