Privacy Policy

Milli is an accounting service. That means we handle some of the most sensitive information you have: your financial records, your tax identifiers, your identity documents. This page explains exactly what we collect, why, where it lives, and your rights over it - in plain English, because a privacy policy nobody can read protects nobody.

Who we are

Milli (“we”, “us”) is a trading name of Dotsytine Consulting Ltd, a company registered in England & Wales under number 06888782. That company operates trymilli.com and is the data controller for the personal data described here. Contact: hello@trymilli.com.

What we collect

• Account details - your name and email address.
• Business identity - business structure, company name and number, tax references (UTR, VAT number), Companies House authentication code. These are needed to prepare and file on your behalf.
• Financial records - the bank statements, receipts and invoices you upload, and the transactions we extract from them.
• Identity documents - the photo ID you provide for the identity check the law requires of accountants (Money Laundering Regulations 2017).
• Your conversations with Milli - the chat is how the service works; conversations are retained as part of your client file and reviewed by our accountant team where needed.
• Payment details - held by Stripe, our payment processor. We never see your card number.

Why we process it (lawful bases)

• To provide the service (contract): preparing your books, computations and filings.
• Because the law requires it (legal obligation): identity verification under the Money Laundering Regulations, and statutory record-keeping for accounting and tax.
• To run and protect the service (legitimate interests): security monitoring, audit trails, preventing abuse, and improving how Milli works.

AI processing - stated plainly

Milli is an AI-native practice. Your conversations and documents are processed by AI models (provided by Anthropic) to do the work - reading statements, categorising transactions, preparing filings - always under the supervision and review of our accountant team, and nothing is submitted to HMRC or Companies House without a recorded human approval. Our AI provider processes data under contract to deliver the service and does not use your data to train its models. Every AI action on your file is logged with full provenance - what was done, by what, based on which inputs.

Where your data lives and who touches it

Your data is stored with Supabase in London (UK). The service runs on Vercel, also served from London. We use a small set of processors, each under a data processing agreement: Supabase (database and document storage), Vercel (hosting), Anthropic (AI processing), Stripe (payments), and Resend (transactional email). Where a processor is US-based, transfers are protected by recognised safeguards (the UK extension to the EU-US Data Privacy Framework or standard contractual clauses). We look up public company information from the Companies House API. We never sell your data, and there is no advertising tracking anywhere in the product.

How long we keep it

Accounting and tax records must be kept for statutory periods - generally six years after the end of the accounting period they relate to. Identity verification records are kept for five years after our relationship ends, as the Money Laundering Regulations require. If you close your account, we delete what we are not legally required to keep and tell you what must be retained and until when.

How we protect it

Encryption in transit and at rest; row-level security so each client can only ever reach their own records; role-based access for our team with a permanent audit log of every action; short-lived signed links for document access; rate limiting and lockouts on sensitive endpoints. More detail on our security page.

Your rights

You can ask for a copy of your data, ask us to correct it, delete it (subject to the statutory retention above), restrict or object to processing, or take your data elsewhere. Email hello@trymilli.com and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We use essential cookies only: the ones that keep you signed in. No advertising cookies, no cross-site tracking.

Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect.