Privacy policy

When you submit a password to create an account, sign in or reset it, the updated website checks guessable patterns locally. It then computes a SHA-1 hash locally for breach lookup and sends only the first five hexadecimal characters to the free Have I Been Pwned Pwned Passwords service over HTTPS. Matching against returned hash suffixes happens in your browser. The service does not receive your password, full hash, name or email through this check, but it receives connection information such as your IP address and the hash prefix. Checks run on submission, not while you type. Milo does not persist passwords or lookup hashes in its workspace or analytics. SHA-1 is used for this lookup protocol, not password storage. The authentication provider separately processes passwords to authenticate accounts. A failed safety lookup prevents the updated website from continuing the password request until a check succeeds.

Where passkeys are enabled, the authentication provider stores public credentials and credential metadata to verify sign-ins. Your device or password manager protects the private key. Milo does not receive your fingerprint or face data. You can manage registered passkeys from Account settings. Your device or password manager controls whether passkeys synchronise between your devices. See Have I Been Pwned’s privacy information and Supabase’s privacy information.

You can save destination names and whether employer sponsorship is needed now, later, not needed, or uncertain. These self-reported choices are held with your account workspace and its browser cache. They are used to show search guidance, not to verify legal eligibility. They are not added to search URLs or job-provider requests. This feature does not request nationality, passport scans or visa documents, and does not send these answers to an AI provider or employers. Remove a destination in Preferences and save to remove it from your workspace preferences. You can search without providing these answers.

Support tickets store your account identifier, chosen category, subject, messages, timestamps and ticket status. Authorised support staff can read and reply to help fulfil support requests and protect the service. Closed tickets are deleted after 180 days; account deletion removes linked tickets. Replies appear in your support centre. Do not include passwords, payment credentials, identity documents or complete CVs. Optional AI troubleshooting sends only the question you submit to OpenAI using the existing AI controls. You choose whether to include its answer in a ticket.

This notice covers milojobs.com. The data controller is MILOJOBS LTD, company 17457533, at 66 Paul Street, London, EC2A 4NA, United Kingdom. For privacy questions and requests, contact support@milojobs.com. We use the information described below for free account tools, Founding Access pre-orders, monthly subscriptions when available, payments and the private workspace.

The homepage requests a recently cached UK job example from Milo’s server without an account token or candidate details. The response includes a public advert excerpt, original source link, fetch date and deterministic assessment. It does not ask an AI provider to assess your personal information. Opening the original advert takes you to that employer’s external site. Hosting providers may process ordinary connection logs for the request. No application outcome or CV is collected by viewing the example.

Creating a free account stores your authentication details so daily allowances can be enforced. For a CV versus job-description check, the CV text, job text, role and employer you enter are sent to Milo’s server for deterministic text comparison. This checker does not send them to an AI provider. Its request processor uses the text in memory without storing the raw CV, job description or generated report. Results remain in your open browser tab unless you download them. Remove unnecessary personal or sensitive details before checking.

We retain a usage record containing your account identifier, check type, random request identifier, a keyed fingerprint of the input, state and timestamps for up to 30 days. The fingerprint supports safe retry handling without storing the submitted text. Per-minute rate-limit counters are retained for up to two days. These account-linked records are also removed on account deletion. A request being processed can temporarily count against your allowance. Infrastructure providers may retain connection and error logs under their own settings.

A sponsor lookup sends the employer name and search criteria you enter to our service. Register results are public organisation records, not a finding about your personal immigration status. The source date and whether a fallback snapshot was used are shown with the result.

When you request an assessment or Pitch Kit, Milo’s server processes the job text, employer, salary and occupation details, supplied candidate facts and any CV text needed for that request. The core assessment and Pitch Kit use deterministic checks and templates. A Pitch Kit does not send your CV or candidate facts to an external AI provider. If you explicitly allow optional AI interpretation on the assessment form, and the service is connected, the job advert alone is sent to TypeSafe (Jev) for supplementary wording analysis. Obvious contact emails, phone numbers and URLs are removed first, but this is not guaranteed anonymisation. Your CV, profile, salary answers and personal outcomes are not included. You can run the assessment without this optional transfer; it does not alter the rules used for the evidence band. Jev remains disabled until the operator configures the service. Provider processing is governed by the applicable TypeSafe terms and processing arrangements. The request processor uses the inputs in memory without saving the raw CV, job description or generated result. The results stay in your open tab unless you download them or separately save them in the private workspace.

