Privacy Policy

1. Who we are and what this policy covers

MillOS is a workspace for architectural estimating, for commercial shops in the United States. It is operated by MillOS, Inc., a Delaware corporation, 4310 Directors Row, Houston, Texas 77092 (“MillOS”, “we”, “us”).

This policy covers:

• our website at millos.ai and our help site at docs.millos.ai,
• the early-access request form,
• the MillOS application that shops use in their Workspace, and
• emails and other messages between you and us.

It does not cover what your shop does with information outside MillOS. That includes a proposal your team downloads and sends to a general contractor.

Our two roles

• For your shop's content (section 3.3), we act on your shop's behalf and follow its instructions. Privacy laws call this a “processor” or “service provider”. Your shop decides what goes into MillOS and who can see it. If you are a person whose details appear in a shop's documents and you want them changed or removed, please contact that shop first. We will help the shop answer you.
• For account, website, early-access and billing information, we decide how the information is used. Privacy laws call this a “controller”.

A shop that wants these processor terms in writing can ask us for our Data Processing Addendum (DPA) at legal@millos.ai.

2. Information at a glance

• Early-access request: name, work email, company, bids per month, what your shop bids and whether you want updates. It comes from you, through the form. We use it to answer your request and set up your Workspace.
• Account: name, email, profile picture, Workspace name and logo, role and invitations. It comes from you and your teammates. We use it to run your account and Workspace.
• Shop content: bid packages, drawings, specs, addenda, rates, Product Library, rules, Workspace Memory, Chats, answers, RFIs, comments, Reports, workbooks and proposals. It comes from your team, and from MillOS working for your team. We use it to provide MillOS.
• Usage and technical: product events, error reports, request logs, IP address and browser type. It comes from your device and our providers. We use it to keep MillOS working, secure and improving.
• Messages: emails to hello@, support@, legal@ and security@, and our replies. They come from you. We use them to answer you.
• Billing: billing contact, invoices, what was bought and payment status. It comes from you and Stripe. We use it to bill and keep tax records.

3. What we collect

3.1 When you ask for early access

The form asks for your name, work email, company, mobile number and how many bids you price each month. You can also tick what your shop bids (casework, countertops, wall panels and paneling, reception and specialty, trim) and tick that you would like occasional MillOS updates. We reply to your request whether or not you tick that box. You can also tick that we may text you about your request. Texting is optional: we never call or text you unless you ask.

To stop abuse of the form, our rate-limit table keeps a keyed (hashed) version of your IP address, not the address itself. (Our hosting providers' ordinary request logs still record IP addresses; see section 3.4.) It counts requests for a one-hour window and is deleted about a day after that window ends.

The form's answers go to Z360, the system we use to manage early-access requests and our replies (section 6).

3.2 When your shop uses MillOS

• Account details: your email address, your name, and a profile picture if you add one. We also keep your role in each Workspace (owner, admin, estimator or viewer).
• Workspace details: the Workspace's name and logo, its members, and invitations. When someone invites you, we receive your email address from them.
• Sign-in: you sign in with a one-time link or code sent to your email. MillOS does not use passwords. This means anyone who controls your email inbox can sign in as you, so keep your email account secure.
• Agreement records: when you agree to our Terms and this policy, we record who agreed, when, and which version.
• Activity records: MillOS records who did what in a Workspace, for example who deleted a file, published a link or changed a setting. Your team sees some of these as a file's Activity. These records are kept while the Workspace exists. If a member deletes their account, the records of what they did stay with the Workspace, linked to their user ID. Records about a Project are deleted when that Project is deleted for good, and all of them are deleted with the Workspace.

3.3 Your shop's content

“Shop content” means everything your team puts into MillOS and everything MillOS writes for your team. It includes:

• bid packages: architectural and interior drawings, specifications, addenda, schedules and other bid documents, including every earlier version of a file your team replaces,
• your shop's commercial information: labor and material rates, markups, the Product Library, shop rules and standards, and Workspace Memory,
• work in a Project: Chats with MillOS, your team's answers to its questions, RFIs, comments, review notes, approvals and feedback on estimate lines,
• what MillOS produces: takeoffs and measurements, the Report, estimate workbooks and proposals.

Bid documents often contain other people's details, such as the names and contact details of architects, engineers, owners, general contractors and their staff. They can also contain confidential project information. Upload only what your shop has the right to use with MillOS. See section 5 of our Terms.

