Privacy Policy

Milkweed, Inc. (“Milkweed,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us.

This Privacy Policy explains how we collect, use, disclose, transfer, store, retain, protect, and otherwise process Personal Information we receive from you when you visit our website, use our products or services, communicate with us, or otherwise interact with us (collectively, the “Services”).

Please read this Policy carefully. It describes our privacy practices. Our Terms of Service govern your use of the Services.

As used in this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household. Examples include your name, postal address, email address, phone number, date of birth, account identifiers, device or online identifiers, and content you submit to or through the Services. That list is illustrative, not exhaustive.

The term includes information that is “personal data” under Article 4(1) of the EU GDPR or the UK GDPR, and “personal information” under California Civil Code § 1798.140(v). Where another privacy law applies to our processing of your information, the definition in that law controls for purposes of the rights that law provides.

Depending on how you interact with Milkweed, we may collect the following categories of information.

Information You Provide to Us

We may collect information that you voluntarily provide, including:

• Name
• Email address
• Telephone number
• Company or organization name
• Account information
• Information submitted through forms, surveys, or questionnaires
• Communications with Milkweed
• Customer support inquiries
• Feedback and other information you choose to provide
• Messages, prompts, questions, and other text you submit to AI features
• Files, images, and other content you upload so the Services can retrieve relevant context
• Feedback you provide on AI outputs

If you create an account, we may also collect information necessary to establish, authenticate, and manage your account.

If you use AI features, we also create and store embeddings (vector representations) of content you submit or upload so the Services can find relevant context for later requests. Embeddings are Personal Information when they can be linked to you or your household or organization.

Information Collected Automatically

When you access our website or Services, we may automatically collect certain technical and usage information, including:

• IP address
• Browser type and version
• Device type and operating system
• Approximate location derived from your IP address
• Pages viewed
• Links clicked
• Referring and exit pages
• Dates and times of access
• Session information
• Website and application interactions
• Error, diagnostic, and performance information
• App version, device identifiers used for authentication or crash diagnosis
• Approximate in-app feature usage (for example, that an AI feature was invoked), not the full text of your prompts, in our application logs unless needed for security or debugging

We may collect this information through cookies, local storage, analytics technologies, and similar tools.

Information From Third Parties

We may receive information from services you choose to connect (for example, sign-in providers) and from vendors that help us host, secure, or operate the Services (for example, service providers, analytics providers, business partners, and publicly available sources where permitted by law).

We may use information we collect to:

• Generate AI responses and retrieve relevant context from content you have allowed the Services to use
• Maintain and isolate your or your organization’s knowledge in our vector database
• Monitor for abuse, prompt injection, and prohibited content
• Improve reliability, safety, and user experience of the Services. This does not mean we authorize our model provider to train its foundation models on your API content. See Section 6.
• Operate and maintain the Services
• Create and manage user accounts
• Authenticate users and maintain account security
• Personalize the user experience
• Process requests and transactions
• Respond to questions and provide customer support
• Send administrative, transactional, and service-related communications
• Send marketing communications where permitted by law
• Analyze how our website and Services are used
• Develop new products, features, and functionality
• Diagnose technical problems
• Detect, investigate, and prevent fraud, abuse, security incidents, and other harmful activity
• Enforce our agreements and policies
• Comply with legal and regulatory obligations
• Protect the rights, property, safety, and security of Milkweed, our users, and others
• Carry out other purposes disclosed to you at the time information is collected

Milkweed and our service providers may use cookies and similar technologies to operate our website, remember preferences, understand how visitors use our Services, improve performance, and support essential, preference, and first-party or vendor analytics.

Depending on your location and applicable law, you may have the ability to control certain cookies through a cookie consent tool, your browser settings, or other available privacy controls.

Disabling certain cookies may affect the functionality of our Services.

We may use in-house analytics services to understand how users interact with our website and Services.

We may share personal information with third parties when reasonably necessary to operate our business and provide the Services.

These parties may include:

Some features of the Services use artificial intelligence, including large language models operated by OpenAI, and a proprietary retrieval system (a vector database) that we host on Amazon Web Services.

What we send and store. When you use an AI feature, we send your prompt and the minimum relevant context (including chunks retrieved from content you or your organization uploaded) to OpenAI so it can generate a response. We store chat history and embeddings of eligible content on our systems so the feature can work across sessions. We do not put our OpenAI API keys in the mobile app; calls are made from our servers.

Permission. The Services are AI-powered. Using the Services means your prompts, uploads, and retrieved context are sent to OpenAI to generate responses, as described in this section. This processing is required to operate the Services; it is not an optional setting. Before you create an account or first use the Services, we will show an in-app notice that names OpenAI and explains this transfer, and we will ask you to confirm that you understand and agree. If you do not agree, you should not use the Services. You can stop our processing by deleting your account, which deletes associated chat history and embeddings as described in Section 7.

Training. We configure our OpenAI API use so that OpenAI does not train its foundation models on your API inputs or outputs. We do not sell your prompts or files. If we ever use your content to train a Milkweed-specific model or to opt in to a vendor training program, we will disclose that and, where required, obtain consent or offer an opt-out.

Outputs. Responses are AI-generated and may be inaccurate, incomplete, or inappropriate. Do not treat them as legal, medical, financial, or other professional advice. Do not represent Milkweed outputs as solely human-authored where that would mislead someone.

Sensitive content. Do not submit government ID numbers, payment card data, passwords, or other highly sensitive information in prompts unless a specific Milkweed feature is built to collect that data and says so. We use automated abuse and content filters and may review reports of harmful output.

