Privacy Policy

Milepost is a product of Intellizu LLC (“Intellizu”, “we”, “us”). This policy explains what information Milepost collects, how we use it, and the choices you have. It covers the Milepost web app at app.mileposthq.dev, the client portal, the Milepost mobile app, and this website.

Milepost is used by agencies (“customers”) to run client engagements. When an agency invites its staff, contractors, or clients into Milepost, the agency decides what information goes in. For that customer data we act as a service provider (processor) on the agency’s behalf, and the agency’s own privacy practices also apply.

Information we collect

Account information. Name, email address, password (stored only as a salted hash), multi-factor authentication settings, and the workspace and role you belong to. If you sign in with Microsoft single sign-on, we receive your name, email address, and directory identifier from Microsoft.

Customer content. What you and your workspace put into Milepost: clients and contacts, opportunities, projects, milestones, tasks, contracts, change orders, time entries, invoices, support tickets and emails, files, and reports.

Data from connected services. When a workspace administrator connects an integration, Milepost receives the data that integration needs to work, as described under Google user data and Other connected services.

Payment information. Card and bank details are collected and stored by our payment processor, Stripe. Milepost receives only limited details such as the card brand, last four digits, and payment status.

Usage and device information. Log data such as IP address, browser type, pages requested, and timestamps, used to operate and secure the service. The web app reports errors to our error monitoring provider. If you use the mobile app and allow notifications, we store a push notification token for your device.

Information you send us. Messages you send through our contact form or support email, and any ratings you give after a support conversation.

How we use information

We use information to:

• provide, maintain, and support Milepost and the features you choose to use;
• authenticate users and keep accounts and workspaces secure;
• send service messages such as notifications, approvals, invoices, and support replies;
• process payments and manage subscriptions;
• diagnose errors and improve reliability; and
• comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use customer content or data from connected services for advertising.

Google user data

Milepost can connect to Google Calendar when a workspace administrator chooses to. Milepost requests these permissions:

• openid and email, to identify which Google account was connected.
• Google Calendar events (https://www.googleapis.com/auth/calendar.events), to create calendar events from Milepost (for example, all-day events for upcoming project milestones), keep those events up to date when a milestone changes, remove them when a milestone is deleted, and show upcoming events from the selected calendar inside Milepost.

How we use it. Google Calendar data is used only to provide these user-facing calendar features in the workspace that connected the account. We store the OAuth tokens Google issues, encrypted, plus a record linking each Milepost milestone to the calendar event created for it, so the event can be updated or removed later. Upcoming events shown in Milepost are fetched from Google when requested.

How we share it. We do not sell Google user data, and we do not transfer it to anyone except as needed to provide or improve the calendar features you use, for security purposes, to comply with applicable law, or as part of a merger or acquisition with notice to you. We do not use it for advertising.

People. No one at Intellizu reads Google user data unless you ask us to for support, it is necessary for security purposes such as investigating abuse, or the law requires it.

AI and machine learning. We do not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

Limited Use. Milepost’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access. A workspace administrator can disconnect Google Calendar from Milepost’s Integrations settings at any time, after which Milepost stops accessing the calendar. You can also revoke Milepost’s access from your Google Account permissions. To have stored Google data deleted, contact us at the address below.

Other connected services

Workspaces can also connect services such as Jira, Linear, GitHub, Slack, QuickBooks Online, Microsoft calendars, Grafana, and other Intellizu products. Each connection is made by a workspace administrator, receives only the data that integration needs, and can be disconnected at any time. Credentials for connected services are stored encrypted.

Some features, such as reading details out of an uploaded document, send that document’s content to an AI model provider to extract structured information. The provider processes the content to return the result to Milepost and does not use it to train its models.

Service providers

We share information with providers that help us run Milepost, under agreements that limit their use of it to providing services to us. These include:

• Amazon Web Services, for hosting, storage, and email delivery;
• Stripe, for payment processing;
• Sentry, for error monitoring;
• Anthropic, for AI document extraction; and
• the connected services a workspace chooses to enable.

We may also disclose information if required by law, to protect the rights, safety, or property of our users or others, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply.

Data storage and security

Milepost is hosted in the United States. We encrypt data in transit with TLS, encrypt stored integration credentials, restrict production access to the people who need it to run the service, and offer multi-factor authentication for accounts. No system is perfectly secure, but we work to protect your information and will notify affected customers of a security incident as the law requires.

Retention

We keep customer content for as long as the workspace’s account is active, or as the workspace directs. When a customer closes its account, we delete or de-identify its content within a reasonable period, except where we must keep records (for example, invoices and payment records) to meet legal or accounting obligations.

Your choices and rights

You can view and update your profile information in Milepost. Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. If your information is in Milepost because an agency added it, please contact that agency first; we will help them respond. To make a request, email us at the address below. We respond within 30 days.

Children

Milepost is a business service and is not directed to children under 16. We do not knowingly collect their personal information.

Changes to this policy

We may update this policy as Milepost changes. If a change is material, we will notify workspace administrators by email or in the app before it takes effect. The date at the top of this page shows when it last changed.

Contact

Questions about this policy or your information: email hello@mileposthq.dev or use our contact form.