HeyMilton

Privacy Policy

Last updated: September 2026

HeyMilton (“Milton,” “we,” “us”), operated by Belocalone, is a personal work-and-life operating system. This policy explains what data Milton accesses, how it is used, how AI processing works, how long we keep it, and the controls you have. It describes Milton’s actual behavior, not a generic template.

Google Workspace access & the scopes we request

When you connect your Google account, Milton requests exactly these scopes, each for a specific purpose:

  • openid, userinfo.email, to identify your account and show which mailbox is connected.
  • gmail.modify, to read your messages so Milton can triage, summarize, and extract commitments; to create drafts; to send replies you approve; and to apply labels or archive at your request. Milton does not permanently delete your mail.
  • calendar.events, to read events for scheduling context and to create or update events you approve.
  • calendar.readonly, to read event details for availability and daily briefings.
  • drive.file, to attach or save only the specific files you create or open with Milton. Milton cannot see the rest of your Drive.
  • chat.spaces.readonly, chat.messages.readonly, chat.messages.create, to list your Chat spaces, read recent messages for briefings, and post replies you approve.
The use of information received from Google Workspace scopes will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How AI processes your messages

To triage your inbox, summarize threads, extract action items, and draft replies, the relevant message text and headers are sent to AI language models for processing:

  • Anthropic (Claude) claude-sonnet-4-6, accessed through Emergent’s Universal Key infrastructure, is the primary model. It performs triage, summarization, commitment extraction, and drafting, and it powers the conversational “Ask Milton” assistant. Your Gmail message bodies are processed here and are pinned to this Anthropic lane, never sent to any other model.
  • If the primary model is unavailable, frontier requests fail over to OpenAI (gpt-5.4) or Google (Gemini) (gemini-2.5-flash). These fallbacks may receive your workspace context (Google Calendar events and your contacts’ names and roles) to answer a question, but never your Gmail message bodies.
  • A NVIDIA NIM model (meta/llama-3.2-11b-vision-instruct) handles high-volume background system work only (such as routing and classification). It never receives your Gmail message bodies.

This roster is read live from the running configuration, so it always reflects the models the product actually uses.

This processing is transient, content is sent to generate the specific result you asked for and is not used to build advertising profiles. Your data is not used to train general AI models. Data is encrypted in transit (TLS) and at rest (AES-256) and is processed in the United States and India. We do not sell your data.

Relationship enrichment (optional, off by default)

Milton can build a private contact graph to help you keep track of who you work with. This feature is off by default and is enabled per connected account only after you explicitly turn it on. When enabled, Milton extracts:

  • Business-card details a sender includes in their own email signature, name, job title, company, department, and office/main phone.
  • Relationship signals from explicit metadata, people shared on the same thread, co-attendance on the same calendar event, and shared company domains.

Milton does not harvest personal cell numbers, messaging handles, or personal email from message text. When the relationship engine is active, unconfirmed enrichment about third parties will be deleted after 90 days without any interaction, pruned field-by-field (your own correspondence history is never deleted to do this). You can turn the feature off at any time and choose to purge everything already collected.

Forwarding & paste intake

You may forward emails to a private, rotatable @in.heymilton.app address, or paste text into Milton. Messages from addresses that are not on your allow-list are quarantined and shown to you for one-tap approval, never silently dropped, never auto-filed, and never fed to the AI until you promote them. Milton treats all forwarded and pasted text strictly as data, never as instructions. You can rotate or kill your forwarding address instantly from Settings.

Service providers (subprocessors)

  • Emergent, application hosting and AI request routing (Universal Key).
  • Anthropic (Claude), OpenAI, Google (Gemini), NVIDIA NIM, AI model inference, as described above.
  • MongoDB, encrypted data storage.
  • Google, the source of Gmail, Calendar, Drive-file, and Chat data you connect.
  • GoHighLevel and Slack, only if you choose to connect them.

What we store, and for how long

Milton reads mail on demand and does not create a permanent copy of your entire mailbox. We retain only what a feature needs, triage results for the current window, commitments you keep, contacts you approve, and connection tokens (encrypted). Disconnecting Google revokes Milton’s access and stops all reading.

Your controls

  • Disconnect Google at any time from Settings (also revocable at your Google Account permissions page).
  • Per-contact export and hard delete, export or permanently delete any contact and all enrichment tied to it.
  • Rotate or disable your forwarding address instantly.
  • Turn off enrichment and purge collected data.

Contact

Questions or data requests: privacy@heymilton.ai.

See also our Terms of Service.