MileageBachao helps you find petrol pumps in India that stock ethanol-free (E0), 100-octane fuel. This policy explains what personal data we do and do not process, why, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the DPDP Rules, 2025. Our guiding principle is data minimisation: the surest way to protect your data is not to collect it in the first place, and for most of MileageBachao we don’t.
1. Who we are
MileageBachao is operated by an Indian company (“MileageBachao”, “we”, “us”, “our”) that owns and stores the underlying dataset in India. For personal data processed through this service, we are the Data Fiduciary under the DPDP Act. Our full corporate name, registered office and CIN are published on the Legal overview page and are kept current.
The pump information we publish — outlet name, RO code, address, coordinates, brand and which grades a pump stocks — is business fact, not personal data. We deliberately display no dealer / proprietor names. DPDP therefore bites only on the limited personal data described below.
2. What we collect — itemised notice
The following table is our itemised notice under Rule 3 of the DPDP Rules, 2025. Where a row is marked v1.1, that processing only begins when contributor accounts and check-ins ship; browsing MileageBachao today (v1.0) requires no account and no personal data at all.
| What | Why (purpose) | Legal basis | Kept? |
|---|---|---|---|
| Your device location for “near me” distance | Sort/show nearby pumps and distances | Your browser permission; processed on-device | Never stored or sent to us |
| Theme preference (light/dark) | Remember your display choice | Strictly-necessary local storage | In your browser only |
| Minimal server/access logs (IP, user-agent, timestamp, path) | Security, abuse prevention, rate-limiting, debugging | Legitimate uses (security of the service) | Short-lived; then deleted/aggregated |
| Account identifier — email (magic-link) or Google sign-in ID (v1.1) | Let you contribute (check-ins, corrections) | Your consent, at sign-up | Until you delete your account |
| Check-in events — station, grade, result, timestamp, your user ID (v1.1) | Keep availability data fresh and trustworthy | Your consent, at the prompt | Retained as a contribution record |
| Optional contact you add to a correction / report | Follow up on your report if you ask us to | Your consent, when you provide it | Only as needed to resolve the report |
| Photos you upload for a pump (v1.1) | Illustrate an outlet / support a correction | Your consent, at upload | Until removed by you or moderation |
3. Notice & consent
Where processing relies on your consent, we ask for it by a clear, unambiguous affirmative action at the moment the data is needed — for example, when you create an account or when your browser prompts to share your location for a check-in. The request is in plain language, states the specific purpose, and links to this policy.
Withdrawing consent is as easy as giving it. You can withdraw at any time from your account settings (v1.1) or by writing to privacy@mileagebachao.in. Withdrawal does not affect processing already carried out lawfully, and some contributions you have published may remain as an anonymised record where we have a legal obligation to retain them.
4. Cookies & local storage
MileageBachao uses no advertising or analytics cookies and no third-party trackers. We use a small amount of first-party browser storage that is strictly necessary for the site to work — for example, remembering your light/dark theme and, in v1.1, keeping you signed in. This information stays on your device and is not used to track you across other websites.
5. Your location
Location is the most sensitive data a pump-finder could touch, so we designed it out of the server entirely:
- “Near me” distances are computed in your browser. When you allow location, your coordinates are used on your device to sort and measure distance to pumps. They are never transmitted to us and never stored.
- Navigation hand-off uses our coordinates, not yours. When you tap “Directions”, we open your map app using the pump’s stored coordinates via a standard OS deep link. We do not round-trip your position through a third party.
- Geofenced check-ins (v1.1) ask for your location only to confirm you are at the pump. That coordinate is used transiently to validate the geofence and is not stored — we keep only the check-in event (station, grade, result, time, your user ID), never a location trail. If you decline, you can still check in via a city picker.
6. Sharing & disclosure
We share personal data only in these narrow cases:
- Processors acting for us under contract — e.g. our India-region hosting provider, and (in v1.1) an email delivery provider for magic-links, an identity provider if you choose Google sign-in, and object storage for images. They may process data only on our instructions.
- Legal & safety — to comply with a valid court order or lawful request from an authorised government agency, or to protect the rights, safety and security of users and the service.
We never sell personal data, and we do not transfer it for others’ marketing.
7. Where data is stored & security
All MileageBachao data is stored in India, in DigitalOcean’s BLR1 (Bengaluru) region. We apply reasonable security safeguards appropriate to the limited data we hold — encryption in transit, access controls, least-privilege credentials, an append-only provenance ledger for the dataset, and rate-limiting on write endpoints. If a personal-data breach ever occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Rules.
8. Retention & erasure
We keep personal data only as long as the purpose it was collected for is served, then erase it. Two specifics:
- Contribution records. Where we are required by the IT (Intermediary Guidelines) Rules, 2021 to retain user-registration and removed-content records for 180 days, we keep that forensic record and then erase it — the 180-day duty and DPDP erasure interoperate rather than conflict.
- Account deletion. When you delete your account we remove your account identifier and de-link your contributions; published availability facts may persist in aggregate and anonymised form because they are business facts about pumps, not about you.
9. Your rights as a Data Principal
Under the DPDP Act you have the right to:
- Access a summary of the personal data we process about you and how;
- Correction, completion and updating of inaccurate or incomplete data;
- Erasure of your personal data where the purpose is served or you withdraw consent;
- Grievance redressal through the mechanism below; and
- Nominate another individual to exercise your rights in the event of death or incapacity.
To exercise any right, write to privacy@mileagebachao.in (or, in v1.1, use the self-serve export/erasure controls in your account). We respond within the timelines set out below. If you are not satisfied, you may complain to the Data Protection Board of India.
10. Children
MileageBachao is a general-audience utility not directed at children. We do not knowingly process the personal data of anyone under 18 without verifiable parental consent, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us personal data, contact us and we will delete it.
11. Grievance Officer & Data-Protection contact
We publish a contact for privacy questions and grievances, as required by the DPDP Rules and the IT Rules, 2021. We acknowledge complaints within 24 hours and resolve them within 15 days (complaints in the specified categories under the IT Rules are actioned within 72 hours).
12. Changes to this policy
We may update this policy as the service and the law evolve — notably as the substantive DPDP obligations commence (expected in 2027). When we make material changes we will update the “last updated” date above and, where required, seek fresh consent. This version is effective 30 July 2026.
Related: Terms of use · Data & attribution · Legal overview.