Privacy Policy

1. Who is responsible

The operator and data controller for this Milo prototype is ZACHARIAS KOKKINAKIS, Greece. For privacy questions or requests, contact hkokk1234@gmail.com.

No public hosting provider has been selected as of this policy's update date. Hosting provider, processing location, backup retention and any applicable international-transfer details must be added to this policy before public deployment collects account information.

2. Information Milo processes

• Account information: your name, email address, personal or organisation account type, optional organisation name, creation/update dates and onboarding status.
• Authentication records: password hashes, hashed session identifiers, CSRF verification values, expiry/activity timestamps and hashed password-reset tokens. Plaintext passwords are not stored.
• Communication preferences: language, tone, role, goals, greeting, closing, signature, priorities, contacts/domains you enter, formatting preferences, safety preferences and profile versions.
• Optional content: writing examples and their categories; memories, notes, relevance tags, source and status; structured communication rules; preview ratings and comments.
• Service feedback: category, optional 1?5 rating, message, submission identifier and timestamp linked to your account. These private submissions are available to the operator for support and product improvement, are not published, and are deleted when the account is deleted. You can view your latest 20 submissions in the application and request removal by contacting us.
• Preview metadata: identifiers, synthetic scenario, profile version, timestamps and feedback links. The preview history table does not store complete generated replies or incoming email bodies.
• Technical connection information: the server necessarily receives network details such as your IP address. The app uses IP-based request limits; a future hosting provider may keep separate operational logs.
• Support messages: information you send voluntarily to the contact email. Please do not send passwords, verification codes or unnecessary sensitive information.

Only name, email and password are needed for a personal account; organisation accounts also need an organisation name. Additional setup fields are needed to create the communication profile. Writing examples, memories, rules and feedback are optional. Avoid entering special-category, confidential or third-party information that is unnecessary or that you are not entitled to share.

3. Purposes and legal bases

We process account and preference information to provide the features you request, including login, saved setup, profile editing, memory/rule management and personalized template previews. The legal basis for these service operations is performance of the service agreement or steps taken at your request to enter it.

Authentication, fraud/abuse prevention and essential operational security rely on our legitimate interest in protecting the service and its users, balanced against your rights. Support requests are handled to respond to you and administer the requested service. Where we rely on consent for a specific optional use, that consent must be requested separately and can be withdrawn without affecting earlier lawful processing.

Optional content is used for the feature you choose, not to retrain an AI model or market unrelated products. There is no targeted advertising, sale of personal information, or automated decision-making with legal or similarly significant effects in this prototype.

4. Cookies and local storage

Milo uses an essential session cookie to keep you signed in and protect requests. Sessions expire after 30 minutes of inactivity or seven days at most. Cookies are HttpOnly and SameSite Strict; production HTTPS configuration adds Secure protection. They do not contain your password.

The current application does not set advertising or analytics cookies, and does not store your private profile or authentication tokens in browser localStorage. Blocking the session cookie prevents account functions from working. Public pages can be viewed without an account.

5. Recipients and external services

Application information is stored in the server's database and is accessible to the operator for running and supporting the service. A hosting provider, when selected, will process data required to host it; its identity and location will be disclosed before public use.

Password-reset email is unavailable unless an email-delivery provider is configured. When enabled, that provider receives your recipient address and reset link for delivery. The contact address uses Gmail: choosing to email us also involves Google's processing of that correspondence. This is separate from connecting a Gmail inbox to Milo.

No external model provider receives examples, memories or preview data in the current version. Future inbox or AI integrations require updated information about providers, permissions, processing and any transfers outside the EEA before they are activated. We may disclose information where required by applicable law or necessary to address a legitimate security incident, subject to applicable safeguards.

6. Retention and deletion

Account, profile, memory, rule and feedback records remain in the prototype database until they are removed. There is currently no automatic inactivity-based account deletion schedule. You can delete your optional memories, rules and writing examples through the application. Archiving a memory keeps it in your account but excludes it from active retrieval.

The latest 100 preview-metadata records per user are retained; older metadata is removed as new previews are generated. Related feedback can remain with its scenario and profile version. Minimal feedback-decision references may remain so a rejected or deleted suggestion is not proposed again.

Reset links are single-use and expire after 30 minutes. Expiry prevents use; expired authentication records are removed through application cleanup operations rather than a guaranteed immediate purge at expiry.

Self-service account closure and export are not yet available. Request access, deletion, export or removal of feedback and its associated decision references by emailing hkokk1234@gmail.com. Such requests require manual handling. Deleting a database record does not guarantee immediate erasure from all backups or storage remnants. Backup retention and support-message retention must be defined for the chosen deployment before public launch; this prototype does not promise an unimplemented automatic purge.

7. Your rights and requests

Where applicable under data-protection law, you may request access, correction, erasure, restriction, portability or object to processing. Where consent is used, you may withdraw it. Contact hkokk1234@gmail.com; reasonable verification may be needed to protect your account. Requests are handled without undue delay and normally within one month, with any legally permitted extension explained to you.

You may raise concerns with the Hellenic Data Protection Authority or another competent supervisory authority. See also the European Commission's information on data-protection rights.

8. Security and changes

Milo implements password hashing, server-side sessions, access controls and request validation. These measures reduce risk but do not guarantee that all vulnerabilities or incidents are impossible. This prototype is not presented as security-certified or production-certified.

We may update this policy as the service changes and will show a new update date. A new processing purpose or provider integration must be explained before it is introduced, with consent requested where required. Contact the operator if you need clarification about the current version.