This Privacy Policy describes how Milkiyat (“we,” “us,” or “our”) processes personal information when you use our websites, applications, and related services (the “Services”) offered under the milkiyat.com brand in connection with real estate listings, agents, agencies, and developers in Pakistan.

We aim to process personal data fairly, lawfully, and transparently, in line with the direction of Pakistan’s Personal Data Protection Bill (PDPB), where enacted and applicable, and with obligations under the Prevention of Electronic Crimes Act (PECA), 2016, and other applicable Pakistani law. This policy supplements (and does not replace) our Terms of Use or any product-specific terms you accept when using the Services.

This document is not legal advice. A qualified Pakistani advocate should review it before you treat it as binding on your organisation.

2.1 Personal data you provide

When you register or use the Services, we collect the following personal data types:

• Full Name
• Email Address
• Phone Number

Accounts are securely created using standard email-and-password credentials or third-party Google Sign-In (Google OAuth). If you use Google Sign-In, we receive information that Google shares according to your account settings and Google's Privacy Policy.

You may also provide:

• Verification (KYC): Computerized National Identity Card (CNIC) number and related verification documents or images where required for agent or high-trust onboarding.
• Listings & inquiries: property descriptions, media, pricing, location details, and messages you send through forms, chat, or contact features.
• Payments: payment-related information processed by our payment service providers (we do not store full card numbers on our own servers).

2.2 App performance telemetry

We collect anonymized crash logs and diagnostics to monitor platform stability, diagnose errors, and improve reliability. These events are not used to build advertising profiles.

2.3 Automatic information

When you use the Services, we automatically collect or receive:

• Device & network: IP address, browser type, operating system, device identifiers where available, and approximate location derived from IP.
• Usage data: pages viewed, searches, interactions with listings, and timestamps used to secure and improve the platform.
• Cookies & similar technologies: cookies, local storage, and pixels for sessions, preferences, analytics, and (where permitted) marketing measurement (see Section 10).

2.4 Device storage & media

Milkiyat does not natively scrape, browse, or access local device storage folders, files, or private photo or video galleries on your phone or computer. All media uploads (such as property images) are strictly user-initiated through sandboxed web file inputs and are transmitted directly to our Cloudinary CDN storage for hosting and delivery.

2.5 Third-party sign-in (OAuth)

If you sign in with Google, we receive the profile information that provider shares with us according to your settings. You should review Google's terms before connecting your account.

For standard hosting logs and diagnostic events, see Section 10.

We process personal information for the following purposes, aligned with our Google Play Data Safety declarations:

We also use personal information to:

• Verify identity, prevent fraud, and protect users and the platform;
• Display listings and facilitate communication between users and advertisers;
• Deliver essential transactional communications, including 6-digit security OTPs and account recovery instructions;
• Send service messages, security alerts, and (where permitted) marketing communications;
• Comply with legal and regulatory obligations, including tax and anti–money laundering requirements where they apply;
• Enforce our terms and defend our legal rights.

As a real estate marketplace operating in Pakistan, we may be subject to or align with obligations under the Anti-Money Laundering Act, 2010 and related rules, guidance, and sector expectations concerning customer due diligence, record-keeping, and cooperation with competent authorities.

Where the law applies to our activities, we may be required to verify identities, monitor activity for risk indicators, maintain records, and report suspicious transactions to the Financial Monitoring Unit (FMU) or other designated bodies, and to cooperate with the Federal Board of Revenue (FBR) and law enforcement when legally compelled. The scope of these duties depends on our regulatory classification and the nature of each transaction; we do not state that every user interaction triggers a statutory report.

We reserve the right to disclose personal information when we reasonably believe it is required or permitted by law to prevent fraud, money laundering, terrorist financing, tax offences, or other unlawful activity, or to respond to lawful requests from regulators and courts.

Milkiyat is a marketplace. Listings are typically published by independent agents, agencies, or developers (“Advertisers”).

