Privacy Policy

The Data Fiduciary is Mila Finance, operating www.milafinance.ai and the invited portal at app.milafinance.ai.

Write to contact@milafinance.ai for privacy questions, rights requests, and grievances. Do not send Aadhaar numbers or full bank account numbers to that inbox.

We collect only what the product needs. Each use is tied to a purpose. We do not reuse data for a new purpose without a new notice.

• Invited users: name, mobile number, optional email, organisation, role, and records of imports, edits, and demand sends they perform. This lets them sign in with OTP and gives the developer an audit trail. There is no public sign-up.
• Ask Mila on WhatsApp: the invited user’s WhatsApp number, their question, and Mila’s reply. This lets them ask about their project books. We match the number to their login.
• Buyers and co-owners: name, phone, email, address, and mother name if supplied; unit, booking and payment details; loan, sanction and disbursed amounts and bank name if supplied; demand letter files, amounts, due dates, and delivery status. This lets the developer keep the project book and send demand letters.
• People named on a unit: sales manager or channel partner name if supplied; banker name, phone, and email if supplied. This shows who works that unit in the book. A banker named on a row may also get a copy of a demand letter.
• Developer collection accounts: payee name, bank, account number, and IFSC. This prints where to pay on a demand letter. We do not store a buyer’s full bank account.
• Architect certificate: a PDF the developer uploads for a demand batch, so it can go with the letters.
• Login and OTP records: attempts against a mobile number, so we can run login and stop abuse.
• Website enquiries: name, email, phone, company, and message, so we can reply to a request for access or a demo.

We do not collect Aadhaar or biometric data. We do not use buyer contacts for marketing or for offers that are not about that project’s books or demand letters.

Login accounts are created by Mila admin. The user then proves the mobile number with OTP. OTP attempt records come from that login.

Buyer contacts, unit and payment details, people named on a unit, developer collection accounts, and architect certificates come from the real estate developer (typed or imported by someone with project access). After OTP login, a developer confirms that the buyers are their customers, have given permission to share and store their financial data, and that the developer has the right to give Mila those contacts and send demand letters. Mila admin does not make that confirmation. New buyer-contact storage or a demand send needs an attested developer with access to that project. Existing contacts stay; we do not backfill an old confirmation.

That developer confirmation is not the same as a buyer agreeing that Mila may store a loan file or show papers to a bank.

Website visitors send us their own details when they write in.

Ask Mila questions come from the invited user’s WhatsApp after we match the number to their login.

We do not sell personal data. We share it only to run the service:

• the developer’s authorised users and Mila staff working that project;
• hosting and database companies that run the site and store the project book and files;
• MSG91, for login OTP (the mobile number);
• a document-signing service, when a demand letter is signed (the letter contents);
• email delivery companies, when a demand is emailed (recipient contact, letter, and any attached certificate);
• MSG91, when a demand is sent on WhatsApp (recipient contact and letter) or when an invited developer uses Ask Mila (the number, the question, and the reply);
• Langfuse, for Ask Mila traces (the caller’s number and name, the questions and replies, and project-book data used to answer);
• an AI company, when Ask Mila answers (they do not train on this);
• the banker named on a unit, when a send includes that banker.

The project book and private files live on servers in India. Login OTP, demand email or WhatsApp, Ask Mila answers, and some application hosting may be processed outside India so the site and messages can run.

Ask Mila traces are processed by Langfuse in the United States.

If you ask, we will name who received your data and what was shared.

• Sign-in is a one-time code to your mobile number. We do not store passwords.
• The website and database connections use TLS.
• The project book and private files are stored in India and encrypted at rest.
• Private files stay in a private store. Only a signed-in person who may see that project can download them.
• Each person sees only the projects and actions their role allows.
• We record changes to units, the people on a unit, and payments, and each private-file download.
• The database host keeps backups so the project book can be restored.

We keep login accounts while they are enabled, then for 90 days after login is turned off. We keep Ask Mila WhatsApp questions and answers while that login is enabled, and after that until you ask us to erase them. We keep project books, buyer contacts, and demand letters while the project is active, then for seven years after it closes. We keep OTP and login-abuse records for one year, and access or demo emails for two years (or until you ask us to delete them if no account was created).

If a complaint, investigation, or court matter is open, we keep what that matter needs until it closes. Write to contact@milafinance.ai to ask us to erase data. We may refuse or delay erasure of a buyer contact that is still needed for a live project book or an unexpired demand, or that the law requires us to keep. We will say so in writing.

Under the DPDP Act you may ask us to:

• show you the personal data we hold about you;
• name who received your data and what was shared;
• correct incomplete or wrong data;
• erase data we no longer need for a stated purpose;
• name a nominee who can exercise these rights if you cannot;
• raise a grievance with us;
• complain to the Data Protection Board of India after you have written to us, once that Board’s complaint channel is available.

Write to contact@milafinance.ai. Say what you want and give a mobile number or email we can use to confirm it is you. We aim to acknowledge within 7 working days and finish within 30 days, unless law allows more time.

Write to contact@milafinance.ai to withdraw a yes or to ask us to stop using your data for a purpose. A developer can withdraw the developer confirmation the same way. Email is enough. You do not need a portal login. Withdrawal stops new processing for that purpose. It does not unwind letters already sent or records we must keep.

A buyer who wants contacts removed from a project book should first ask the developer who put them there. The buyer may also write to us. We will tell the developer and apply the erasure rules above.

The Grievance Officer is Kamlesh Kamria. Write to contact@milafinance.ai. Website: www.milafinance.ai. We will resolve grievances within one month of receipt.

If you are not satisfied, you may complain to the Data Protection Board of India. Watch meity.gov.in for the Board’s live complaint channel.

If we become aware of a personal-data breach, we will intimate affected people in plain language without delay and intimate the Board as required.

Mila is for adults. We do not knowingly collect personal data of a person under 18. If you believe we have, write to contact@milafinance.ai and we will delete it.

We will change this page when our processing changes. The date at the top will move. If a change needs a new yes, we will ask for that yes before we start the new processing.