MIF-CHECKOUT Back to home

Privacy Policy

Last updated: February 2026

1. Introduction

This Privacy Policy (the "Policy") explains how MIF Video Management System (MIF-VMS) ("MIF-VMS", "we", "us", "our") collects, uses, stores, retains, discloses and deletes information about the merchants, operators and administrators who use the MIF-VMS service ("you", the "merchant" or the "user").

What MIF-VMS is. MIF-VMS is a warehouse and e-commerce video management system for Indian D2C brands. It records the packing / dispatch of an order at the merchant's warehouse against the outbound Air-Way-Bill (AWB) or order identifier, stores those recording files in the merchant's own cloud storage (typically Google Drive) and helps the merchant respond to marketplace footage requests (for example, AJIO packing-proof requests received over Gmail) by matching the incoming request with the correct recording and replying on the same email thread.

MIF-VMS is a business-facing tool used exclusively by warehouse operators, dispatch supervisors and merchant administrators. It is not directed at consumers or children and does not itself sell goods.

2. Information We Collect

  • Account information — display name, email address, phone number and role (owner / operator / admin) used to sign into MIF-VMS.
  • Business / merchant information — business name, warehouse location(s), timezone, contact person, and preferences (retention window, storage destination, notification rules).
  • Login information — hashed passwords (where email/password auth is used), one-time-password (OTP) tokens, session tokens and, where applicable, Google Sign-In tokens described in §3.
  • Order / AWB information — the order id, marketplace, AWB, SKU list, carrier, dispatch date and any operator notes attached to a recording.
  • Recording metadata — start time, end time, duration, camera / device id, warehouse station, operator id, resolution, checksum, upload status and the identifiers of the folder / files created for the recording in the connected storage destination.
  • Videos and photographs created by the merchant — the actual media captured during the packing / dispatch flow. These are uploaded to the merchant's connected Google Drive; MIF-VMS retains only the identifiers and metadata required to find and manage them.
  • Application usage / activity information — pages visited within MIF-VMS, feature usage counters, error logs, IP address, browser and device identifiers, and access-audit logs.
  • Support information — messages, screenshots or files you send to our support team along with the ticket metadata.
  • Google account information obtained through OAuth — described in detail in §3.

3. Google API Services and Google User Data

Merchants may optionally connect one or more Google accounts to MIF-VMS in order to unlock specific features. All Google access is scoped to the exact operations described below and is governed by the Google API Services User Data Policy, including the Limited Use requirements.

A. Google Sign-In

Where you sign into MIF-VMS with your Google account, we receive the basic profile information that Google provides for authentication: your name, email address, Google user identifier (the stable "sub" claim) and, where available, your profile picture URL. We use this only to identify you across sessions, populate your profile inside MIF-VMS and let you sign in without a separate password. We do not use Google Sign-In data for advertising, profiling or resale.

B. Google Drive

When a merchant connects Google Drive, MIF-VMS requests only the Google Drive access needed to perform the following actions inside the merchant's own Drive:

  • Create folders for order / AWB recordings (one folder per configured hierarchy).
  • Upload recording videos into those folders.
  • Upload still images captured during a recording (packing photos, damage photos, AWB label photos).
  • Verify the integrity of uploaded files (size, MIME type, checksum).
  • Obtain file / folder identifiers, direct links and shareable links required to display, deep-link, or send the recording back to the merchant or to a marketplace.
  • Manage or delete files and folders that MIF-VMS itself created when the merchant requests deletion, when configured retention expires (see §7) or when the merchant disconnects Drive.

The connected Google Drive is used as the merchant's storage destination for recordings. MIF-VMS does not scan, index, read or otherwise access Drive content the merchant did not create through MIF-VMS.

