Privacy policy

Last updated: October 2026. The German version is legally binding.

1. Controller

Dominik Helf
Waidmarkt 18
50676 Köln (Cologne), Germany
Email: support@heymilo.pro

2. What this is about

Milo is an app for online sellers. It reads customer requests from the seller’s support mailbox, Amazon and Shopify, drafts replies with the help of AI and presents them to the seller for approval. This policy explains which data is processed – of sellers (our customers) and of their buyers – and when you visit this website.

3. Roles

We are the controller for seller data (account, billing, usage). For buyer data that Milo processes on behalf of a seller, the seller is the controller and we act as processor under Art. 28 GDPR. A data processing agreement is available on request.

4. Data we process

• Account: email address, name, sign-in via one-time code, Apple or Google.
• Connections: mailbox credentials (IMAP/SMTP), authorizations for Amazon Seller Central (SP-API) and Shopify. Credentials are additionally encrypted.
• Customer requests: buyer messages, name, email or Amazon relay address, order and shipping data (e.g. order number, items, amount, tracking status), attachments such as photos.
• Rules and learning: corrections and rules derived from them, stored without names, addresses or email addresses.
• Billing: number of cases, payment data via our payment provider.
• Technical: device tokens for push notifications, error and access logs.

5. Purposes and legal bases

• Providing the app and handling customer requests: contract (Art. 6(1)(b) GDPR); for buyer data, on behalf of the seller.
• Billing and statutory retention: Art. 6(1)(b) and (c) GDPR.
• Security, troubleshooting and abuse prevention: legitimate interest (Art. 6(1)(f) GDPR).

We do not sell data or use it for advertising. Buyer data is not used to train AI models.

6. Recipients and service providers

• Amazon Web Services EMEA SARL (Luxembourg): servers and database in Frankfurt, Germany; email delivery of sign-in codes.
• OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA): drafting replies and translations. We send the request and the case details needed. Requests are processed via the API and not stored by OpenAI for its own purposes. Transfers to the USA may occur, based on the EU-US Data Privacy Framework or standard contractual clauses.
• Stripe Payments Europe Ltd. (Ireland): payment processing.
• Amazon and Shopify: retrieving order data and sending replies, where the seller has connected them.
• Apple and Google: sign-in, if chosen; Apple also for push notifications. Expo (650 Industries, USA) for app updates and push delivery.
• Hostinger (Lithuania): hosting of this website.

7. Retention

Cases and messages are kept until the seller deletes them or their account. When an account is deleted, the keys to the encrypted credentials are destroyed immediately and all data is deleted; backups expire shortly afterwards. When Shopify is disconnected or Shopify requests deletion of a customer, we delete the affected data automatically. Billing records are kept as long as tax and commercial law require (up to 10 years).

8. Security

Database and storage are encrypted (AWS KMS), credentials additionally with a per-account key. All connections use TLS. Only a few authorized people have access to production data.

9. Website

This website sets no cookies, uses no tracking and loads no third-party content. Our host processes technically necessary data (IP address, time, page requested, browser) in server logs that are deleted after a short time (Art. 6(1)(f) GDPR).

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to support@heymilo.pro. Buyers should preferably contact the seller they ordered from; we support the seller in this. You may also lodge a complaint with a data protection supervisory authority.