3.4 Usage and technical information

• Product events: we use PostHog to count four product actions: creating a Project, starting a Chat, starting an estimate and an estimate finishing. Each count is tied to your user ID and your Workspace ID. It does not include your name, your email or any shop content. Automatic click tracking, page-view tracking and session recording are switched off. PostHog also starts on our public website pages and gives each browser an anonymous ID there, although it sends none of the four counts from those pages.
• Error reports: when something breaks, our error tracker (Sentry) receives the error type, where in the code it happened, the error message, your user ID and your Workspace ID. Before anything is sent, the app strips request bodies, query strings, cookies, headers, breadcrumbs and inline files. It also collects timing data for about 1 in 10 requests to measure speed.
• Bug reports: if you use “Report a bug”, what you write, the page you were on and your email address go to our private issue tracker on GitHub.
• Logs: our hosting and infrastructure providers keep request logs, which include IP addresses, browser type, the page or API address requested and the time.
• Run records: for each estimating run, MillOS keeps records of what the AI did. These include the steps it took, the tools it used, how long it ran, token counts and cost. See section 5.4 for what these records can contain.

3.5 When you write to us

We keep the emails you send to hello@, support@, legal@ and security@millos.ai (security questionnaires and vulnerability reports) and our replies. They are handled in Google Workspace, and some customer replies in Z360.

3.6 Billing

We keep your billing contact, the Projects you buy, invoices, amounts, tax and payment status. Payments go through Stripe's hosted checkout, so card details go straight to Stripe and never touch our servers. We do not receive or store your full card number.

3.7 What we do not collect

We do not ask for Social Security numbers, government ID numbers, health information or precise location. We do not collect biometric identifiers, such as face geometry, fingerprints or voiceprints. MillOS is not built to hold that kind of information. Please do not upload it. If a bid document happens to contain it, it is still treated as shop content.

4. How we use information

We use information to:

• Provide MillOS. This covers reading your bid package, measuring, pricing with your rates and rules, and writing Reports, workbooks and proposals for your team to review and approve.
• Run accounts and Workspaces. This covers sign-in, invitations, roles and shared links.
• Support you. This covers answering questions and fixing problems you report.
• Keep MillOS secure and working. This covers preventing abuse, finding and fixing errors, and measuring speed and reliability.
• Improve MillOS. We look at usage counts, error reports, run timings and costs, and where runs fail. MillOS staff do not read shop content or the text in run records to improve MillOS. The only exception is a shop that has joined our design-partner program and agreed in writing (section 5.5).
• Send account emails. These are sign-in links, confirmations, invitations and important notices about your account or these policies. You cannot opt out of these while you have an account.
• Send updates. We send these if you ticked the box on the early-access form, or if you are a customer and the email is about MillOS. Every update email has a one-click way to stop them.
• Send text messages. We text you only if you gave a mobile number and ticked a text box on the early-access form. Texts about your request cover your request, getting started and your account. If you also ticked the box for updates and offers, we send occasional marketing texts about MillOS. Message frequency varies, and message and data rates may apply. Reply STOP to stop them or HELP for help.
• Bill and keep records, including sales tax records.
• Meet legal duties. This covers answering lawful requests, enforcing our Terms and protecting our rights and the safety of others.

We do not use your information to make decisions about you that have legal or similarly significant effects, such as hiring, credit or housing decisions.

5. AI and your data

5.1 What the AI does

MillOS uses large language models to read drawings and specifications, measure, find items, price them with your shop's rates and write the Report, workbook and proposal. It is built to show the sheet and mark each number came from, and to raise a question or RFI when it finds documents that disagree. It will not catch every conflict.

A person approves every estimate. MillOS recommends lines; it does not approve them. A person at your shop reviews and approves the estimate and decides what to send. MillOS's AI has no tool that approves a line.

5.2 Which models, and where they run

• The models are made by Anthropic. We use them through Amazon Bedrock, from AWS's US East (N. Virginia) Region, with AWS's global cross-region inference. This means AWS may process a request in any AWS commercial Region, including Regions outside the United States. The request travels on AWS's own network, encrypted. AWS says Bedrock does not store the prompts and outputs of the models we use.
• If Bedrock has a temporary fault and a request keeps failing, MillOS sends the same request to the same model through Anthropic's own API. Anthropic stores API data in the United States. It may process a request outside the United States, because we use its default global processing. Anthropic deletes these requests within 30 days, unless they are flagged under its usage policy. It handles them under its Commercial Terms, which do not allow training on our data.
• If we add or change an AI model provider, we update the provider list and tell Workspace owners at least 15 days before the change.

5.3 No training on your content

• We do not use your shop content to train or fine-tune AI models.
• Our AI providers do not use it to train their models.
• Anthropic's Commercial Terms say Anthropic may not train models on customer content. The same terms apply when we use Anthropic's models through Bedrock.
• AWS says Amazon Bedrock does not use prompts or outputs to train any model and does not share them with model providers.
• This promise covers every provider that receives shop content, including any backup or future model provider. LangChain, Daytona and Supabase say in their terms that they do not train on customer data.
• If we ever want to use shop content to train or improve models, we will ask first and use it only with your shop's clear permission. We will not change this policy quietly to allow it.

5.4 Run records and traces

To run and fix the estimating work, the platform that hosts it (LangSmith, run by LangChain) keeps the saved state of each Chat and technical traces of each run.

Before traces are uploaded, images, PDFs and other embedded files are replaced with a placeholder. Our traces do not keep message inputs and outputs. They keep the steps, tools used, timings, token counts and costs. Traces are kept for 14 days, or up to 180 days if one is kept longer for review.

The saved Chat state is separate from traces and always holds the conversation, because that is how a Chat reopens.

5.5 Who at MillOS can see shop content

MillOS staff open a shop's content only:

• when your shop asks for help,
• to investigate and fix a problem with MillOS that affects your shop, or
• when the law requires it.

We do not read shops' content or run records to improve estimating in general. The exception is shops that join our design-partner program and agree in writing. For those shops, named members of our team may review Projects, run records and estimator feedback to improve MillOS, as the written agreement describes. A shop can end that agreement at any time. Applying for early access is not that agreement.

This is a rule our team follows. It is not something the software enforces on its own. It binds everyone who works on MillOS, including people provided by our development contractor, under their written agreements with us. Access to our production database and to LangSmith is limited to named members of our engineering team.

5.6 Web research

When MillOS needs a technical fact or a published price, it may search the web through Tavily and read web pages. Tavily receives the search words and the addresses of the pages MillOS reads. The search tool refuses any query that contains the name of your Project, its general contractor or your Workspace. MillOS is also instructed to keep addresses, room numbers, sheet numbers and document text out of searches. That second part is an instruction to the AI, not a hard block. Your team can ask MillOS not to use web research for a Project.

5.7 The computers that work on your files

MillOS opens and measures your files in isolated cloud computers run by Daytona. Each Chat gets its own machine, with no internet access and no credentials. It stops after 15 minutes idle and is deleted 120 minutes after it stops. Daytona keeps no copy of your files after the machine is deleted.

5.8 Accuracy

AI output can be wrong. It can miss scope, misread a sheet or measure incorrectly. That is why a person at your shop reviews and approves every estimate, and why our Terms make your shop responsible for the bids it sends.

6. Who we share information with

6.1 Service providers

These companies process information for us to run MillOS. Under their terms with us, they act on our instructions to provide their service. Those terms allow some limited uses of their own, such as security, abuse prevention and legal compliance. The full current list, with what each one receives and where, is below. We tell Workspace owners at least 15 days before we add a provider that receives shop content.

• Supabase (Supabase Pte. Ltd.): sign-in, database and file storage. It receives account data and shop content. Where: United States (AWS us-east-2, Ohio).
• Vercel (Vercel Inc.): hosts the website and web app. It receives requests, logs and data passing through the app. Where: United States (app functions run in Washington, D.C.); content is delivered from a global edge network.
• LangChain (LangSmith): runs the part of MillOS that does the estimating work, and stores Chat state and traces. It receives shop content and run records. Where: United States (Google Cloud US).
• Amazon Web Services (Amazon Bedrock): AI models. It receives the parts of shop content sent to the model. Where: sent from US East (N. Virginia); processed in any AWS commercial Region (global cross-region inference).
• Anthropic: AI models, as a backup route when Bedrock has a temporary fault. It receives the same, when used. Where: stored in the United States; may be processed in other countries (section 5.2).
• Daytona (Daytona Platforms Inc.): isolated computers that open and measure files. It receives Project files, during a run (no copy is kept afterward).
• Tavily (AlphaAI Technologies Inc.): web search and page reading. It receives generic search words and page addresses. Where: a United States company; its storage location is not published.
• Plunk: account emails (sign-in links, invitations), sent from millos.ai. It receives email addresses and email content. Where: Germany (EU).
• Z360 (an independent provider): early-access requests, customer replies and text messages. It receives early-access form answers, messages and, if you gave one, your mobile number.
• Google Workspace (Google LLC): our email. It receives emails you send us. Where: Google does not promise a region; it may store email wherever it has facilities.
• GitHub: bug reports from the app. It receives the report text, the page and your email. Where: United States.
• Sentry (Functional Software, Inc.): error reports. It receives error details, user ID and Workspace ID. Where: United States (US data region).
• PostHog (PostHog, Inc.): product events (see 3.4). It receives the event name, user ID and Workspace ID. Where: United States (PostHog US cloud).
• Stripe (Stripe, LLC): payments. It receives billing and payment details. Where: United States.

