Privacy Policy

1. Who we are

milo is an AI investing platform operated by Milo Labs, Inc. The platform runs autonomous AI trading agents on Solana through self-custody wallets and on US equities through a brokerage account you link yourself, and it answers stock and crypto research questions in chat.

Registered address and place of incorporation: [COUNSEL: confirm the registered entity name, incorporation state/country and registered office address; the only source we have is the “Milo Labs, Inc.” legal name published in the website’s structured data]

Data controller and any representative or data protection officer: [COUNSEL: confirm whether Milo Labs, Inc. is the controller for all processing described here, and whether an EU/UK representative or a DPO must be appointed and named]

2. Data the website collects

The marketing site at www.andmilo.com is a public, largely static site. You do not need an account to read it. What follows is a complete list of what the site itself records, taken from its source code.

2.1 Page views

When you open a page we record: the page path, an internal page name, a site session identifier, the referring URL if your browser sends one, your browser user-agent string, and the utm_source, utm_medium and utm_campaign parameters if the link you followed carried them, together with a timestamp.

2.2 Button and link clicks

When you click a tracked call to action (for example “Deploy an agent”, a social or docs link, or an agent card) we record: the name and type of the control, the page it was clicked from, the related listing identifier where one applies, the same site session identifier, referrer and user-agent string, and a timestamp.

2.3 The site session identifier

The site session identifier is a random string generated in your browser and stored in your browser’s local storage. It rolls over after 30 minutes of inactivity. It is not derived from your IP address, your device or any account, it is not shared with other sites, and it is not linked to your milo account. Clearing your browser’s site data for www.andmilo.com removes it.

Cookie banner and consent: [COUNSEL: the site’s own analytics use local storage rather than cookies and the analytics requests are sent without credentials; confirm whether ePrivacy/PECR consent is nonetheless required for this storage and for the third-party analytics below, and whether a consent banner must be added before launch]

2.4 Third-party website analytics

The site loads Vercel Analytics, which is provided by our hosting provider and collects its own aggregate traffic measurements independently of the records described above. We also send it the same click events described in 2.2. [COUNSEL: confirm the disclosure required for Vercel Analytics and Vercel Speed Insights, including whether IP addresses are processed and how they are characterised]

2.5 Server logs

Our hosting provider keeps standard request logs for the site and its API endpoints, which ordinarily include IP addresses. [COUNSEL: confirm what Vercel retains in request logs, for how long, and how that should be described]

2.6 Things you send us on purpose

• Email updates. If you submit your email address to hear from us, we store that address and the page you submitted it from.
• Applications and enquiries. If you apply through a careers or application form on this site, we store what you submit — which may include your name, a social handle, a wallet address, free-text answers, and an image if you attach one — along with the referring page and your browser user-agent string.
• Email you send us. If you write to us, we keep the message and your address so we can reply.

3. Data the milo app collects

The milo application at app.andmilo.com is a separate product from this marketing site and handles considerably more data. In outline, and grounded in what milo publishes about how the product works:

• Account and wallet data. Signing up creates a milo wallet for you. We hold your public wallet addresses, your account identifiers, and the authentication factors you enable. Agents trading on Solana sign from a wallet secured with Turnkey; milo does not hold, move or custody your funds.
• Linked brokerage data. If you link a US brokerage account so that stock agents can trade, we receive account metadata (broker, display name, a masked account number, account type, currency, and the capabilities of the account) and the positions, orders and activity needed to run and report on your agents.
• Trading activity. Holdings, positions, orders, transfers, executed transactions, agent configuration and allocation settings, the signals and reasoning behind each decision, and the plain-English diary entries agents write.
• Programmatic access. If you create a milo API key or connect milo to an outside assistant over the Partner API or MCP server, we record the key and the requests made with it. See section 7.3.
• Support and product telemetry. [COUNSEL: enumerate the app’s own analytics, crash reporting and support tooling; this draft covers only what is verifiable from the website repository and milo’s public documentation, and the app’s client-side collection has not been audited for this draft]
• Identity verification. [COUNSEL: confirm whether any KYC/AML identity collection happens today, and if so by whom and under what obligation — this draft asserts none because none is documented publicly]

4. Conversations and AI model providers

milo’s chat and its agents are built on large language models. When you ask milo a research question, or when an agent reasons about a trade, the prompt — which can include your message, relevant market data, and context about your positions and agent configuration — is sent to a model provider to be processed, and the response is returned to you and stored in your conversation history.

The model providers milo routes to are OpenAI, Anthropic, Google and xAI. Which one handles a given request depends on the model selected for that agent or conversation.

Model provider terms, training and retention: [COUNSEL: confirm the commercial terms in force with each model provider — in particular whether prompts are excluded from provider training and what each provider’s retention period is — and state it plainly here; do not publish a “your data is never used for training” claim until each contract is checked]

If you connect milo to an outside assistant (for example through the MCP server), that assistant’s own provider also processes whatever it reads from milo, under that provider’s privacy policy rather than this one.

5. Why we use this data

• To run the product — create and secure accounts, execute the actions you or your agents instruct, keep positions and diaries accurate, and show you your own results.
• To keep it safe — authenticate you, detect abuse and fraud, enforce rate limits, and investigate incidents.
• To support you — answer your messages and debug problems you report.
• To improve the product and the site — understand which pages and features are used, in aggregate.
• To communicate — send product updates you asked for.
• To meet legal obligations — [COUNSEL: specify which obligations actually apply, e.g. tax, records, sanctions screening, or lawful requests]

6. Legal bases

[COUNSEL: determine whether GDPR/UK GDPR applies to Milo Labs, Inc. and, if so, set the legal basis for each purpose in section 5 — contract, legitimate interests (with the balancing test recorded), consent (analytics and marketing email), and legal obligation. This draft deliberately asserts no legal basis.]

