Privacy policy

Draft version for legal review. Last updated: date to add

1. Who we are

Milo is provided by Avijol Technologies Ltd, registered in England and Wales under company number to add, registered office registered office address. This policy explains how we handle personal data when you visit this website, use Milo, or contact us. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our contact for privacy questions is hello@milo.datavalley.ai.

2. Our two roles

• Controller. For account details, billing, website visits, support requests and product communications, we decide how and why personal data is used. This policy covers that use.
• Processor. For personal data inside a workspace (work items, documents, messages, form responses, Desk tickets and the like), the organisation that owns the workspace is the controller and we process the data on its instructions. If you submitted information through a form or Desk widget run by one of our customers, please contact that organisation first.

3. What we collect

4. How we use it, and our lawful bases

• To provide Milo: create and run accounts and workspaces, sign you in, and deliver the features you use. Lawful basis: contract.
• To bill you: take payment, keep accounts and meet tax rules. Lawful bases: contract and legal obligation.
• To keep Milo secure: detect abuse, prevent fraud, enforce spend caps and investigate incidents. Lawful basis: legitimate interests.
• To improve Milo: understand which features are used and fix problems, using aggregated or de-identified data where possible. Lawful basis: legitimate interests.
• To reply to you: answer contact form messages and support requests. Lawful basis: legitimate interests, or steps before entering a contract.
• To send product news: only if you opted in, and you can opt out at any time. Lawful basis: consent.

We do not sell personal data.

5. AI features

When you use AI features, including story fill, Ask Milo, Milo AI chats and agents, the relevant Customer Content is sent to the AI model provider that performs the request, and the result is returned to your workspace. Workspace pages may be converted into embeddings so search and AI answers can find them.

Confirm: we do not use Customer Content to train AI models, and our model providers are contractually barred from using it for training.

Milo shows tokens, runs and cost for agent work so that workspaces can see and control AI spending. This information is visible to members of the workspace according to their permissions.

6. Who we share it with

We use carefully chosen service providers ("sub-processors") to run Milo, under contracts that require them to protect the data and use it only on our instructions. They fall into these groups:

• hosting, database and file storage providers;
• AI model and embedding providers;
• email delivery providers;
• payment processing;
• error monitoring and support tools.

Publish the current sub-processor list with names and locations. We may also share personal data with professional advisers, with a buyer if our business is sold (under the same protections), or where the law requires it.

7. International transfers

Some providers process data outside the United Kingdom. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Enterprise customers can choose where their data is stored.

8. How long we keep it

• Account data: for as long as your account is active, and for up to 12 months afterwards to deal with questions and disputes.
• Billing records: six years after the end of the financial year they relate to, as UK tax law requires.
• Customer Content: for as long as the workspace keeps it, subject to the workspace's own retention settings, and deleted after the workspace is closed as set out in our terms.
• Logs and security events: period to confirm.
• Contact form messages: up to two years after our last reply.

9. Security

We protect personal data with encryption in transit, access controls, strict separation between workspaces, hashed credentials and access keys, short-lived links for file downloads, and an audit trail of actions by people and agents. No system is perfectly secure; if a breach affects your personal data we will tell you and the regulator where the law requires.

10. Cookies

Milo uses a strictly necessary cookie to keep you signed in. This website stores your theme choice and billing toggle in your browser's local storage; it does not use advertising or tracking cookies. Update this section if analytics are added.

11. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted in some circumstances;
• restrict or object to some processing, including direct marketing;
• receive data you gave us in a portable format;
• withdraw consent at any time, where we rely on consent.

To use these rights, email hello@milo.datavalley.ai. We will reply within one month. For data inside a workspace, we will pass your request to the organisation that controls it and help it respond.

12. Children

Milo is not intended for children under 16 and we do not knowingly collect their personal data.

13. Changes to this policy

We will update this policy when our practices change and show the date at the top. If a change materially affects how we use your personal data, we will tell you by email or in Milo before it takes effect.

14. Contact and complaints

Email hello@milo.datavalley.ai or use our contact form. If you are unhappy with our answer, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.