This Privacy Policy explains how Milcko (“Milcko”, “we”, “us”, “our”), operated by Milcko Enterprises, Cabin 02, Kalchuri LNCT Incubation Centre, LNCTE Building, Raisen Road, LNCT Campus, Bhopal, Madhya Pradesh, India, collects, uses, shares, stores and protects your personal data when you use:
- the Milcko Android app for customers (package com.example.milcko);
- the Milcko Partner Android app for farmers, suppliers and delivery partners (package com.example.milcko.partner); and
- this website and any support channel we operate.
We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices) Rules, 2011. By using Milcko you agree to this policy. If you do not agree, please do not use our apps.
The short version. We collect only what is needed to take your order, deliver it, and keep your account secure. We do not show ads, we do not sell or rent your personal data, and we do not use your data for third-party advertising or credit scoring. You can request deletion of your account and data at any time from our account deletion page.
Contents
1. Data we collect
We collect the following categories of personal data. Items marked Partner app only apply solely to farmers, suppliers and delivery partners.
| Data | Why we collect it | Required? |
|---|---|---|
| Mobile number | To create your account and sign you in using a one-time password (OTP) | Required |
| Name | To address you and to identify the recipient at delivery | Required |
| Email address | Order receipts and support correspondence | Optional |
| Delivery address (house/flat, area, landmark, PIN code) | To deliver your order and to confirm you are inside our Bhopal service area | Required to order |
| Approximate / precise device location | To pin your delivery address on a map; in the Partner app, to sort the day's stops by distance and to enable the “call customer when nearby” safeguard | Optional (address can be typed manually) |
| Order history, cart, ratings and support tickets | To process, deliver and support your orders and show your past orders | Required |
| Photos you upload (e.g. profile picture, delivery proof) | To personalise your profile and evidence a completed delivery | Optional |
| Partner app only: Government identity document details and a live selfie / face capture | Mandatory Know-Your-Customer (KYC) verification before a partner may collect or deliver dairy products | Required for partners |
| Partner app only: Payout details (bank / UPI identifier) | To pay you for supplies and completed deliveries | Required for partners |
| Device information — model, OS version, app version, language, crash logs | To keep the app stable, diagnose crashes and prevent abuse | Automatic |
| Push notification token | To send order status updates and delivery alerts | Automatic (you can turn notifications off) |
We do not collect: your contacts, SMS messages, call logs, browsing history outside our app, biometrics for any purpose other than the one-time partner face check, or any data for advertising purposes.
2. How we use your data
- Create and secure your account, and sign you in via phone OTP.
- Show products and prices available in your Bhopal service area.
- Take, route, fulfil and confirm your orders, including the delivery OTP handover.
- Let the assigned delivery partner reach your address and contact you about that specific delivery.
- Send transactional messages — order confirmations, out-for-delivery alerts, delivery confirmations and support replies.
- Verify the identity of farmers and delivery partners (Partner app) and pay them.
- Handle refunds, complaints and cancellations.
- Detect and prevent fraud, abuse and misuse of the service.
- Meet our legal, tax, food-safety and accounting obligations.
- Improve the app using aggregated, non-identifying usage and crash data.
We do not use your personal data for automated decision-making that produces legal effects, for advertising or profiling, or for lending or credit assessment.
3. Legal basis for processing
We process your personal data on the basis of:
- Your consent, given when you create an account, add an address, or grant a device permission (you can withdraw it at any time);
- Performance of our contract with you — we cannot deliver an order without your address and phone number;
- Legal obligation — tax, invoicing, food-safety and law-enforcement requirements; and
- Legitimate uses permitted under the DPDP Act, such as preventing fraud and ensuring the safety of our delivery partners.
4. Device permissions we request
| Permission | Purpose | Can you refuse? |
|---|---|---|
| Location (approximate & precise) | Pin your delivery address; sort a partner's route by distance; confirm the partner is near the address before revealing the customer's phone number | Yes — customers can type the address manually. Partners need it to work a route. |
| Camera | Take a profile photo, capture the one-time KYC selfie, and photograph delivery proof | Yes |
| Photos & media | Upload an existing image instead of taking one | Yes |
| Notifications | Order and delivery status alerts | Yes |
| Phone (dialler hand-off) | Open your dialler to call the delivery partner or customer. We never place calls in the background or read your call logs. | Yes |
| Internet / network state | Required for the app to function | No |
Location is used only while the relevant screen is open. Milcko does not collect location in the background when the app is closed.
5. Sharing and disclosure
We never sell, rent or trade your personal data. We share it only in these situations:
- With your delivery partner: your name, delivery address, order contents and — once the partner is close to your address — your phone number, so the order can be handed over.
- With the supplying farmer/dairy: only the order contents and quantities. Your name, address and phone number are not shared with suppliers.
- With service providers who process data on our behalf under contract (see section 6).
- With authorities where required by Indian law, a court order, or a lawful request from a government agency.
- In a business transfer — if Milcko is merged or acquired, your data may transfer to the successor entity under this same policy; we will notify you.
6. Third-party services we use
| Service | What it handles | Their policy |
|---|---|---|
| Google Firebase — Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, Crashlytics | Phone OTP sign-in, storage of account/order data, push notifications, crash diagnostics | firebase.google.com/support/privacy |
| UploadThing (file storage) | Hosting product and profile images uploaded through the app | uploadthing.com/privacy |
| Google Play Services | App distribution, updates and integrity checks | policies.google.com/privacy |
These providers may store data on servers outside India. Where that happens we rely on contractual safeguards with the provider and transfer data only to countries not restricted by the Government of India under the DPDP Act.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Account profile (name, phone, email, addresses) | Until you delete your account, then removed within 30 days |
| Order and invoice records | Up to 8 years from the end of the financial year, as required by Indian tax and company law — retained in a form linked to the invoice, not to your live account |
| Partner KYC documents and face-check images | Duration of the partnership plus the period required by applicable law, then deleted |
| Delivery location traces | 90 days |
| Crash and diagnostic logs | 90 days |
| Support conversations | 24 months |
8. How we protect your data
- All traffic between the apps and our servers is encrypted with TLS/HTTPS.
- Data at rest is encrypted by our cloud provider.
- Access is restricted by database security rules and role-based permissions; staff access is limited to what a role genuinely requires.
- Delivery OTPs are verified on our servers and are never stored in plain text on the order record.
- We never store your card, UPI PIN or banking credentials — Milcko is cash-on-delivery.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected user as required by the DPDP Act.
9. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you and how it is processed;
- Correct inaccurate data and complete incomplete data — most fields are editable in the app;
- Erase your personal data and account (see section 10);
- Withdraw consent at any time, including revoking permissions in your device settings;
- Nominate another individual to exercise your rights in the event of your death or incapacity; and
- Raise a complaint — write to us (section 15) and, if you are not satisfied with our response, escalate to the Data Protection Board of India.
Write to milckoofficial@gmail.com to exercise any of these rights. We respond within 30 days.
10. Account and data deletion
You can delete your Milcko account and associated data at any time:
- In the app: Profile → Settings → Delete account, then confirm.
- On the web: follow the steps on our account deletion page.
- By email: write to milckoofficial@gmail.com from your registered email, or include your registered mobile number.
We verify the request against your registered mobile number, then delete your profile, addresses, cart, saved preferences, uploaded images and push tokens within 30 days. Order and invoice records are retained as described in section 7 because Indian tax law requires it; they are de-linked from your account and are not used to contact you. Deletion is permanent and cannot be undone.
11. Children
Milcko is not directed at children. You must be at least 18 years old to create an account and place an order. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it promptly — please contact us if you believe a child has given us data.
12. Payments
Milcko currently operates on cash on delivery only. We do not collect or store card numbers, CVVs, UPI PINs, net-banking credentials or any payment instrument details from customers. Partner payout identifiers (bank/UPI) are collected only from farmers and delivery partners for the purpose of paying them.
13. Cookies and this website
This website uses no advertising or tracking cookies. It loads a web font from Google Fonts, which may log your IP address as part of serving that request. The Milcko apps do not use cookies or third-party advertising identifiers.
14. Changes to this policy
We may update this policy as the service evolves. The “last updated” date at the top always reflects the current version. For material changes we will notify you in the app or by a message to your registered mobile number or email before the change takes effect. Continuing to use Milcko after that means you accept the revised policy.
15. How to contact us
For any question, complaint or request about your personal data — access, correction, deletion or withdrawal of consent — write to us:
- Email: milckoofficial@gmail.com
- Phone: +91 94797 96726 (Mon–Sat, 9:00 AM – 7:00 PM IST)
- Address: Milcko Enterprises, Cabin 02, Kalchuri LNCT Incubation Centre, LNCTE Building, Raisen Road, LNCT Campus, Bhopal, Madhya Pradesh 462022, India
We acknowledge every request within 48 hours and resolve it within 30 days. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India. See our contact page for anything else.
© 2026 Milcko. This policy applies to the Milcko and Milcko Partner mobile applications and to this website.