To enforce allowances and handle safe retries, we store your account identifier, a random request identifier, request type, a keyed input fingerprint, processing state and timestamps. Request records are kept for up to 30 days and short-term rate counters for up to two days. Account deletion removes these account-linked records. Account export includes the service-record metadata, excluding internal security fingerprints. Infrastructure connection and error logs follow provider settings. Do not enter a passport number, financial details or information about other people that the tool does not need.

Assessments can use dated public job-ad observations associated with an exact employer and role. This describes wording in adverts, not verified sponsored hires. Candidate details and personal application outcomes are not sent to employers or other candidates by an assessment request.

The Sponsorship Reality Tracker stores the outcome, observation date, role family, evidence category and the assessment snapshot you choose to save alongside your existing application record. Evidence categories describe what you report; they do not mean Milo verified an employer message or Certificate of Sponsorship. The tracker does not request a certificate number or a copy of an employer message. These records use the same account-scoped workspace sync as your applications and are included in your workspace export.

You can remove a sponsorship observation while retaining its application. Deleting the application removes its related sponsorship fields, and account deletion removes the workspace. No shared-outcome collection, public employer report, recruitment-agency resale or participation toggle is enabled in this release. A future shared view would need a separate explanation of its purposes, safeguards, retention and participation choices before collecting data for that purpose.

We process your name, account email and authentication information; profile and resume information; uploaded documents; saved jobs and application records; interview answers, feedback and outcomes; and messages you send to support. Starting Founding Access checkout stores your name, email, selected currency, agreement version, checkout reference and payment state to manage your pre-order and the 50-customer limit. We also use a keyed hash of connection-address information to limit repeated checkout attempts. Entering details without starting checkout does not send those details to Milo. Avoid adding sensitive details that are not needed for your job search.

Hosting and authentication providers also process connection information such as IP addresses, browser information and service logs. Stripe processes checkout names, emails, payment and fraud-prevention information. MILOJOBS LTD can access payment status and transaction references to manage orders, refunds and future activation. Card details are entered on Stripe, not stored in Milo’s frontend. Payment-related communications are separate from optional marketing updates.

Account access, requested sponsor and CV checks, document storage and workspace syncing are used to provide the service you request (contractual necessity where applicable). Security, error investigation and support rely on legitimate interests in running a reliable service, balanced against your rights. Records required by law are processed for legal obligations. Optional product updates and job alerts rely on your consent. You can disable job alerts in the workspace or unsubscribe in an alert email; you can withdraw product-update consent through support.

Your entered outcomes support comparisons and experimental estimates in your own workspace. These features do not make employment decisions about you. AI Studio, when configured, sends only the text you enter for a selected task to OpenAI through our Supabase backend after you agree to that request. It does not automatically send your inbox or saved workspace. You can continue using the template tools without using AI Studio. The popup feature guide matches your query locally against the feature directory; guide queries are not saved or sent to a model provider.

IONOS hosts the website. Supabase provides authentication, workspace data and private document storage. Fonts are served from our own website rather than requested from Google Fonts. Google Workspace processes correspondence sent to our support and founder addresses. Resend processes email received by the private application inbox. Email job-alert delivery is not active; it will require separate opt-in when made available. The Milo application inbox receives messages at an assigned application address. It does not connect to your personal Gmail or Outlook mailbox or require those inbox passwords.

Job searches use connected feeds including Arbeitnow, selected Greenhouse, Lever and Ashby employer boards, and Reed when configured. Reed receives your search keywords and location; your resume and account email are not included in job-feed requests. Employer links take you to external sites with their own privacy practices.

Company research requests go through an authenticated Milo server endpoint, without using public CORS proxies. The destination website receives our server connection and the public URL being requested, not your account token, CV or personal inbox credentials. The service limits destinations and redirects, blocks private network addresses, and caps fetch size and time. Do not enter private links or URLs containing personal information. Paste public page text if a link cannot be imported safely.

