Privacy policy

1. Who we are

Milo is operated by Winning Sales, a Brazilian company. Legal name: Winning Sales LTDA, Brazilian company registration (CNPJ) 54.144.552/0001-00. For your account data and your use of the product, Winning Sales is the controller under the Brazilian data protection law (LGPD, Law 13.709/2018).

Milo is built for businesses. People who use the product act on behalf of the company they work for, which we call the Customer here. Each person belongs to one workspace of that company. An admin can invite teammates.

For third-party data the Customer brings into Milo (for example, its leads and customer contacts), the Customer is the controller and Winning Sales is the processor (LGPD "operador"). In that case we process the data only to fulfil the Customer's requests.

Questions about this policy: suporte.milo@winningsales.com.br.

2. What data we process

We process the groups of data below.

• Account data: name, e-mail and the role or seniority given at onboarding
• Company context: description, offerings, personas, brand and tone of voice, given by you or read by Milo from the company's public website and public sources during onboarding
• Uploaded documents: PDF, DOCX, XLSX, PPTX and image files you upload, and files you bring from a storage service you connect
• Conversations and runs: the messages exchanged with Milo, agent runs and the outputs generated
• Authorized connections: read-only access to third-party systems, such as CRM and file storage, that an admin or the person authorizes through an integration provider
• Usage data: navigation and product usage events, collected by a product analytics tool
• Public site data: campaign parameters (UTM) and first-party measurement cookies, described in section 7
• Billing data: handled by our payment processor. We never store card numbers
• Support: e-mails and messages you send us

3. Why we process it and on which legal basis

We use each group of data for a clear purpose, always on a legal basis from the LGPD (art. 7).

• Performance of the contract (art. 7, V): creating and keeping your account, building the company context, answering your requests, running agents, storing conversations and documents, billing the plan
• Legitimate interest (art. 7, IX): keeping the service secure, preventing fraud and abuse, measuring and improving the product with usage data, providing support
• Consent (art. 7, I): campaign measurement cookies on the public site, which you can refuse at any time
• Legal obligation (art. 7, II): keeping tax and billing records for the period the law requires and complying with orders from authorities

4. AI processing and model providers

Milo generates answers with artificial intelligence models. To answer a request, we send the model providers only the content that request needs: the question, the relevant company context and the excerpts of documents or connections the request requires.

AI providers engaged by Winning Sales run the models and process that content under the contracts and terms of each service.

Winning Sales may use anonymized or aggregated data, which identifies neither you nor your company, to improve Milo, including the AI models it uses. Data you bring from connected systems is used only to fulfil your requests.

What Milo knows about your company is visible, editable and deletable by you at any time in the settings.

Outputs are generated by AI and may contain errors. Review them before use.

5. Who we share data with

We do not sell personal data. We share data only with providers in the categories below, to the extent needed to operate Milo, and with authorities when the law requires it. You can request the current list of providers at suporte.milo@winningsales.com.br.

6. International transfer

Your account data, the company context, documents and conversations are stored in Brazil, in the São Paulo region of our cloud infrastructure providers.

Some providers process data outside Brazil, mainly in the United States: the AI models that generate the answers, payments, usage analytics, e-mail delivery and the connections to third-party systems, as the table in section 5 shows. Under the LGPD this is an international data transfer.

We make this transfer under art. 33 of the LGPD, through contractual clauses with each provider and adequate safeguards for security and for your rights.

7. Cookies and analytics

Inside the product we use cookies needed to keep your session and preferences, and a product analytics tool to understand how the product is used. This data helps us fix problems and improve Milo.

On the public site (the home page and the sign-in screen) we use tag management tools and advertising platform pixels to measure marketing campaigns. We keep campaign parameters (UTM) and the first-party cookies _fbp, _fbc, ws_ft and ws_lt, which record the source of the first and the latest visit.

How to refuse: block or delete cookies in your browser settings, or use private browsing. Blocking measurement cookies does not affect how Milo works. The product behind the sign-in does not load these campaign measurement tools.

8. How long we keep data

We keep your data while your account exists and, after that, only for the period the law requires. Tax and billing records are kept for 5 years. Security event logs are kept for a limited period.

You can delete your own account in the settings. When you do, your conversations, runs and personal files are deleted. When you leave a workspace, your personal connections are removed.

Backups are purged on their normal rotation schedule. Until then they stay protected and are not used for any other purpose.

9. Your rights and how to exercise them

The LGPD (art. 18) gives you the rights below. We will answer within 15 days.

• Confirm whether we process your data and access it
• Correct incomplete, inaccurate or outdated data
• Request anonymization, blocking or deletion of data that is unnecessary or processed unlawfully
• Request the portability of your data
• Know who we share your data with
• Withdraw a consent you gave
• Delete your account

10. Security

We protect data with encryption in transit, access controls, workspace isolation in the database (every row belongs to one workspace) and an audited log of every operator access.

If a security incident may cause risk or harm to you, we will notify the affected Customers and, when the law requires it, the Brazilian data protection authority (ANPD).

11. Under 18

Milo is a product for businesses and is not directed at people under 18. We do not create accounts for minors. If we learn that we collected data from a minor, we will delete it.

12. Changes to this policy

We may update this policy when the product or the law changes. The date at the top shows the current version. If a change is material, we will notify you by e-mail or inside the product before it takes effect.

This policy exists in Portuguese, English and Spanish. If the versions differ, the Portuguese version prevails.

13. Contact

To exercise your rights or ask a question, write to suporte.milo@winningsales.com.br or use your account settings. This is also the channel of our data protection officer.