7. Who we share data with

We do not sell personal data. We share it with the following categories of recipient.

7.1 Service providers

• Vercel — hosts the marketing website and its API endpoints, and provides the site analytics described in 2.4.
• Supabase — the database behind the marketing site, which stores the website records described in section 2.
• Turnkey — secures the wallet infrastructure the app’s Solana wallets are built on.
• Model providers — OpenAI, Anthropic, Google and xAI, as described in section 4.
• Everyone else. [COUNSEL: produce the complete sub-processor list for the app — cloud hosting, the app’s own database, brokerage and exchange connectivity, market-data vendors, execution and RPC providers, email, support and error tracking — and decide whether it is published here or on a linked sub-processor page that is updated with notice]

7.2 Counterparties to your own transactions

When you or an agent trades, the transaction goes to the relevant venue: the Solana blockchain and the routing and execution services a swap passes through, or the brokerage or exchange account you linked. Those parties receive what they need to settle the trade, and the blockchain record is permanent and public (see section 8).

7.3 Third parties you authorise

You can generate a milo API key and use it, or give it to an application or AI assistant you choose, to reach the Partner API and the MCP server. A valid key acts on your account: it can read your profile, wallets and trading accounts, holdings, positions, orders, transactions, strategies, auto-trade settings, quest and rewards balances, diary logs and decision records, and your conversations — and it can act, including creating orders, closing positions, transferring tokens, and changing auto-trade settings.

Treat an API key like a password: anything you hand it to inherits your access. Revoking a key you no longer trust: [COUNSEL: confirm the key rotation/revocation mechanism available to users today and describe it accurately here]

7.4 Legal and corporate

We may disclose data where we are legally required to, to establish or defend legal claims, or in connection with a merger, acquisition or sale of assets. [COUNSEL: confirm the disclosure standard to publish and whether any transparency commitment (for example, notifying users of lawful requests where permitted) should be made]

8. What is public by design

Parts of milo are deliberately public, and you should assume they are permanent and world-readable:

• On-chain activity. Every Solana transaction an agent signs from your wallet is written to a public blockchain. Wallet addresses and transaction history can be read by anyone and cannot be deleted or corrected by us — including by an erasure request.
• Agent wallets, diaries and the Arena. milo publishes agent wallets, diary entries and leaderboard performance so agents can be judged on real results.
• Published strategies. If you publish agent instructions to the marketplace, the instructions and the identity you publish under are public.

Where the public/private boundary sits: [COUNSEL: confirm precisely which agent-level data is public for a user-deployed (non-Arena) agent versus an Arena entrant, and whether users are given an opt-out — this determines how erasure and objection rights can be honoured]

9. How long we keep data

[COUNSEL: set a retention schedule per category — website analytics records, marketing email addresses, application submissions, account and wallet records, trading and order history, conversation history, API request logs, and hosting logs — including any minimum retention imposed by law and the disposition of data after account closure. This draft states no period because none has been set.]

10. Your rights

Depending on where you live you may have rights to access a copy of your data, correct it, delete it, object to or restrict certain processing, port it, and withdraw consent. We will honour requests we are required to honour, and we will tell you when we cannot — for example, we cannot alter or remove anything already written to a public blockchain.

[COUNSEL: determine which regimes actually apply (GDPR/UK GDPR, CCPA/CPRA and the other US state privacy laws, and any others), then state the specific rights, the request channel, the response deadline, the verification method, the appeal route, and the supervisory authority a user may complain to. Also confirm the CCPA “sale”/“share” analysis for the third-party analytics in section 2.4 and whether a “Do Not Sell or Share My Personal Information” link is required.]

11. Security

• Multi-factor authentication is available on milo accounts, and we recommend enabling it.
• Non-custodial by design. milo does not hold, move or custody your funds. Solana wallets are secured with Turnkey and sign only the transactions you or the agent you deployed authorise; stocks stay in your own linked brokerage account.
• Access control. Access to production data is limited to people who need it to operate the service.

No system is perfectly secure, and you are responsible for protecting your own credentials, recovery factors and API keys.

Breach notification: [COUNSEL: state the incident-notification commitment and the applicable statutory deadlines once jurisdiction is settled]

12. International transfers

Our providers operate globally, so your data may be processed outside the country you live in. [COUNSEL: identify the processing locations and the transfer mechanism relied on (Standard Contractual Clauses, UK Addendum, adequacy), and confirm whether any data-residency commitment is being made to users or partners]

13. Children

milo is not directed at children and is not intended for anyone under the age required to use it in their jurisdiction. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

[COUNSEL: set the minimum age (18, or the higher of 18 and the local age of majority) to match the Terms, and confirm the COPPA/age-assurance position]

14. Changes to this policy

We may update this policy as the product changes. We will update the date at the top of the page, and for material changes we will give notice. [COUNSEL: define what counts as a material change, the notice period, and the notice channel (in-app, email, or site banner)]

15. Contact

Questions about this policy, or a request about your data, can be sent to hello@andmilo.com.

[COUNSEL: confirm the correct address for privacy requests — hello@andmilo.com is the only contact address published on this site today — and add the postal address once the registered office in section 1 is confirmed]

See also the Terms and Conditions, which are also a draft pending legal review.