Privacy Policy

1. Overview & Who We Are

This Privacy Policy ("Policy") describes how Milanse Private Limited ("Milanse", "we", "us", "our"), the owner and operator of the Milanse matrimonial platform ("Platform"), collects, uses, stores, discloses, and protects your personal data when you access or use our website, mobile application, or any related services. This Policy is drafted in compliance with the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Intermediary Guidelines"), and all other applicable Indian laws.

2. Data Fiduciary Details

Under the DPDPA 2023, Milanse Private Limited is the Data Fiduciary responsible for processing your personal data. Our Data Protection Officer and Grievance Officer details are provided in Section 21 of this Policy. All data processing is conducted within India or in jurisdictions that offer equivalent or greater data protection standards.

3. Personal Data We Collect

We collect personal data that you voluntarily provide during registration and use of the Platform, as well as data we collect automatically. Below is a comprehensive breakdown of the categories of personal data we collect:

4. Aadhaar & KYC Data — Critical Disclosure

Aadhaar-based verification is conducted exclusively through DigiLocker's secure, UIDAI-authorised API or through Surepass's Aadhaar eKYC service. Your Aadhaar XML/data and the 12-digit Aadhaar number are processed in temporary memory only — they are never written to disk, never logged, and never stored in our database. The only artefact stored is a one-way salted SHA-256 cryptographic hash of your Aadhaar number, which cannot be reversed to obtain your actual number. This hash is stored solely to detect and prevent the same person from creating multiple accounts, as required for platform integrity. We strictly comply with the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and all UIDAI guidelines. We do not use Aadhaar data for any purpose other than verifying your identity as required by the Platform's trust-first mandate.

5. Biometric & Photo Data

Under the SPDI Rules 2011, biometric data — including facial images used for identity purposes — constitutes Sensitive Personal Data or Information (SPDI). We handle this data with the highest level of care:

• •Selfie Verification: During the verification process, we capture a live selfie which is processed by AWS Rekognition to confirm liveness and match against your submitted identity documents. The verified selfie is stored permanently as your "identity anchor" at a restricted access path and is NEVER deleted, even if you delete your account — this is to prevent the same person from re-registering with a new identity after being rejected.
• •Photo Processing: All profile and gallery photos are processed through AWS Rekognition for: (a) single-face detection to confirm only your face is in the photo, (b) NSFW content moderation to detect and reject inappropriate imagery, and (c) face comparison against your verified selfie to confirm it's truly you (threshold: 85% confidence).
• •No Biometric Templates: We do not store facial recognition templates, embeddings, or biometric templates. Only the original image files are stored. AWS Rekognition processes images and returns comparison scores; it does not store templates on our behalf.
• •Watermarking: All photos served through the Platform are watermarked with a dynamic overlay to prevent misuse and unauthorised distribution.
• •Storage: All photos are stored on Cloudflare R2 (encrypted at rest) and served via Cloudflare CDN with access controls.

6. Sensitive Personal Data or Information (SPDI)

Under the IT (SPDI) Rules 2011, the following categories of your data constitute Sensitive Personal Data or Information (SPDI), and we treat them with heightened protection and require your explicit consent for collection:

• •Biometric data (selfie, face matching scores)
• •Health and physical disability information (if voluntarily disclosed)
• •Financial information (income range — only stored in bucketed/non-precise form)
• •Sexual orientation (not explicitly collected; marital intent is the platform's purpose)
• •Religious beliefs and community affiliation (Gotra, Aakna, religion)

You may withdraw your consent for SPDI collection at any time by deleting your account, subject to our data retention obligations under applicable law. Withdrawal of consent may prevent you from using the Platform, as verification is mandatory for all users.

7. Legal Basis for Processing

Under the DPDPA 2023 and SPDI Rules 2011, we process your personal data on the following legal grounds:

8. How We Use Your Information

We use your personal data for the following specific purposes:

• •Account creation, authentication, and session management
• •Mandatory identity verification (Aadhaar KYC / document verification / selfie liveness check) before your profile goes live
• •Building and displaying your matrimonial profile to other verified users (subject to your privacy settings)
• •Operating our AI-powered compatibility scoring and recommendation engine
• •Enforcing Gotra auto-exclusion — same-gotra profiles are permanently excluded from your search results and recommendations at the database level
• •Enabling messaging, interest expressions, and other interactive features between verified users
• •Sending transactional notifications via SMS (MSG91), email (Resend/SES), push notifications, and WhatsApp Business (opt-in only and with pre-approved templates)
• •Processing payments for premium subscriptions through Razorpay
• •Computing your Seriousness Score (a platform-internal trust indicator based on login frequency, response rate, profile completeness, and verification level — shown only to other users as a label like 'Highly Active')
• •Detecting and preventing fraud, fake profiles, and abuse
• •Complying with legal obligations and responding to lawful government requests
• •Improving the Platform through aggregated, anonymised analytics
• •Sending service communications (verification status updates, subscription renewal reminders, policy changes)

