Privacy Policy

Website waitlist

When you enter your email in this website’s waitlist form, we store your email address, signup time and privacy-policy acknowledgement in Supabase. This form saves your registration only. It does not subscribe you to launch emails or send a welcome email.

Earlier registrations may retain the launch-email consent given at that time and their welcome-email request status. Submitting this form does not change an existing registration’s consent or send another email.

To limit abuse, the website creates a keyed hash of your IP address and keeps a temporary request counter. The waitlist database does not store your raw IP address. You can request removal using the privacy contact below. Joining the waitlist does not create a Milely app account.

01Overview

This Privacy Policy explains how Milely (“Milely”, “we”, “us” or “our”) collects, uses, discloses and protects personal data when you use our mobile application, website and related services (collectively, the “Services”). It is intended to reflect Singapore’s Personal Data Protection Act 2012 (“PDPA”).

By using the Services, you acknowledge the practices described here. Where consent is the appropriate legal basis, you may withdraw it by contacting us, subject to reasonable notice and any legal or operational consequences we explain to you.

02Information we collect

Information you provide

• Account information, such as your name, email address and sign-in provider.
• Card profile information, such as bank, card product, nickname, cardholder name and last four digits. We do not ask for full card numbers, CVVs or online banking passwords.
• Transaction information, including merchant, amount, date, category, currency, payment channel, selected card, reimbursements and notes.
• Receipt images and details extracted from them when you choose to use receipt scanning.
• Shared-wallet information, including invitations, member roles and activity visible within a wallet.
• Messages or information you send when requesting support.

Information collected automatically

• Device, operating system, app version, language and limited diagnostic information.
• Security and usage events needed to authenticate users, prevent abuse, maintain the Services and understand feature performance.
• Website information such as approximate location derived from IP address, browser type and pages viewed, where analytics are enabled.

03How we use information

We use information for purposes that include:

• Providing accounts, card tracking, transaction history, cap calculations, reward estimates, recommendations, shared wallets and exports.
• Recognising receipt text on supported iOS devices and presenting extracted details for your review, with manual entry when recognition is unavailable.
• Authenticating users, responding to support requests and communicating service or security updates.
• Protecting accounts, detecting misuse, troubleshooting errors and improving reliability.
• Analysing aggregated or de-identified usage to improve features and product decisions.
• Meeting legal obligations and enforcing our Terms of Service.

Milely’s calculations and recommendations are estimates. Banks and card issuers determine actual eligibility and rewards.

04When we share information

We do not sell personal data. We may disclose information:

• To service providers that support hosting, authentication, database storage, analytics, communications and error monitoring, under appropriate contractual protections.
• To members of a shared wallet, only as required to provide shared activity and cap visibility. Private transaction controls may limit what other members see.
• When you direct us to export or otherwise share information.
• Where required by law, court order or regulatory request, or where reasonably necessary to protect rights, safety and the integrity of the Services.
• In connection with a merger, financing, acquisition or sale of assets, subject to appropriate confidentiality measures and notice where required.

Sign-in services offered by Apple or Google process information under their own privacy terms. Our infrastructure providers, including Supabase and their underlying subprocessors, may process data on our behalf.

05International transfers

Some service providers may process information outside Singapore. Where the PDPA applies, we will take reasonable steps to ensure transferred personal data receives a standard of protection comparable to that under the PDPA, including through contractual or other legally recognised safeguards.

06Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, to provide your account, resolve disputes and meet legal or legitimate business requirements. Retention periods depend on the type of information and why it is held. When information is no longer required, we will delete it or make it no longer associated with an identifiable individual, subject to backup and legal retention cycles.

07Security

Receipt processing

In the current app, receipt text recognition runs on your iPhone using Apple’s on-device Vision framework when available. On Android, the web, or when recognition is unavailable, you enter the details manually. Receipt images, recognised text and extracted financial details are encrypted on your device before being uploaded to Supabase for storage. The current receipt flow does not send receipt images or text to Google Gemini or another cloud AI processor. The earlier server-side Gemini receipt flow has been retired.

Encrypted storage and its limits

Milely’s current app encrypts new financial records and receipt files on your device before upload. This includes transaction details, saved-card details, reward settings and Auto Log purchase details. On iPhone and Android, the key used to unlock that content is kept in device-protected storage. Milely stores an encrypted recovery backup, but not the recovery key you are asked to save.

This protection is selective. Account details and service metadata—including your email, display name, wallet membership, record type, timestamps and routing information—remain available to the services that operate Milely. People you invite to a shared wallet can decrypt the shared records for which they receive a wallet key. On the web, saved keys depend on the security of the browser profile and website origin.

No service can guarantee absolute security. Keep your device, sign-in credentials and recovery key secure, and contact us promptly if you suspect unauthorised access. See Data protection at Milely for a plain-language explanation of these safeguards and limits.

08Your choices and rights

Subject to applicable law and any permitted exceptions, you may request access to personal data we hold about you, ask us to correct inaccurate data, withdraw consent, or request account deletion. You may also manage certain information directly in the app and choose whether to use optional receipt scanning, notifications or shared-wallet features.

To make a request, contact privacy@milely.app. We may need to verify your identity. The Singapore Personal Data Protection Commission provides more information about individual privacy rights under the PDPA.

09Children

The Services are not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us so we can take appropriate action.

10Changes and contact

We may update this Policy as the Services or legal requirements change. We will post the updated version, revise the “Last updated” date and provide additional notice when a change is material.

Questions, requests or complaints may be directed to our Data Protection contact at privacy@milely.app.