Privacy policy
1. Who we are
Milyoo, Inc. (“Milyoo”, “we”, “us”) provides a shared workspace that you and your AI agents read and write: a graph of records, notes, files and tasks, with a web app and an MCP server your agents connect to (the “Service”). A Mac app is in development and not available yet. This policy explains how we handle personal information when you visit our website, join the waitlist, use the Service, or interact with us.
For information our customers put into the Service about other people, such as notes about a contact or a meeting transcript, the customer is the controller and we act as a processor on their behalf, under our Data Processing Addendum. Requests about that information should go to the customer who holds it.
2. Information we collect
Information you give us
- Account information: name, email address, and either a password (stored only as an scrypt hash) or your Google account identifier when you sign in with Google; your workspace and role.
- Waitlist: your email address, and if you give them, your company and what you'll use Milyoo for.
- Billing information: your plan, subscription status and billing contact. Payments run through Stripe; card details go to Stripe and are never stored by us. Stripe Tax uses your billing address to work out sales tax.
- Customer content: records, fields, notes, files, tasks, meeting transcripts and notes, deal room content, and anything you or your agents drop into the Nebula or write to the workspace.
- Communications: messages you send us, demo requests and survey responses.
Information from your agents
- Agent connections: each connected agent's name and client (for example Claude or Codex), its key or OAuth connection, and a receipt for every change it makes: which agent, for which person, from what source and when.
- Wake webhooks: if an agent gives us a web address to be woken at, we keep that address and send it signed event notices (see section 5). An agent without one gets the same notices in its hosted Wake Inbox, which stays inside the Service.
Information from connected services
- Calendar: if you connect Google or Microsoft calendar, event titles, times, attendees and meeting links, used to show upcoming meetings and link notes to the right people.
- Gmail, Google Drive and Outlook: if you connect one in the Nebula, we read recent messages or files (read-only) and add them to your Nebula as items for your agents to file. Connection tokens are encrypted (AES-256-GCM) before storage.
- Audio and transcripts: audio and video files you drop in are sent to Deepgram for transcription, and the transcript is stored as customer content. Recording meetings in the Mac app isn't available yet. When it is, audio from your microphone and computer will be streamed to Deepgram, and by default not kept after transcription.
Information collected automatically
- Usage and device data: IP address, browser and device type, pages and features used, and error logs, used to run, secure and improve the Service.
- Data use: how much data each request reads and sends, per workspace and per agent, to run the monthly data pool on your plan and protect your workspace from runaway reads. This is a count of bytes, not the content.
- Cookies: strictly necessary cookies for sign-in and security. See our Cookie policy.
3. How we use information
- To provide, maintain and secure the Service, including authentication, syncing, backups and the data pool.
- To deliver features you choose, such as transcription, suggested record updates and answers to your questions.
- To email you about your account: an invitation when someone adds you to their workspace and a welcome when you sign up, sent through Resend. Where permitted, product news, which you can opt out of at any time.
- To process payments through Stripe and prevent fraud and abuse.
- To comply with legal obligations and enforce our Terms.
Where the GDPR applies, our legal bases are performance of a contract, our legitimate interests (securing and improving the Service), your consent (where we ask for it), and compliance with legal obligations.
4. AI processing
Some features use third-party AI models to process customer content: Deepgram (Nova-3) transcribes audio, and Anthropic's Claude models propose field updates and answer questions. Meeting notes are not available yet; when they are, Anthropic's models will write them. We send only what's needed for the feature you're using. Your own agents (Claude, ChatGPT, Codex, Cursor or any other) are yours: what they read from your workspace is governed by your agreement with their provider. Every change to your records is recorded with who made it and from what, and any change can be undone. Your workspace is not used to train AI models.
5. How we share information
We don't sell personal information, and we don't share it for cross-context behavioral advertising. We share information only:
- With subprocessors who help us run the Service, under contracts that protect it;
- Within your workspace: on Pro, your partner and their agents see the workspace too, except what one of you has locked. A locked record, and everything linked under it, is hidden from the other person and their agents;
- With the agents you connect, which read and write your workspace on your behalf;
- With a web address an agent registered for wake notices: each notice says what happened (for example a new item or an updated record) and is signed with HMAC-SHA256 so the receiver can check it came from us;
- When you choose to share, for example through a deal room link;
- If required by law, or to protect the rights, safety and security of our users or the public;
- As part of a merger, acquisition or sale of assets, with notice to you.
6. Retention
We keep customer content for as long as your account is active. Moving to a smaller plan never deletes it. After an account is closed, we delete or anonymize customer content, except where we must keep it longer by law. How long that takes, and how long backup copies last, will be stated here before general availability. You can export your data at any time.
7. International transfers
We store data in the United States: the database and uploaded files are in Neon (Postgres and object storage), and the app runs on Vercel. Where we transfer personal information from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete and correct information, and not to be discriminated against for using these rights. To make a request, email support@milyoo.ai. We'll verify your request and respond within the time the law requires. You may also complain to your local data protection authority.
9. Security
We use administrative, technical and physical safeguards described on our Security page. No system is perfectly secure, but we work hard to protect your information and will notify you of a breach as the law requires.
10. Children
The Service isn't directed to children under 16, and we don't knowingly collect their personal information.
11. Changes
We'll post any changes here and update the date above. If changes are significant, we'll notify you by email or in the Service.
12. Contact
Milyoo, Inc. · support@milyoo.ai