Privacy Policy

Dilsho is a hyperlocal delivery platform that connects customers and local shops that deliver with their own staff. This policy explains what personal data we collect from each of them, why we collect it, how long we keep it, and the choices you have. It applies to the Dilsho website, the customer app at /app, the Android app, the shop dashboard and the Dilsho POS cloud services.

1. What we collect

• Account details - your full name, mobile phone number (your primary sign-in id) and, if you choose to add one, your email address. If you sign in with Google, we also store the identifier Google gives us for your account; your Google password never touches our servers.
• Delivery addresses - the addresses and map pins you save or use for an order, so the shop and its delivery staff can reach you.
• Order history - the items you order, the shops you order from, prices, timestamps and delivery outcomes.
• Shop business details (shopkeepers) - your shop's name, category, address, location pin, and any registration details you provide such as CNIC, NTN, GST or licence numbers, used to verify and list your shop.
• Shop staff details (shop team members) - the name, phone number and optional email your shopkeeper enters when creating your Dilsho login, plus the powers they grant you (for example delivering orders).
• Delivery location - if a shop's delivery staff choose to share their live position from the Dilsho app while bringing an order, it is shown to that order's customer. Sharing is optional and stops when the delivery ends; we do not track anyone otherwise.
• Technical and security data - IP address and browser details in our security and audit logs (sign-ins, sensitive account actions), used to protect accounts and investigate abuse.
• Anonymous usage statistics - only if you accept the cookie banner: which pages are visited, when, and the page you came from. The IP address in these statistics is stored only as a salted, truncated hash that cannot be turned back into your address. We use no third-party analytics or advertising trackers of any kind.

2. How we use it

• To run the service: show catalogues, place and deliver orders, and settle cash-on-delivery amounts.
• To verify shops before they join the marketplace.
• To keep accounts safe: sign-in security, fraud prevention, rate limiting and audit trails.
• To support you when something goes wrong with an order.
• To understand, in aggregate, how Dilsho is used so we can improve it.

We never sell your personal data, and we never share it with advertisers.

3. Who sees what

• Shops see the orders placed with them: the items, your name, delivery address and contact number - only what they need to prepare and hand over the order.
• The shop's delivery staff see the delivery details of the orders their shop assigns to them: your name, address, contact number and the amount to collect.
• Customers see the name and phone number of the shop member bringing their order and, if that person shares it, their live position while the delivery is in progress.
• Dilsho staff access account data only to operate the platform (approving shops, resolving complaints); every sensitive action is logged.
• We disclose data to authorities only where the law requires it.

4. Cookies

Dilsho uses first-party cookies only. One session cookie keeps you signed in; it is essential and set only when you log in. If you accept the cookie banner we also record the anonymous usage statistics described above; if you choose "Essential only" we do not. Your choice is remembered on your device and you will not be asked again on every page.

5. How long we keep it

• Account details: for as long as your account exists.
• Order records: kept for accounting and dispute resolution; after account deletion they are retained only in anonymised form.
• Security and audit logs: about 6 months.
• Anonymous usage statistics: about 13 months, so year-on-year comparisons work.
• Delivery live location: only while a delivery is in progress; it is not kept as a movement history.
• Emailed verification and password-reset links: expire within hours and are deleted within days.

6. How we protect it

Passwords are stored only as strong one-way hashes. Session tokens and emailed links are stored hashed, so a copy of our database cannot be replayed to sign in. Traffic is encrypted with HTTPS, access is role-based and server-enforced, and sensitive actions are audit-logged.

7. Your rights and choices

• You can view and edit your name and email in your account settings, and change your password at any time.
• You can request a copy of the data we hold about you, or the deletion of your account, via the contact page. Deleting your account removes your personal details; anonymised order records may be retained for accounting.
• You can withdraw analytics consent by clearing this site's data in your browser - the banner will ask again on your next visit.

8. Children

Dilsho accounts are for adults. Shop and shop-staff accounts require you to be at least 18; customer accounts require you to be old enough to enter a purchase contract where you live.

9. Changes and contact

If this policy changes materially we will announce it on this page before the change takes effect, and update the version shown below. Questions and data requests: use the contact page.

Version 2026-07-29 - effective July 29, 2026.