Privacy Policy

Last updated: 6 October 2026

1. Introduction

Mili Software, Inc. (“Mili,” “we,” “us,” “our”) provides an AI assistant built for wealth advisors and other financial services professionals. This Privacy Policy explains how we handle personal information in connection with our website at getmili.ai, our desktop and mobile applications, and the Mili platform (together, the “Services”).

Mili offers the Services to customers located in the United States. Customer Data is processed and stored in the United States.

Two commitments underpin everything below: we do not sell or share personal information, and we do not use Customer Data to train artificial intelligence models.

Questions about this policy can be directed to our Privacy Officer at privacy@getmili.ai.

2. Our two roles

Mili handles two categories of information, and different rules apply to each.

Account Data

Information about the advisors, firms and website visitors who use Mili — names, business contact details, billing information, and login and usage records. Mili determines how Account Data is used and acts as a controller for it.

Customer Data

Information a customer firm submits to or generates through the Services in the course of serving its own clients — meeting content, notes, summaries, client and prospect records, documents, and data synchronised from connected systems. Mili processes Customer Data only on the customer firm’s instructions, as a service provider to that firm.

The customer firm remains responsible for its relationship with its own clients, including any notice and consent those clients are owed. If you are a client of an advisory firm that uses Mili and you wish to access, correct or delete information about you, please contact that firm. We will assist the firm in responding.

3. Information we collect

Account Data

  • Registration and profile information: name, business email address, telephone number, firm name and role.
  • Billing information. Payments are handled by a third-party payment processor; Mili does not store full payment card numbers.
  • Usage and device information: log records, IP address, browser and device type, and feature usage.
  • Correspondence with our support, sales and security teams.

Customer Data

Depending on the configuration a customer firm chooses, the Services may process:

  • Meeting content from virtual, in-person and telephone meetings, including transcripts, notes and summaries.
  • Meeting audio, where a firm has enabled audio capture. Audio capture is off by default.
  • Client and prospect records, including contact details and financial information provided by the firm or extracted from documents the firm uploads.
  • Data synchronised from systems the firm connects, such as CRM, calendar, email, financial planning and custodial platforms.
  • Consent records captured by the firm through the Services.

4. Meeting capture and consent

Audio and video recording is off by default. A customer firm may configure capture mode for its organisation — including transcript-only and summary-only modes — and may enable audio capture where its own policies require it. Where audio capture is enabled, firms may configure real-time deletion of audio following transcription.

The Services provide audible and on-screen meeting notices and support the capture and tracking of client consent, including contact-level consent history. Firms configure these workflows to match their compliance policies.

Recording and notification laws vary by state, and some states require the consent of every participant. Customer firms are responsible for obtaining any consent required by law and by their own policies before capturing a meeting.

5. How we use information

We use Account Data to provide, maintain and secure the Services; to authenticate users; to process billing; to provide support; to send service notices; to improve reliability and performance; and to comply with legal obligations.

We also use Account Data to send product emails — information about features, releases and updates related to the Services — and to market to our mailing list, including after the original transaction. Every marketing email includes an unsubscribe link, and you can opt out at any time by following it or by writing to privacy@getmili.ai. Opting out does not stop service notices about your account or subscription.

We use Customer Data only to provide the Services to the customer firm and as instructed by that firm, together with what is necessary to investigate security incidents or abuse and to comply with legal obligations.

We may anonymise and aggregate information about how the Services are used, so that it no longer identifies any individual or customer firm, and use the result for statistics and to operate, analyse and improve the Services. Anonymised, aggregated data is never used to train artificial intelligence models, and is never derived from Google user data.

We do not use Customer Data for advertising or marketing. We do not sell or share personal information. We do not use Customer Data to train artificial intelligence models.

6. Artificial intelligence

Training exclusion

Customer Data is not used to train or improve artificial intelligence models, whether ours or those of any third party. Every subprocessor that handles Customer Data is bound by a written agreement prohibiting its use for training or improving artificial intelligence or machine learning models.

Zero data retention

With the model and transcription providers that process Customer Data — OpenAI, Anthropic, Google, AssemblyAI and Deepgram — we operate under zero-data-retention terms. Customer Data sent to these providers is used only to return the requested result and is not retained by them afterwards.

A small number of subprocessors retain content because the service requires it: collaborative note storage, request logging and evaluation tooling. These are listed on our subprocessors page with the reason in each case. Their agreements prohibit training, and we can require deletion of Customer Data held by any subprocessor at any time.

Human review

AI-generated output, including notes, summaries, drafted communications and extracted data, is presented to the user for review. Output is not synchronised to a connected system or sent to any recipient without a user taking that action.

Accuracy

AI-generated output is produced on a best-effort basis. AI systems can produce incomplete or inaccurate results, including content that does not reflect what was said. Advisors are responsible for reviewing output before relying on it, entering it into a client record, or sending it to a client.

Redaction

Firms may configure categories of personal information to be redacted, so that redacted details do not reach summaries, forms or connected systems.

7. Google user data and Limited Use

Where a firm connects Google Workspace, Mili requests only narrow, granular permissions: name and email address to identify the account; read access to Gmail and the ability to create drafts, which an authorised user reviews and sends; access to calendar events; and per-file access to Google Drive. Mili can open only the specific files a user selects through the Google Drive picker, and cannot browse, search or access any other file in that Drive. A firm may disconnect its Google account at any time.

Mili’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is Customer Data under this policy. It is used only to provide the features the firm has enabled. It is never used for advertising, never sold, and never used — whether raw, aggregated, de-identified or otherwise derived — to create, train or improve any generalised or foundational artificial intelligence or machine learning model, by us or by any provider acting on our behalf.