C. Gmail

When a merchant connects Gmail, MIF-VMS requests only the Gmail access needed to service marketplace footage-request workflows, currently AJIO packing-proof requests. Specifically MIF-VMS may:

  • Identify incoming AJIO footage-request emails using sender / subject filters.
  • Read the body of those specific emails to extract the order identifier and related request information.
  • Match the request to the corresponding MIF-VMS recording using order id / AWB.
  • When the merchant explicitly uses the "Reply with footage" feature, prepare and send a reply on the original AJIO thread, attaching the correct footage link.

MIF-VMS does not read, index, mine, categorise, forward, or otherwise access Gmail messages that are not identified as marketplace footage requests. Access is strictly the minimum required to deliver the feature.

4. How Google User Data Is Used

Google user data obtained through MIF-VMS is used only to provide the Google-related functionality the merchant explicitly requested (Sign-In, Drive recording storage, Gmail footage-request handling), as described in §3.

MIF-VMS does not sell Google user data. We do not use Google user data for:

  • Advertising or targeted advertising.
  • Selling to or sharing with data brokers, list brokers or credit bureaux.
  • Credit scoring or lending decisions.
  • Profiling that is unrelated to the requested MIF-VMS functionality.
  • Marketing that is unrelated to the requested MIF-VMS functionality.
  • Training general or non-personalised artificial-intelligence or machine-learning models.

MIF-VMS's use of and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Google Data Sharing

Google user data received by MIF-VMS is not sold and is not shared with advertisers or data brokers.

MIF-VMS shares Google user data only with the specific service providers that are operationally necessary to run the service:

  • The cloud infrastructure that hosts MIF-VMS (compute + database, contracted under standard confidentiality & security agreements).
  • Error-monitoring and application-logging services strictly to keep MIF-VMS running (payloads are sanitised to exclude message bodies and tokens).

We do not otherwise transfer, publish, disclose, sync, integrate or license Google user data to any third party. MIF-VMS makes no false claims about third-party providers and will update this list transparently if it ever changes.

6. Data Storage

  • Application & account metadata — stored in MIF-VMS's primary database (MongoDB) as required to operate the service (order lookup, retention scheduling, audit logs).
  • Recording files — stored in the merchant's own connected Google Drive. MIF-VMS does not maintain a shadow copy of the recording after the upload is confirmed.
  • OAuth credentials / tokens — stored only server-side, encrypted at rest, and are never intentionally exposed to end users, front-end code, browser storage or third parties.
  • Sensitive credentials are never stored in browser localStorage. Only opaque, short-lived session identifiers may be present in localStorage / cookies for the login session.
  • Temporary local buffers — a recording may briefly reside in the operator's browser or workstation while the upload to Google Drive is in progress; it is discarded once the upload is confirmed.

7. Data Retention and Deletion

MIF-VMS supports configurable recording retention. The default retention where configured by the merchant / system is 90 days. Merchants may configure retention periods according to the settings available in the merchant dashboard.

When the configured retention period expires, MIF-VMS may delete the recording folder / files that MIF-VMS itself created in the connected Google Drive. Deletion is subject to the following safeguards:

  • The folder / file identifiers must match those recorded in the MIF-VMS metadata for that AWB / order.
  • Deletion is limited to files created by MIF-VMS. Files created by other tools, or manually uploaded by the merchant, are never touched.
  • The Drive integration must still be connected at the time of scheduled deletion; a disconnected integration causes retention deletion to skip.
  • Failed deletions are retried with exponential back-off and logged.

Metadata after deletion. After a recording is deleted from Drive, MIF-VMS may keep the recording's metadata (AWB, order id, timestamps, retention outcome) for operational and audit purposes. The metadata reflects that the footage has expired / been deleted.

Manual deletion. A merchant may manually delete a specific recording (or a batch) from the MIF-VMS dashboard at any time; the same deletion path applies to the corresponding Drive files.

Account / data deletion requests. Users may request deletion of their applicable account and associated data by contacting MIF-VMSsupport (see §15). We will action such requests within a reasonable period, subject to any statutory retention obligations (for example tax records).