We keep Personal Information only as long as needed to provide the Services, including the purposes in this Policy, unless a longer period is required for security, disputes, or law.

Typical periods:

• Account profile and organization membership - for the life of the account
• Chat history and uploaded files - until you delete them or close the account
• Embeddings derived from that content - deleted when the source content or account is deleted
• Security, access, and application logs - about 90 days (we avoid storing full prompt bodies in default logs where feasible)
• Backups - up to 30 days after deletion from primary systems
• Records of privacy requests and incidents - as needed to show we responded, typically up to three years

You may delete your account in the app (Settings) or by emailing support@milkweed.ai. We will delete your account data, chat history, uploaded files, and associated embeddings from production systems, then from backups as those media expire. We may retain limited records (for example, that a request was made, or data we must keep for law, security, or billing).

OpenAI may retain API inputs and outputs for a limited period for abuse monitoring under its terms, unless a zero-data-retention arrangement applies to our account.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or misuse.

However, no method of transmitting information over the Internet or storing information electronically can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and should notify us promptly if you believe your account has been compromised.

Residents of certain countries or U.S. states may have additional privacy rights under applicable country or state privacy laws.

Depending on the law that applies, these rights may include the right to:

• Request access to personal information we maintain about you
• Request correction of inaccurate personal information
• Request deletion of certain personal information
• Obtain a copy of certain personal information
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Opt out of certain targeted advertising, sharing, or sales of personal information
• Appeal certain decisions concerning a privacy request
• Receive information regarding categories of information collected, used, or disclosed

Where required, we will provide mechanisms for exercising these rights and will process verified requests in accordance with applicable law.

To request access, correction, deletion, or export, email support@milkweed.ai with the subject “Privacy Request.” We aim to complete verified requests within 45 days but may also extend once, by up to 45 days, as the statute allows.

We may need to verify your identity before fulfilling your request.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

You may opt out of promotional email communications by following the unsubscribe instructions contained in those communications.

Even if you opt out of marketing communications, we may continue sending non-promotional communications relating to your account, transactions, security, or use of the Services.

Our Services are not directed to children under 13. We do not knowingly collect Personal Information from children under 13. If we learn that we have, we will delete it.

If you believe a child has provided personal information to us in violation of applicable law, please contact us so that we can investigate and take appropriate action.

Certain Milkweed products or features may establish a higher minimum age where required by law or appropriate for the particular service.

Our Services may contain links to websites, applications, products, or services operated by third parties.

Milkweed does not control the privacy practices of those third parties. Information you provide directly to a third party is governed by that third party's privacy policy.

We encourage you to review the privacy policies of third-party services before providing them with personal information.

The primary processing location is the United States. OpenAI and AWS may process data in the United States and in other regions they operate. Where EU or UK law requires a transfer mechanism, we rely on the vendor’s appropriate safeguards (such as Standard Contractual Clauses) and our agreements with them.

As a result, your information may be transferred to a jurisdiction with privacy laws that differ from those in your country of residence.

Where required by applicable law, we use appropriate mechanisms designed to protect personal information transferred internationally.

This section is for California residents and supplements the rest of this Policy. “Personal information” here has the meaning in California Civil Code § 1798.140(v). Milkweed, Inc. is the “business.”

Categories collected. Depending on how you use the Services, we may collect: identifiers (name, email, account and device identifiers, IP address); customer records information; commercial information (subscription status, purchase history through an app store); internet or electronic activity (app and site usage, diagnostics); geolocation at a coarse level derived from IP address; audio/electronic/visual information if you upload media; professional information (company name, role) for B2B accounts; inferences we draw to operate the product (for example, that a document is relevant to a query); user content you submit, including prompts and files; and embeddings of that content. We do not intentionally collect sensitive personal information to infer characteristics about you. Do not submit sensitive personal information in prompts unless a feature expressly requests it.

Sources. You; your device and the Services; your organization if you have a B2B account; app stores; and service providers listed in Section 5.

Purposes. The purposes in Section 2, including providing AI features, security, support, and (where permitted) service communications.

Recipients. Service providers and contractors in Section 5 (including AWS and OpenAI); authorities when required by law; successor entities in a business transaction.

Sale / share / targeted advertising. We do not sell personal information for money and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a “Limit the Use” right, other than to provide the Services you request.

Retention. See Section 7.

Rights. You may request access (including specific pieces and categories collected, disclosed, or sold/shared), correction, deletion, and a copy of personal information. You may use an authorized agent with proof of authority. We will verify your request and respond within the time the CCPA/CPRA allows. We will not discriminate against you for exercising these rights. Submit requests to support@milkweed.ai or write to the address in Section 16.

Notice at collection. We collect the categories above for the purposes above. We do not collect additional categories or use them for materially different purposes without updating this Policy.

We may update this Privacy Policy periodically to reflect changes to our Services, business practices, technology, or legal requirements.

When we make changes, we will update the “Last Updated” date at the top of this Privacy Policy. If required by law, we may provide additional notice regarding material changes.

We encourage you to review this Privacy Policy periodically.

If you have questions about this Privacy Policy, our privacy practices, or would like to exercise an applicable privacy right, please contact us at:

Milkweed, Inc.
Mailing Address:
2450 Colorado Avenue, Suite 100E
Santa Monica, CA 90404
United States
Email: support@milkweed.ai
Website: www.milkweed.ai