Milly Privacy Policy

Version: v2
Date: 19 August 2026

In case of any discrepancy between the French and English versions of this document, the French version prevails.

1. Data controller

The controller of your data is Aristide Hervé Mbassi Demoudourou, a natural person, reachable at aristide.mbassi28@gmail.com and residing at 91 D Rue Gabriel Péri, 42100 Saint-Étienne, France. This policy is published at https://milly-virtualassistant.fr/privacy.

2. The data Milly keeps

Milly keeps, for each user, in a PostgreSQL database:

• Account: an identifier, your time zone, the subject identifier of your Google account, the account creation date.
• Planning preferences entered during onboarding: start and end of day, lunch time and length, buffer between blocks, maximum task minutes per day.
• Conversation turns: the text you send (capped at 2000 characters per message) and the text of Milly's reply, both encrypted at rest with AES-256-GCM.
• Tasks: title, estimated duration, priority, deadline, status, and per-day planning state.
• Proposals and day plans, plus an action journal that keeps the wording of each action so it can be undone.
• Google grant: its status, the granted scopes, and the OAuth access and refresh tokens, each encrypted at rest with AES-256-GCM.
• Calendar events projected from and to Google Calendar: title, times, guests.
• Device registration for notifications: an APNs device token, a device identifier, the platform.
• Session refresh tokens, stored only as a hash.

3. What Milly never keeps

Two unusual points, in your favour:

• The content of places returned by Google is never stored. Only Google's place_id is kept; re-reading an old conversation re-fetches the cards from Google. Exception: the place you actually choose. Its name and address become the appointment's location, stored and projected to Google Calendar like any other appointment field.
• Your device's position is never stored. It travels with the request, anchors the place search, and is discarded as soon as the request is served.

4. Why this data is processed and on what legal basis

• Providing the service (understanding your messages, planning your day, syncing your calendar, sending notifications): performance of the contract (article 6.1.b GDPR).
• Creating and securing your account and sessions: performance of the contract (article 6.1.b) and legitimate interest in the security of the service (article 6.1.f).
• Accessing your Google Calendar and searching for places: performance of the contract (article 6.1.b), Google access being further conditioned on the authorisation you grant explicitly and can revoke.

Milly does no advertising, no profiling for commercial purposes, and no selling of data.

5. Recipients and sub-processors

Your data is shared with the following third parties, solely to operate the service:

• Google: the Google Calendar API, on the scope https://www.googleapis.com/auth/calendar, to read your calendar and write the appointments Milly creates; and the Places API (New), which returns place suggestions. The Google Terms of Service (https://policies.google.com/terms) and the Google Privacy Policy (https://policies.google.com/privacy) apply to map and place data and are incorporated by reference into this policy. Some place summaries are authored by Google and displayed verbatim, with their attribution.
• Anthropic: the text of your message and the context needed to answer it are sent to the Claude API (model claude-haiku-4-5) so Milly can understand your request. This content is processed to serve the request and is not used to train models.
• Anthropic, your agreement: your messages, tasks and calendar are only sent to Anthropic once you have explicitly agreed, which the app asks for before the first conversation. You can withdraw that agreement at any time from Milly's settings; the conversation then stops and your day stays readable.
• Apple: Sign in with Apple for authentication, and the Apple Push Notification service (APNs) for notifications.
• Hosting: a virtual server rented from OVH, located in France; the database is hosted on Supabase, in a region located in Europe, within the European Union.

6. Limited Use of Google user data

Milly receives data from your Google account through the Google Calendar API, on a scope Google classifies as sensitive. Milly complies with the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. Notwithstanding anything else in this policy:

• Google user data is used only to provide user-facing features that are prominent in the app;
• it is not transferred to third parties, except to provide those features with your consent, for security purposes, to comply with the law, or as part of a merger or sale of assets after your explicit prior consent;
• it is never used for advertising;
• no human reads it, except with your affirmative agreement, for security reasons (for example investigating a bug or an abuse), or where the law requires it.