When you click “Call”, “WhatsApp”, “Email”, or submit an inquiry on a property listing, you explicitly consent to our sharing of the contact details and message content you provide with the Advertiser responsible for that listing, so they can respond to you. Advertisers are independent controllers for their subsequent use of your data; their practices are governed by their own policies and any direct agreement with you.

We may also share data with hosting, analytics, communications, payment, and security vendors under contracts that require appropriate confidentiality and security measures.

Data in transit between your browser and our servers is protected using TLS (HTTPS) where the Services are correctly configured.

Sensitive verification materials (including CNIC-related uploads) are stored using industry-standard encryption at rest and access controls, limited to authorised systems and personnel for identity verification (KYC), fraud prevention, and compliance. No online system is completely secure; you should use strong passwords and protect your devices.

We retain personal information only as long as necessary for the purposes described in this policy and to meet legal, tax, and regulatory requirements.

Transaction-related and compliance records (including materials that may be relevant for tax, audit, or anti–money laundering purposes) may be retained for at least five (5) years from the end of the relevant relationship or transaction period, or longer where Pakistani law or a lawful authority requires a longer period.

When retention periods end, we delete or anonymise data where feasible, subject to backup and archival systems that may take additional time to purge.

Subject to applicable law, you may have the right to:

• Access personal information we hold about you;
• Correct inaccurate or incomplete data;
• Request erasure of certain data, subject to legal hold, regulatory retention, and our overriding legitimate interests (for example, fraud prevention or unresolved disputes).

To exercise these rights, contact us using the details in Section 14 or follow the account deletion process in Section 9. We may verify your identity before responding.

What is deleted

When your deletion request is approved and processed, we purge from live systems:

• Personal profile records (name, email, phone, and related account fields);
• Login credentials, session tokens, and authentication data;
• Saved properties, favorites, and personal dashboard data;
• Active real estate listings tied to your account, removed from our live databases and Meilisearch search indexes.

What may be retained

After deletion, we may retain non-identifiable transaction logs or historical ledgers regarding promotional credit balances (for example, spending points on Super Ads, High demand ads, or Popular ads) that cannot reasonably be linked back to you. Such records are kept only where strictly required for legal accounting compliance, fraud prevention, or dispute resolution, as described in Sections 4 and 7.

10.1 Log files & diagnostics

Like most websites and applications, our servers automatically record standard hosting logs when you use the Services, including:

• Internet Protocol (IP) address;
• Browser type and version;
• Referring or exit pages;
• Date and time stamps of requests.

We also collect anonymized crash logs and diagnostic events (as described in Section 2.2) to maintain security, prevent abuse, and improve reliability. These logs are not sold as personal advertising profiles.

10.2 Cookies & similar technologies

We use cookies, local storage, and similar technologies to operate the Services, remember your preferences, and measure usage:

• Essential cookies — required for login, security, and core functionality;
• Preference cookies — to remember settings such as theme or language where applicable;
• Analytics cookies — to understand how the platform is used and improve performance;
• Marketing cookies — only where you have consented, for campaign measurement.

You can control non-essential cookies through your browser settings or any cookie banner we provide. Blocking essential cookies may limit your ability to sign in or use certain features.

Our service providers or infrastructure may process data outside Pakistan. We use global infrastructure providers like Amazon Web Services (AWS) to ensure high-speed, secure data processing and email delivery. Where required, we implement safeguards intended to protect your information in line with applicable requirements.

The Services are not directed to children under the age at which they may validly consent under Pakistani law. We do not knowingly collect personal information from children. If you believe we have done so, please contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may be communicated through the Services or by email where appropriate. Continued use of the Services after changes, where permitted by law, constitutes acceptance of the updated policy.

For privacy-related requests or questions about this policy, reach out using the details below.

General privacy inquiries: [email protected]

Account deletion & data erasure: [email protected]

Office: Lake Harbour, Downtown Park View City, Islamabad, Pakistan.

This Privacy Policy is provided for transparency and general information. It does not create rights for third parties and is subject to change. Nothing here waives any statutory rights you may have under Pakistani law once applicable data protection legislation is fully in force.