When you ask Milo to import a supported public job posting, our server requests that page or its public posting API. The employer service receives the public posting URL and our server’s connection information. We do not include your login token, resume, email or answers in that external request. Unsupported or inaccessible links require pasted text. The imported description is shown for your review and becomes workspace content only when you save or prepare an application.

Import protection stores an account identifier and daily and short-term request counters. These counters do not contain imported URLs or page bodies. Records older than two calendar days are removed when another import reservation runs; account deletion also removes them. Hosting providers may retain request logs under their own retention settings.

Inside the private workspace, Milo Brief displays news headlines and publisher excerpts supplied through Mediastack. Access requires a verified signed-in account with private workspace access. Our server requests and temporarily caches stories; your name, email, profile and resume are not sent in these news requests. News searches and topic filters run in your browser and are not submitted to Mediastack. Reading a publisher link opens that external website, whose own privacy practices apply. The news feed does not add an advertising pixel, email signup or reading-history profile. This section was added on 21 September 2026.

Every account can watch up to 25 exact legal employer names. Milo stores your account identifier, watched name, current matched public register rows, source date and time checked. Watches remain until you remove them or delete the account. Detected register changes are retained for at most 365 days and are removed when the watch or account is deleted. In-app updates describe changes between observed snapshots, not official revocation notices. This feature does not send your CV or contact details to watched employers.

Email watch alerts and sponsor-aware job digests are not active. If email delivery becomes available, enabling it will require a separate choice, use your verified account email and show the applicable provider, preferences and retention before you opt in. Existing email-alert preparation records, where present, contain preferences, consent and queue metadata; prepared delivery records are scheduled for deletion after 30 days. You can disable an existing preference in the workspace. No active alert opt-in is created by adding an employer watch.

To show employer advertising history, Milo records public job titles, employer names, locations, source links, sponsorship wording and observation dates. These observations do not include applicant information. Records are retained for 365 days after their last observation. This history describes adverts seen by Milo, not visas granted, people hired or all jobs an employer has advertised.

AI Studio supports document drafting, translation, written interview practice feedback and feature guidance. Generated text may be inaccurate and must be reviewed before use. Requests use OpenAI with response storage disabled; this does not eliminate provider abuse-monitoring logs or applicable caching retention. See OpenAI’s data controls. Provider processing may take place internationally. Remove unnecessary sensitive information before sending a request. Review and remove unnecessary email addresses, phone numbers, links and sensitive details yourself. Do not assume information is automatically anonymised; details in your work history can still identify you. Generated drafts remain in the current tab unless you copy or download them; leaving AI Studio clears them. Do not rely on this temporary draft view as storage.

When monthly subscriptions become available, our server connects your account to a Stripe customer and subscription. We process the selected plan, currency, price reference, billing period, payment and cancellation status, checkout reference and accepted terms version to provide access and manage billing. Signed Stripe event identifiers and processing state help prevent duplicate changes and recover incomplete updates. These records do not contain your full payment-card details.

Billing records can outlast account deletion where needed for accounting, dispute handling and legal obligations. We do not claim that these records are erased with the 30-day checker log. Cancelling renewal, obtaining a refund and deleting your workspace are separate actions; use Account and data or contact support for help.

Resume text extraction runs on your device. Extracted text is saved or sent only when you use the corresponding save or generation action. We store AI request task, timestamps, completion state and token counts for quota enforcement; the usage ledger does not contain your input or generated text.

A submitted preparation package stores the exact job, resume, cover letter, contact details and answers you approve, together with queue state and any submission receipt. Cancellation stops eligible queued work but does not itself erase the package. Account deletion removes these account-linked packages and AI usage records. Purchase records include checkout reference, email, amount, refund state and activation dates, and may be retained for accounting or disputes after account deletion. A purchase is linked only after verification of the matching account email.