7. The publisher's access to your data

The publisher has technical access to the production database and does not read the content of your conversations or calendars, outside the exceptions listed in the previous section.

8. No model training

No conversation, calendar or task content is used to train any model, neither by the publisher nor by Anthropic through the API. The transfer to Anthropic is precisely the case Google allows: a transfer necessary to provide a user-facing feature that is prominent in the app, the conversation itself.

9. Transfers outside the European Union

The application server is in France and the database is hosted within the European Union: hosting your data involves no transfer outside the Union. Google, Anthropic and Apple may process data outside the European Union, each under its own safeguard:

• Google: Google LLC is certified under the EU-U.S. Data Privacy Framework, as well as the Swiss-U.S. Data Privacy Framework and the UK extension, as stated on Google's data transfer frameworks page (https://policies.google.com/privacy/frameworks). Where that certification does not apply, Google's Cloud Data Processing Addendum provides for the European Commission standard contractual clauses.
• Anthropic: transfers are governed by the standard contractual clauses adopted by the European Commission in implementing decision 2021/914 of 4 June 2021, modules two and three, together with the UK addendum, as set out in Anthropic's Data Processing Addendum (https://www.anthropic.com/legal/data-processing-addendum). For the European region, the Anthropic entity is Anthropic Ireland Limited.
• Apple: personal data of people in the European Economic Area, the United Kingdom and Switzerland is controlled by Apple Distribution International Limited, in Ireland, and Apple's international transfers of that data are governed by the standard contractual clauses, as stated in Apple's privacy policy (https://www.apple.com/legal/privacy/en-ww/).

10. Retention periods

• Conversation turns: 90 days, then automatic deletion.
• All other categories listed above: kept as long as your account exists, then deleted with it. No other precise period is defined today, and this policy says so honestly rather than inventing figures.

11. Minimum age

The service is not intended for people under 15, the threshold set in France under article 8 of the GDPR. No account is knowingly created for a minor under 15.

12. Business transfer

If the business is transferred, personal data may be part of the transfer. Google user data, for its part, may only be part of it after your explicit prior consent.

13. Disclosure required by law

Your data may be disclosed when the law or a legal process requires it.

14. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability over your data. To exercise them, write to aristide.mbassi28@gmail.com. You may also lodge a complaint with the CNIL, the French data protection authority (https://www.cnil.fr).

15. Security

The measures in place: encryption in transit with TLS, connections being made over HTTPS with Let's Encrypt certificates; conversation content and Google tokens encrypted at rest with AES-256-GCM; refresh tokens stored only as hashes; secrets held per environment, outside the source code.

16. Personal data breach

In case of a personal data breach, the publisher notifies the CNIL within 72 hours and informs you when the risk to your rights is high, in accordance with articles 33 and 34 of the GDPR.

17. Deleting your account, revoking Google access

You can delete your account from the app, in the settings, after a confirmation. Deletion is immediate and final: there is no grace period and no deactivated account kept in the background. Everything this policy describes is erased, including your conversations, your tasks, your preferences, your day plans, your action journal, your device registrations for notifications and your session tokens.

Before erasing anything, Milly revokes its access to your Google account with Google. If that revocation fails, your data is deleted anyway and Google expires the authorisation on its side.

The appointments Milly wrote into your Google Calendar belong to you and stay in your calendar: they are not deleted with your Milly account.

You can also write to aristide.mbassi28@gmail.com to ask for deletion.

To revoke Milly's access to your Google account without deleting your Milly account, use your Google account settings (https://myaccount.google.com/permissions).

18. Cookies

Milly is an iOS application and an API: it does not use cookies. Sessions rely on tokens sent by the application, described above.

19. Changes to this policy and contact

This policy may change; every new version will carry its number and date, and you will be informed of substantial changes. For any question: aristide.mbassi28@gmail.com.