Privacy Policy

Dilsho is a hyperlocal delivery platform that connects customers, local shops and delivery riders. This policy explains what personal data we collect from each of them, why we collect it, how long we keep it, and the choices you have. It applies to the Dilsho website, the customer app at /app, the Android app, the shop dashboard, the rider app and the Dilsho POS cloud services.

1. What we collect

• Account details - your full name, mobile phone number (your primary sign-in id) and, if you choose to add one, your email address. If you sign in with Google, we also store the identifier Google gives us for your account; your Google password never touches our servers.
• Delivery addresses - the addresses and map pins you save or use for an order, so shops and riders can reach you.
• Order history - the items you order, the shops you order from, prices, timestamps and delivery outcomes.
• Shop business details (shopkeepers) - your shop's name, category, address, location pin, and any registration details you provide such as CNIC, NTN, GST or licence numbers, used to verify and list your shop.
• Rider application documents (riders) - photos of your CNIC (front and back), driving licence and your bike registration number, used only to verify you before you can deliver.
• Rider location while on delivery - a rider's live position is collected while they are online and delivering, so customers can track their order and new orders can be offered to nearby riders. We do not track riders when they are offline.
• Technical and security data - IP address and browser details in our security and audit logs (sign-ins, sensitive account actions), used to protect accounts and investigate abuse.
• Anonymous usage statistics - only if you accept the cookie banner: which pages are visited, when, and the page you came from. The IP address in these statistics is stored only as a salted, truncated hash that cannot be turned back into your address. We use no third-party analytics or advertising trackers of any kind.

2. How we use it

• To run the service: show catalogues, place and deliver orders, route riders, and settle cash-on-delivery amounts.
• To verify shops and riders before they join the marketplace.
• To keep accounts safe: sign-in security, fraud prevention, rate limiting and audit trails.
• To support you when something goes wrong with an order.
• To understand, in aggregate, how Dilsho is used so we can improve it.

We never sell your personal data, and we never share it with advertisers.

3. Who sees what

• Shops see the orders placed with them: the items, your name, delivery address and contact number - only what they need to prepare and hand over the order.
• Riders see the pickup shop and the delivery details of orders they accept: your name, address, contact number and the amount to collect.
• Customers see the assigned rider's first name, phone number and live position while their delivery is in progress.
• Dilsho staff access account data only to operate the platform (approving shops, verifying riders, resolving complaints); every sensitive action is logged.
• We disclose data to authorities only where the law requires it.

4. Cookies

Dilsho uses first-party cookies only. One session cookie keeps you signed in; it is essential and set only when you log in. If you accept the cookie banner we also record the anonymous usage statistics described above; if you choose "Essential only" we do not. Your choice is remembered on your device and you will not be asked again on every page.

5. How long we keep it

• Account details: for as long as your account exists.
• Order records: kept for accounting and dispute resolution; after account deletion they are retained only in anonymised form.
• Security and audit logs: about 6 months.
• Anonymous usage statistics: about 13 months, so year-on-year comparisons work.
• Rider live location: only while a delivery is in progress; it is not kept as a movement history.
• Emailed verification and password-reset links: expire within hours and are deleted within days.

6. How we protect it

Passwords are stored only as strong one-way hashes. Session tokens and emailed links are stored hashed, so a copy of our database cannot be replayed to sign in. Traffic is encrypted with HTTPS, access is role-based and server-enforced, and sensitive actions are audit-logged.

7. Your rights and choices

• You can view and edit your name and email in your account settings, and change your password at any time.
• You can request a copy of the data we hold about you, or the deletion of your account, via the contact page. Deleting your account removes your personal details; anonymised order records may be retained for accounting.
• You can withdraw analytics consent by clearing this site's data in your browser - the banner will ask again on your next visit.

8. Children

Dilsho accounts are for adults. Shop and rider accounts require you to be at least 18; customer accounts require you to be old enough to enter a purchase contract where you live.

9. Changes and contact

If this policy changes materially we will announce it on this page before the change takes effect, and update the version shown below. Questions and data requests: use the contact page.

Version 2026-07-29 - effective July 29, 2026.