Milo uses browser local storage for login-session information and a recoverable workspace cache, and session storage for navigation and a random checkout retry reference. Job-search terms, filters, results and scroll position are held in account-scoped memory for up to 15 minutes to support switching sections; they are cleared on sign-out or an account change. The checkout reference helps resume a request without creating a duplicate payment; name and email are not stored with that reference in session storage. Clearing storage can remove unsynced changes. On shared devices, sign out when finished. We remember your analytics choice in local storage. Google Tag Manager loads on public pages only after you accept analytics and manages the configured Google Analytics tag. It measures public-page visits and founding-access funnel steps (opening the offer, completing the details step and starting checkout), and may set analytics cookies; Google processes browser, device and connection information. We do not enable advertising personalization or deliberately send your name, email, resume or payment details to Analytics. You can reject analytics or withdraw consent using Cookie settings, without affecting checkout or access. Withdrawal stops future collection; it does not automatically erase previously collected data. Google may process analytics information internationally. This analytics notice was updated on 25 September 2026.

Uploaded files are stored privately with account-based access controls. These safeguards reduce risk but cannot guarantee absolute security.

Workspace content remains associated with your account while needed to provide your workspace. You can delete uploaded documents in the app and use Account and data to export or delete your account after signing in again, including if you only use the free tools. Private-workspace users also have these controls in Profile. Contact support for assistance. Support and security records are kept only as needed for the request, security, disputes or legal obligations; backup copies may persist until the provider’s normal expiry. Account deletion removes the active login, workspace, employer watches, Milo mailbox and stored documents. It cannot retract applications or emails already held by employers, erase local copies on other devices, or remove records independently held by payment and email providers. Contact support for requests involving those records.

Completed or released Founding Access checkout records are cleaned during reconciliation after 30 days: names, connection hashes, saved checkout requests and checkout links are removed. Released unpaid records also lose their email. Paid emails and purchase references remain for order ownership and the founding-customer limit. An unresolved checkout retains the information needed to confirm whether a payment occurred and prevent a duplicate charge until it is resolved.

Providers may process information outside your country. The applicable route depends on the contracting entity, processing region and any onward transfer. UK adequacy regulations, the UK International Data Transfer Addendum to EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient and transfer qualify can provide a lawful transfer route. A provider offering these terms does not itself prove that every Milo transfer has been assessed. Contact us for the applicable safeguards and a copy where available; contractual and transfer-assessment records remain part of our operational review. Payment records may need to be retained after account deletion for accounting, disputes and legal obligations.

The following links identify the providers’ published processing terms. They are not a claim that Milo holds every provider certification or that a vendor account setting has been independently audited.

• IONOS data protection: website hosting and associated connection logs.
• Supabase processing terms: authentication, database and document storage; published terms include provisions for UK transfers.
• Stripe processing terms and Data Transfers Addendum: payment processing, including the UK Addendum where applicable; Stripe also acts as an independent controller for some activities.
• OpenAI processing terms: requested AI processing; provider data controls and international-transfer terms apply.
• Resend processing terms: application email processing, with UK transfer provisions in its published agreement.
• Google Workspace processing terms: support correspondence.
• Google measurement processing terms: optional consent-based analytics.

We investigate suspected breaches and assess their effect on people. Where the UK GDPR requires notification, we report to the ICO without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach. If the breach is likely to create a high risk to affected people, we inform them without undue delay. These duties depend on the incident and risk, not every error or attempted login. Report concerns to support@milojobs.com; our security page explains the scope of our safeguards.

Contact support@milojobs.com to request access, correction, deletion, restriction, portability or to object to processing where those rights apply. You can also withdraw product-update consent. We may verify your identity before acting. Rights have legal exceptions, which we will explain if relevant.

If UK data-protection law applies, you can complain to the Information Commissioner’s Office. You may also contact the relevant authority where you live. Material changes to this notice will be identified with an updated date.

You may contact support@milojobs.com for access, correction, deletion, consent withdrawal or a privacy complaint without creating an account. Tell us which service and account email your request concerns; do not send identity documents unless we explain why proportionate verification is needed. We will respond within the deadlines applicable to your request and explain any lawful exception or extension.

If Indian data protection law applies to our processing, you may also request information about grievance handling and nomination rights as applicable provisions take effect. Other regional rights depend on the law and its scope. You may contact your local supervisory authority. We do not claim that publishing this notice alone certifies compliance with every jurisdiction.