9. Information Sharing & Disclosure

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes. We share your data only in the following circumstances:

10. International Data Transfers

While we are an India-first platform and store the majority of your data within India, certain third-party service providers (such as AWS for Rekognition image processing and Cloudflare for CDN delivery) may process your data in jurisdictions outside India. We ensure that such transfers comply with the DPDPA 2023 and that adequate safeguards are in place, including contractual data processing agreements that require equivalent levels of data protection. You consent to such transfers by using the Platform.

11. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy or as required by applicable law:

12. Your Rights Under DPDPA 2023

Under the Digital Personal Data Protection Act 2023, you have the following rights as a Data Principal:

13. Your Privacy Controls on the Platform

In addition to your statutory rights, the Platform provides granular, real-time privacy controls:

• •Profile Visibility: Hide your profile from search results entirely (go invisible) or hide from specific cities, states, or countries.
• •Anonymous Browsing: Browse profiles without appearing in their 'Recently Viewed' list.
• •Photo Privacy: Set photos to be visible to everyone, only to users you've mutually expressed interest in, or only to accepted connections.
• •Block Users: Block specific profiles from ever seeing or contacting you.
• •Contact Controls: Control who can send you interests and messages.
• •Notification Preferences: Granular control over SMS, email, push notification, and WhatsApp notification categories.
• •Data Download: Request a download of all your personal data from Settings > Account > Download My Data.
• •Account Deletion: Permanently delete your account and all associated data (excluding legally retained data) from Settings > Account > Delete Account.

14. Data Security

We implement reasonable security practices as required by Rule 8 of the SPDI Rules 2011 and industry best practices. Our security measures include:

• •Encryption in transit: All data transmitted between your device and our servers uses TLS 1.3.
• •Encryption at rest: All data stored in our database (PostgreSQL) and file storage (Cloudflare R2) is encrypted at rest.
• •Secure session management: JWT-based authentication with short expiry, refresh token rotation, device-bound sessions, and concurrent session limits.
• •Rate limiting: All API endpoints are rate-limited to prevent brute force and abuse.
• •DDoS protection: Cloudflare provides network-layer DDoS protection.
• •Device fingerprinting: Unusual login patterns trigger re-authentication requirements.
• •Access controls: Internal access to user data is role-based and logged. Only authorised team members can access verification data.
• •Regular audits: We conduct periodic internal security reviews and vulnerability assessments.
• •Password hashing: Passwords are hashed using bcrypt with a cost factor of 12 before storage.

15. Cookies & Local Storage

We use cookies and browser local storage for essential platform functions. For full details, see our Cookie Policy. In summary: we do not use advertising or third-party tracking cookies. We only use essential (authentication, security, preferences) and analytics cookies (first-party, aggregated). You can manage cookie preferences in your browser settings, but disabling essential cookies will prevent you from logging in.

16. Children's Privacy

The Platform is strictly for adults. Users must be at least 18 years of age (females) or 21 years of age (males) per the eligibility requirements of Indian matrimonial law. We do not knowingly collect personal data from anyone under 18 years of age. If we discover that a user is under 18, we will immediately terminate their account, delete their data, and notify their guardian where possible.

17. Third-Party Links & Services

The Platform may contain links to third-party websites or integrate with third-party services (e.g., DigiLocker, WhatsApp). This Policy applies only to our Platform. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party services you interact with through the Platform.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. For material changes, we will provide at least 30 days' advance notice via in-app notification and email to your registered address. Continued use of the Platform after the effective date of the revised Policy constitutes acceptance of the changes. If you do not agree to the changes, you must stop using the Platform and may delete your account.

19. Grievance Officer (As Required by IT Rules 2011 & DPDPA 2023)

As required under Rule 5(9) of the IT (SPDI) Rules 2011 and the IT (Intermediary Guidelines) Rules 2021, we have appointed a Grievance Officer to address complaints and concerns related to your personal data:

20. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data: