Last updated: September 2026
SabMilega ("we", "us") is a data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDPA) for the personal data described below. This policy explains what we collect, why, how long we keep it, and how you can control it.
What we collect
- Phone number - for shoppers, used only if you choose to sign in (searching itself never requires an account); for merchants, required to verify and operate a shop.
- Name - optional for shoppers; used for your shop profile if you are a merchant.
- Location - used to sort search results by distance. Your precise coordinates are never stored - we retain at most a coarse ~600m-radius location marker, which cannot be used to identify or track you.
- Search activity - what you searched for and roughly where, to improve search quality and understand local demand.
- Merchant business details - shop name, address, phone, and any verification documents you submit (e.g. GSTIN, Udyam, Shop Act licence).
- Device and technical data - IP address and user agent, for security, rate-limiting, and abuse prevention.
What we do not collect
- No payment information - no money moves through SabMilega, so we never ask for or store any.
- No email address is required to use the service as a shopper.
- No advertising trackers or third-party analytics that build a profile of you.
Why we use it
To operate the search and shop-listing service, verify shops, respond to support and grievance requests, keep the service secure, and understand demand well enough to improve it. We rely on your consent, or (for security/fraud prevention) our legitimate interest in keeping the service safe.
How long we keep it
- Shopper account data: until you delete your account, plus 30 days.
- Coarse location markers: retained only in aggregate, never at street-level precision.
- Search history: 12 months, after which it is aggregated and the underlying record is deleted.
- Merchant account and verification records: for the life of the account, plus 3 years.
- Device/IP security logs: 90 days.
Your rights
You can request a copy of your data, ask us to correct it, or ask us to delete it, at any time. Withdrawing consent is as easy as giving it. Contact grievance@sabmilega.online - we acknowledge requests within 48 hours and resolve them within 30 days.
Security
Data is encrypted in transit and at rest. OTP codes and any authentication secrets are stored hashed, never in plain text. Access to personal data is restricted by role, and administrative actions are logged.
Children
SabMilega is intended for users 18 and older. We do not knowingly collect personal data from children, and we do not ask for or infer anyone's age.
Changes to this policy
If we make a material change, we will update the date at the top of this page and, where required, notify affected users directly.
Contact
Questions or requests about your data: grievance@sabmilega.online.