8. Google Account Disconnection

Merchants can disconnect and reconnect their Google Drive and Gmail integrations at any time from the MIF-VMS settings screen. When an integration is disconnected:

  • MIF-VMS revokes and deletes the stored OAuth refresh / access token(s) for that integration on its servers.
  • Further Drive uploads / Gmail actions from MIF-VMS for that account stop immediately.
  • Metadata for recordings that were already uploaded before disconnection is retained subject to §7.
  • Retention-based deletion of Drive files after disconnection is not possible until the merchant reconnects Drive (see §7).

Disconnecting an integration does not automatically delete previously uploaded files from your Google Drive. If you also want to delete those files, use manual deletion inside MIF-VMS before disconnecting, or delete them yourself from Drive.

9. Security

MIF-VMS applies the following reasonable security measures:

  • HTTPS / TLS 1.2+ for all traffic between browsers, MIF-VMS servers and Google APIs.
  • OAuth credentials, refresh tokens and access tokens are handled and stored server-side only, encrypted at rest.
  • Role-based access control inside the merchant account (owner / admin / operator).
  • Merchant data isolation (see §10).
  • Authentication and session security — signed session tokens, secure & HTTP-only cookies where applicable, short-lived tokens, revoke-on-logout.
  • Secure token storage — sensitive tokens are never written to browser localStorage.
  • Audit logging of privileged actions (deletion, integration disconnect, permission changes) for operational / audit review.

MIF-VMS does not claim compliance with any certification or security standard that it does not actually hold. We continually improve our security posture in line with industry best practice.

10. Merchant Data Isolation

Every merchant account inside MIF-VMS is logically isolated. One merchant cannot access another merchant's recordings, Google connections, Gmail requests, invoices or account information. All database queries and API endpoints scope reads and writes by the authenticated merchant id.

11. Cookies / Session Data

MIF-VMS uses cookies and equivalent browser storage strictly for:

  • Maintaining the login session.
  • CSRF / security-tokens where applicable.
  • Authentication continuity across pages.
  • Remembering non-sensitive UI preferences (e.g. sidebar collapsed / expanded).

MIF-VMS does not use advertising cookies, third-party ad-network cookies, or cross-site tracking cookies.

12. User Rights and Requests

Users of MIF-VMS may at any time:

  • Request access to the personal information MIF-VMS holds about them.
  • Request correction of inaccurate information.
  • Request deletion of applicable account and data information (subject to statutory retention).
  • Disconnect Google Drive or Gmail integrations at any time (see §8).
  • Contact our support team with any privacy question or concern (see §15).

13. Children

MIF-VMS is a business / warehouse operational service. It is not directed toward children under 18 years of age and does not knowingly collect personal information from children. If you believe a child has provided information to MIF-VMS, please contact support and we will delete such information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, the updated version will be published on this page with a revised "Last updated" date at the top. Material changes will be highlighted so that returning users can easily identify what has changed.

15. Contact Information

For any privacy question, access / correction / deletion request, or to raise a concern about how MIF-VMS handles your (or your Google account's) data, please contact our support team:

  • Please write to the support address listed on our Contact page.

Google API Services Compliance Statement

MIF-VMS's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, MIF-VMS:

  • Accesses only the Google user data described in §3 of this Policy.
  • Accesses that data only for the purposes described in §3 and §4.
  • Uses that data only to provide or improve the user-facing features that require it.
  • Does not transfer that data other than to provide or improve those features, or as required by law, or as part of a merger, acquisition or asset sale where the merchant has been notified.
  • Does not use that data to serve advertisements, including retargeted, personalised or interest-based advertising.
  • Does not allow humans to read that data unless the merchant has given affirmative consent for specific messages, it is necessary for security purposes, it is required to comply with law, or the data has been aggregated and anonymised for internal operations.

Effective date: February 2026.