Google user data is transferred only to the subprocessors that provide the features the firm has enabled, including the model providers described in section 6, and only to provide those features. It is never transferred to service providers for analytics, marketing or any other purpose.

Mili personnel do not read Google user data unless the user has given affirmative agreement for us to view specific data, for example in a support request; it is necessary for security purposes, such as investigating abuse; or it is necessary to comply with applicable law.

8. Retention and deletion

Retention is configured by the customer firm, subject to its agreement with us and to its own books-and-records obligations. Firms may configure retention at the object level and may delete meeting content, transcripts and summaries on request.

Where a firm has enabled real-time audio deletion, meeting audio is deleted following transcription.

Mili supports archiving and supervision export, including to Global Relay, so that firms can retain records within their own systems.

On termination, Customer Data is made available for export for 30 days, after which it is deleted in accordance with the customer agreement. Copies held in backups are removed on our standard backup cycle. We retain Account Data for as long as needed for legal, tax and accounting purposes.

9. Disclosure and subprocessors

We disclose personal information only as follows:

  • To subprocessors that help us provide the Services. Our current list is on our subprocessors page.
  • To our affiliates, including MILIAI Technologies in India, whose personnel support and maintain the Services as described in section 11, and in the case of Google user data only as permitted by section 7.
  • To service providers that support our business operations, such as our payment processor and website analytics providers. These receive Account Data only, never Customer Data or Google user data.
  • To professional advisers such as auditors and legal counsel, under confidentiality obligations.
  • In connection with a merger, acquisition or sale of assets, with notice to affected customers.
  • Where required to comply with law, legal process or a governmental request, or to protect the rights, property or safety of Mili, our customers or others.

Every affiliate, service provider and subprocessor is bound by a written agreement requiring it to keep personal information confidential and use it only for the purposes for which we disclose it. Every subprocessor is further bound to use Customer Data only to provide services to us, to maintain appropriate safeguards, and not to use Customer Data to train or improve artificial intelligence or machine learning models. We can require deletion of Customer Data held by a subprocessor at any time.

We will update the subprocessor page before adding a new subprocessor that handles Customer Data.

We do not sell or share personal information, and we do not disclose Customer Data to third parties for their own purposes.

10. Security

Mili maintains a security programme covering technical, administrative and organisational controls. Current measures include:

  • SOC 2 Type 2 examination, with the report available to customers and prospective customers under a non-disclosure agreement.
  • ISO/IEC 27001:2022 certification of our information security management system, covering the Mili platform. The certificate is available on request.
  • AES-256 encryption of data at rest and TLS 1.2 or above for data in transit.
  • Multi-factor authentication, with single sign-on and SAML provisioning available to customer firms.
  • Role-based access on a least-privilege basis, with access reviewed quarterly.
  • Logical isolation of each customer firm’s data.
  • Annual third-party penetration testing covering the application, APIs, cloud environment and external network, alongside ongoing vulnerability management.
  • Audit logging of access, configuration changes, integration activity and consent events.
  • Background checks on personnel and annual security awareness training.

If we become aware of a security breach leading to unauthorised access to personal information, we will notify affected customer firms without undue delay, and in any event within 72 hours of becoming aware of it. Suspected security issues can be reported to privacy@getmili.ai.

11. Where data is processed

Customer Data is processed and stored in the United States on Amazon Web Services infrastructure.

Mili’s engineering and support teams include personnel located in India. A limited number of these personnel may access Customer Data where necessary to provide support, investigate an issue, or maintain the Services. Access is granted on a need basis, restricted by role-based permission, carried out over an encrypted connection, logged, and reviewed. All personnel are bound by confidentiality obligations and receive annual security training. Access to Google user data is further limited as set out in section 7.

12. Your privacy rights

California

Under the California Consumer Privacy Act as amended, California residents may request to know what personal information we hold, to delete it, to correct it, and to receive it in a portable format. California residents also have the right to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information — although Mili does not sell or share personal information, and does not use sensitive personal information for any purpose beyond providing the Services.

We will not discriminate against anyone for exercising these rights. Requests may be submitted to privacy@getmili.ai and may be made by an authorised agent. We will verify identity before responding, and will respond within 45 days, with one extension where permitted.

Other states

Residents of other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability and opt-out. Requests may be submitted to privacy@getmili.ai. If we decline a request, you may appeal by replying to our response; we will inform you of the outcome and of your right to contact your state attorney general.

Requests concerning Customer Data

Where a request concerns information held on behalf of an advisory firm, please direct it to that firm. Mili will support the firm in responding.

13. Cookies

Our marketing website uses cookies that are necessary for the site to function, together with analytics cookies that help us understand how the site is used. You can set your browser to refuse cookies, though parts of the site may not function properly. We honour Global Privacy Control and Do Not Track signals.

The Mili platform itself uses cookies only for authentication and session management. We do not use advertising or behavioural tracking cookies within the platform, and Customer Data is never used for advertising.

14. Age

The Services are intended for business use by individuals aged 18 or over. They are not directed to children, and we do not knowingly collect personal information from anyone under 18.

15. Changes to this policy

We will post any changes here and update the date at the top. If a change is material, we will notify customers by email or through the Services before it takes effect.

16. Contact

Privacy Officer — privacy@getmili.ai. Support — support@getmili.ai. Mili Software, Inc., 108 W. 13th Street, Suite 100, Wilmington, DE 19801.