6.2 Other times information leaves MillOS

• When your team shares it. When someone in your shop downloads or sends a proposal, or publishes a share link, it goes to whoever they choose. Anyone with a share link can open what it points to. New links end after 30 days by default. The person sharing can choose 7, 30 or 90 days, or Never, and can turn a link off at any time.
• Inside your Workspace. Members of your Workspace can see the Workspace's content according to their role.
• When the law requires it. We disclose information to follow a valid legal process. When the law allows, we tell your shop first, so it can object.
• To protect people and MillOS. We may share information to stop fraud, abuse or a security threat.
• If MillOS is sold or merged. Information may move to the new owner. It stays covered by the promises in this policy, and we will tell Workspace owners before it is covered by a different policy.
• With your permission.

We do not sell personal information, including sensitive personal information. We do not share it for cross-context behavioral advertising. We do not use it for targeted advertising. We have no advertising cookies or pixels on our site or in the app. There are no ad scripts on the website or help site. PostHog product analytics also starts on the public website pages (section 3.4).

Text messages

We do not share mobile numbers or text-message consent with third parties or affiliates for their marketing or promotional purposes. The opt-in records and consent for our texts are not shared with anyone, except the providers that send our texts for us.

7. Where information is kept

We store our databases and files in the United States. Some providers handle data elsewhere:

• AI requests may be processed in AWS Regions outside the United States, because we use global cross-region inference, and on Anthropic's backup route in other countries (section 5.2).
• Our account emails are sent through Plunk, which stores email addresses and messages in Germany.
• Google may store our email wherever it has facilities.
• Some providers deliver content through global networks or have support teams outside the United States, for example Vercel's edge network.

MillOS is offered only to businesses in the United States.

8. How long we keep information, and how to delete it

• Workspace content: while the Workspace exists. Your shop controls it.
• Deleted files, folders and Projects: 30 days in the Recycle Bin, then removed for good. A nightly job removes items older than 30 days. Owners and admins can “Delete for good” or “Empty Recycle Bin” sooner.
• Earlier versions of a file: kept while the file exists, and removed by the nightly clean-up after the file is deleted for good.
• A whole Workspace: 30 days after its owner deletes it, then removed for good. An owner can delete the Workspace in Settings. The delete dialog lists any unused paid Projects. For 30 days the Workspace can be restored. After that the nightly clean-up deletes it for good: every Project, file, Chat and its history, Workspace Memory and branding. A Workspace that has payments cannot be deleted in Settings; we delete it on request. (An owner can also archive a Workspace, which makes it read-only. Archiving can be undone.)
• Your account: until you delete it. You can delete your account in Settings, under Profile. You must first hand ownership to someone else, or delete any Workspace where you are the only owner. Content you made in a shop's Workspace stays with that shop.
• Agreement records: while your account exists, and as long as needed to show what was agreed.
• Shared links: until they end or are turned off. The default is 30 days.
• Isolated work computers: deleted 120 minutes after they stop.
• Hashed IP for the form: about 1 day after its one-hour window.
• Early-access requests: 24 months after your last contact, or sooner if you ask.
• Hosting request logs: up to 1 day on Vercel and 7 days on Supabase.
• Error reports: up to 90 days.
• Traces: 14 days, or up to 180 days if one is kept longer for review. Our traces do not keep message inputs and outputs (section 5.4).
• Backups: 7 days. Our database is backed up daily, and each backup is kept for 7 days. Deleted data can stay in backups until they expire. We do not restore it except to recover from an incident.
• Billing and tax records: 7 years. Texas requires sales tax records to be kept for at least 4 years.
• Emails with us: 3 years after the last message.

Unsent Chat drafts are kept in your own browser (local storage) until you send or clear them. They are not on our servers until you send them.

When you delete something, it is removed from our live systems as described above. Copies held by providers, such as backups, logs and traces, are removed when those expire. If we ever restore a backup, we delete again anything that had been deleted before. We may keep information longer when the law requires it, or to deal with a legal claim or a security investigation (a “legal hold”). When a Project is deleted for good, its saved Chat state in LangSmith is deleted with it. Its traces are removed when they expire, as listed above.

