Your records are yours

Millo, the program

Millo runs on a computer you own and keeps its records in a folder on that computer. Its backups go to a folder you choose. It doesn't send your jobs, hours, invoices, clients or employees to us or to anyone else, and it has no account with us, no licence server and no analytics.

Millo checks millo.ca for new versions; that check carries nothing about you or your company. Your order is sent only when you download an update, and your email and order number (the number is on the invoice attached to the receipt Paddle emailed you) only when you type them into Millo to find that order, which it does once and never keeps the email.

Otherwise, Millo connects to the internet only when you ask it to:

• When you download an assistant model, the model comes from Ollama's library.
• When you choose a cloud AI provider and enter your own API key, the notes and job details the assistant works on are sent to that provider and handled under your agreement with them.
• When you turn on Millo Hub, crew phones reach Millo through your own Cloudflare account, under your agreement with Cloudflare. That traffic doesn't come to us.
• When you choose to open a draft in a web email service, your browser opens that service.
• When someone on your crew turns on phone alerts, the words of each alert go through ntfy, a push-notification service, to their phone, under ntfy's terms. Nothing else about your company goes with them.

Millo never sends invoices, statements, change orders or updates to your clients. You send them yourself.

This website

This site sets no cookies, loads no outside fonts, and runs no advertising or behavioural-analytics scripts. To tell whether important parts of the site work, Millo counts a short list of actions—such as starting the demo, opening checkout or sending a Field Partner application—by day and page. These aggregate counters contain no internet address, cookie, visitor identifier, email address or user agent and expire within 180 days. Cloudflare, the company that hosts the site, also keeps ordinary server logs, such as the internet addresses that requested each page.

The demo runs in your browser. What you click and type in it stays in your browser and isn't sent to us.

When you click a Buy button, your browser loads Paddle's checkout from Paddle. What you type into the checkout goes to Paddle and is handled under Paddle's privacy notice.

Field Partner applications

When you apply to the Field Partner Program, we collect the name, work email, company, general location, country, office operating system, active-work readiness and the repeated workflow problem you put into the form. A company website or public social page and marketing consent are optional. Don't put client names, job addresses, worker records, banking information or other sensitive details in an application.

Cloudflare processes the form and keeps the application for us. The application itself does not keep your internet address. A one-way digest made from it counts submissions from one connection to slow down spam, and expires within two hours. An unselected application expires from the application store within 90 days. If a company joins the program, we keep the acceptance, participation and support records for as long as they are needed to run the program, support the licence and meet legal obligations.

Resend sends the application receipt to you and a review copy to our Millo address. We use the application to assess product fit and pilot capacity, contact you about the application and, if selected, administer the program. The optional marketing checkbox is separate and unchecked; applying does not add you to a marketing list.

When you buy Millo

Paddle is our reseller and handles the payment. We never see your card details. Paddle shares with us what we need to deliver and support your purchase: your name, email address and country, what you bought and when, your order and invoice numbers, and, if you give them at checkout, your business name and tax number.

Your download page keeps your order number, email address, what the order came to and whether it is paid or refunded, so you can get Millo and its updates. To stop order numbers being guessed, the "find your download" form counts tries from each internet address and forgets the count within two hours.

When your order completes, Paddle emails your receipt and your browser opens your Millo download page. We also send you one email with the link to that page and your order number, so you can find it again. We don't add you to a mailing list or send marketing email.

When you email us

We keep the messages you send us so we can help you and follow up on what you asked.

Trial copies we host

Sometimes we host a copy of Millo for someone to try before they buy. That copy keeps what they enter, like any Millo, in a folder on our computer. To learn where Millo is hard to use, it also keeps which screens are opened and how long each stays open, which buttons are pressed and where on the screen, with any numbers in a button's words blanked out, and the reports sent with its Report a bug button. It never records what anyone types into a field. The copy says so the first time each person signs in. Only we can see it, and we delete a trial copy's records within 90 days after the trial ends, or sooner if asked.

How we use it

• To deliver Millo and its updates to you.
• To answer your questions and fix problems.
• To assess Field Partner applications and run the feedback program.
• To keep the sales records the law requires.
• To make Millo easier to use, from what trial copies keep.

We don't sell your information, and we don't send you marketing email unless you ask for it.

Who handles it for us, and where

Paddle handles payments and receipts, as a separate company responsible for what it collects at checkout. Cloudflare hosts this website, the download pages and Field Partner applications. Resend sends the purchase email and Field Partner application messages. An email provider handles our mail. These companies store and process information in several countries, so it may be kept outside Canada, where courts, police and security agencies of those countries may be able to get it under their laws.

How long we keep it

We keep purchase records for as long as your licence lasts and as long as tax law requires us to keep sales records, which is six years after the end of the tax year they belong to. Website action counters expire within 180 days. An unselected Field Partner application expires from the application store within 90 days. We keep selected-participant and support records for as long as they're useful to run the program, support the licence and meet legal obligations. When we no longer need information, we delete it.

Keeping it safe

Only the people who deliver and support Millo can see purchase and support records. If a breach of our safeguards creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada as soon as we can.

Your choices

You can ask what personal information we hold about you, ask us to correct it, or ask us to delete what we don't need to keep by law. We answer within 30 days. If you think we've mishandled your information, tell us first. You can also complain to the Office of the Privacy Commissioner of Canada.

Millo Link

Millo Link isn't available yet. When it is, this page will explain what it handles and what it keeps.

Who's responsible

Ethan Bender is responsible for the personal information described here. The person in charge of privacy is Ethan Bender. Reach them at support@millo.ca. Mail: 261248 Conc 18, Hanover, Ontario N4N 3B8, Canada.

Last updated October 12, 2026