Privacy Policy

Who operates the service

2smilk operates the milk and dairy delivery business and is responsible for customer service, delivery arrangements, billing, exceptional refund decisions and the handling of customer information for that service.

Allexor is hired by 2smilk to manage the website and app. Allexor provides technical management and support; it is not the milk supplier or delivery operator. Where technical management requires access to service information, that access is for managing and supporting the service on 2smilk's behalf.

The support and privacy contact below is the contact supplied for this service. Delivery, billing, refund and privacy requests received through it are to be coordinated with 2smilk, which remains responsible for those decisions.

Information we handle

For an account, we collect your name, phone number, delivery address, delivery pincode and password. Customers with supported delivery pincodes can order immediately. Staff arrange delivery routes and contact customers if an address cannot be served. Passwords are processed for authentication and stored as password hashes. We also keep account identifiers, delivery-person assignments, recurring delivery preferences, day plans, orders, delivery records, invoices and in-person payment statuses.

If you choose to rate a product, we store your star rating, any review text you write and the time it was submitted. Ratings and reviews are published on the product page with your first name and last initial; your phone number, address and full name are not shown.

When you contact the administrator, we handle the information you provide about your request or dispute. Please do not send passwords, one-time codes, card details or unrelated identity documents.

Requests to our services generate technical records such as IP addresses, request information, timestamps, errors and security or administrative audit events. Audit records can include account identifiers, changed data and staff actions.

Why we use information

We use account and delivery details to sign you in, arrange deliveries, communicate about service, maintain your delivery schedule, calculate bills, record collections, resolve complaints and protect accounts against misuse. Delivery information is used to check whether we can serve your address.

Browsing the public product catalogue does not require an account. Information required for an account or delivery is identified when requested. Without required details, we may be unable to create your account or fulfil a delivery.

Who receives information

Authorized administrators handle accounts, billing and customer requests. Assigned delivery personnel receive the customer and order details needed for their delivery and collection responsibilities.

We use Google Firebase and Cloud Firestore to store service records, and Firebase Authentication with reCAPTCHA for phone verification during password reset. Phone numbers submitted for Firebase verification are sent to and stored by Google for spam and abuse prevention across Google services. These services also process technical information needed for security and verification.

Our website, API hosting and communications providers process information needed to operate their services. We may disclose relevant records when required by law or to handle a legal claim. We do not sell customer personal information or use it for targeted advertising.

Storage on your device

The app stores a sign-in token and basket contents in browser storage. Firebase may also store verification or authentication state. This storage supports sign-in, account recovery and your basket. Clearing browser storage can sign you out and remove locally saved items; it does not delete your server account.

The service worker stores only a public connection-help page for offline navigation. It does not cache your account, invoices, delivery plans or API responses. An internet connection is required to use account and ordering features.

Payments

There is no advance payment or online payment gateway. Payment is collected in person for products delivered and accepted by the customer. We keep invoice amounts and collection/verification records. The app does not request card details, banking passwords or UPI PINs.

Retention, security and deletion

Account and delivery records are kept while needed to provide the service. When an account is deleted, minimum invoice and payment records are kept separately for eight complete Indian financial years following the relevant financial year. Unresolved balances, disputes or a legal hold may require longer retention. The archive includes the customer name/reference, invoice amounts, delivered line items and payment status; an outstanding balance may retain the registered phone number until settlement. Delivery addresses, passwords and the full profile are not included in this accounting archive.

You can correct your delivery address and pincode in Account. Use Delete Account to request account and associated-data deletion, either inside the app or from the public website without reinstalling. Account credentials verify ownership; contact support for assisted verification if needed. A confirmed request immediately stops account access and future recurring deliveries. Administrator fulfillment removes the profile and associated operational data while preserving the minimum accounting archive described above. We aim to fulfil verified requests within 30 days and will explain any delay or records that must be retained. Signing out or uninstalling alone does not delete an account.

You can edit or delete your own ratings and reviews at any time from the product page. Administrators may hide reviews that are abusive, off-topic or contain personal information; a hidden review is removed from public view and from the product average. Your ratings and reviews are deleted when your account deletion is fulfilled.

Passwords are hashed, account sessions are invalidated after password changes, and access to operational and accounting information is restricted by staff role. No system can guarantee complete security. Hosting and Firebase providers may process information outside India. Provider logs and backup settings must be verified for the production service before this draft takes effect; we do not claim India-only storage.

Children and policy changes

The ordering service is intended for adults arranging household deliveries. If you believe a child has provided personal information, contact the administrator so the situation can be reviewed.

We will update this policy when our practices change and identify the effective date of the approved version. Material changes affecting your choices will be communicated appropriately.