9. How we protect information

What we do today:

• Separate Workspaces. Every signed-in request checks the person's membership and role in the Workspace. Public share links are the exception: they open only the one item shared. The database also uses row-level security, which is on for every table that holds shop content. An automatic check blocks any database change that would leave a Workspace table without it.
• No passwords. Sign-in is by a one-time email link or code.
• Encryption. Connections to MillOS use HTTPS. The providers that store shop content encrypt it at rest: Supabase (AES-256) and LangChain (AES-256).
• Roles. Owners, admins, estimators and viewers have different rights. For example, only owners and admins can delete items for good.
• Isolated file processing with no internet access (section 5.7).
• Share links that end after 30 days by default.
• Error-report scrubbing (section 3.4).
• Limited staff access (section 5.5).
• A written security program, which we follow and review.

No system is perfectly secure, and we cannot promise that information will never be accessed without permission. We do not hold SOC 2 or ISO 27001 certification yet.

If there is a breach: if we learn that someone got into personal information or shop content without permission, we will tell affected shops right away. We will also notify people and regulators where the law requires it. (Texas law, for example, requires notice to affected people within 60 days, and to the Texas Attorney General within 30 days when 250 or more Texans are affected.) A named member of our engineering team leads our response.

10. Your choices and rights

Everyone

You can:

• see and correct your account details in Settings,
• download your files and workbooks,
• delete your account, or your Workspace if you are its owner (section 8),
• stop update emails with the unsubscribe link, by replying, or by writing to us. We act on it within 10 business days, as CAN-SPAM requires,
• stop text messages at any time by replying STOP, or get help by replying HELP,
• ask us for a copy of your personal information, or ask us to correct or delete it, by writing to legal@millos.ai.

Requests about shop content

If your information appears in a shop's documents, the shop controls those documents. We will pass your request to the shop and help it answer.

State privacy rights

Some US states, including Texas and California, give residents rights over their personal information: to know, access, correct, delete, get a copy, and opt out of sale, targeted advertising and certain profiling. These laws may not apply to MillOS today, because of our size and because we serve businesses. We still accept and answer these requests from anyone, as described below. We may decline all or part of a request when we cannot verify who is asking, when the information belongs to a shop's content and the shop must decide (see above), when answering would affect other people's rights, or when the law requires or allows us to keep the information.

• How to ask: email legal@millos.ai from the address on your account, or tell us how to reach you. We will check that the request is really from you, which may mean asking you to confirm from your email address.
• How long: we answer within 45 days. If we need more time, we will tell you why, and take at most 45 more days.
• Appeals: if we decline your request, you can appeal by replying with “Appeal” in the subject. We answer appeals within 60 days. If you are a Texas resident and are unhappy with our answer, you can contact the Texas Attorney General at texasattorneygeneral.gov.
• Asking for someone else: someone you authorize may ask for you. We may ask for proof of that authority.
• We will not treat you differently for using these rights.

Global Privacy Control

We do not sell or share personal information or run targeted ads. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of any sale, sharing or targeted advertising, and we will keep honoring it if our practices ever change.

11. Cookies and browser storage

We use a small number of cookies and browser storage entries. We do not use advertising cookies. The full list is in our Cookie Notice at millos.ai/cookies. In short:

• Sign-in cookies from Supabase keep you signed in.
• Preference storage keeps your light or dark choice, whether you closed the announcement bar, whether the sidebar is open (a sidebar_state cookie), and how you sort and fold lists.
• Drafts of Chat messages you have not sent yet, and answers you are part-way through, are kept in your browser so you do not lose them.
• A service worker registers in production. It does not cache your pages or data.
• Product analytics (PostHog, section 3.4). It sets its own cookie or local storage entry to recognize your browser.

12. Children

MillOS is for businesses and their staff. It is not meant for anyone under 18, and we do not knowingly collect information from children. If you think a child has given us information, email legal@millos.ai and we will delete it.

13. Changes to this policy

When we change this policy, we update the date at the top and add the change to a dated change log on this page. For a material change, we email each Workspace owner at least 30 days before it takes effect. If a change would let us use information already collected in a new way, such as AI training, we will apply it only with your permission.

14. Contact

MillOS, Inc., 4310 Directors Row, Houston, Texas 77092

Privacy and legal questions: legal@millos.ai

Help with MillOS: support@millos.ai