Milo listens to sales and recruitment conversations in order to coach the people having them. That is unusually sensitive, so this policy sets out plainly what is collected, where it goes, who can see it and how long it is kept — without the hedging that normally makes these documents unreadable.
Milo is a product of Landmark Learning Group Ltd ("Milo", "we", "us"), a company registered in England and Wales.
Landmark Learning Group Ltd
Company number 16636416
Registered office: 111 High Street, Strood, Rochester, England, ME2 4TJ
Contact: matt@ask-milo.ai
We provide an AI coaching platform for sales and recruitment teams, comprising a desktop
application, web applications at ask-milo.com and its subdomains, and supporting
services. This policy covers that platform and this website.
This distinction decides who you ask for what, so it is worth two sentences.
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Name, work email, employer/organisation, job role, team, permissions and role assignments | Your employer, or you at sign-up |
| Authentication | Sign-in events, session tokens, and — where Microsoft single sign-on is used — the identifiers your identity provider returns | You; your identity provider |
| Call audio | Recordings of calls captured under your employer's configuration | Your device |
| Transcripts | Text of recorded calls and of what you say to Milo | Derived from audio |
| Coaching data | Scores, competency assessments, feedback, goals, role-play sessions, questions you ask Milo and its answers | Generated by the platform |
| Usage telemetry | Which features are used and when, session length, engagement — used to improve the product and to show managers adoption | The applications |
| Diagnostics | Error reports and, where you submit one, a bug report including the context you choose to attach | The applications; you |
| Knowledge content | Documents, transcripts and other training material your administrators upload or import | Your administrators |
| Website | Email address if you join a waitlist or contact us; server logs including IP address | You; your browser |
Calls in sales and recruitment routinely mention third parties — candidates, clients, colleagues. Those people's details will appear in recordings and transcripts. Responsibility for telling them, and for having a lawful basis to record them, sits with the customer operating Milo, not with Milo.
Recording is controlled by the customer, not by us, and not by default. An administrator at your employer configures whether Milo records at all, which applications it may record from, and whether particular call types are recorded or blocked. We do not switch recording on for anyone.
Recording law is the customer's responsibility. Notifying participants and obtaining any consent required in the relevant jurisdictions is a legal obligation of the organisation doing the recording. Milo provides the controls; it cannot know what the law requires of you.
The desktop application detects that a call is in progress by observing which application holds the microphone. It does not read the contents of your other applications, your screen, your files or your keystrokes.
The "Hey Milo" wake word is detected on your device. Audio is processed locally to decide whether the wake word was spoken, and short spoken commands are transcribed locally. Audio that is not part of a recorded call or a deliberate interaction with Milo is not transmitted or retained.
We do not sell personal data. We do not share it with advertisers, and we do not use it for advertising or profiling unrelated to the service.
Milo's speech recognition and language models run on infrastructure we operate ourselves, in the region described below. Call audio, transcripts and coaching content are not sent to third-party AI providers for processing.
The one exception is synthesised speech: when Milo speaks aloud, the text of what it is about to say may be sent to a third-party voice provider to be converted into audio (see section 9). That text is the coaching Milo is delivering, not your call recording.
We do not use customer content to train generalised AI models, and we do not permit our providers to do so. Models are improved using our own materials and aggregated, de-identified signals, not by feeding one customer's conversations into a model that serves another.
Automated scoring produces assessments of conversations that a manager may see. These are coaching aids, evaluated and acted on by people. Where an employer chooses to use them in decisions that significantly affect an individual, that is the employer's decision to make lawfully and to explain.
Administrators may optionally connect a Google account so that Milo can import training material from YouTube into their knowledge base. This section describes that specific integration, and applies only where an administrator has explicitly connected an account.
youtube.readonly, plus openid
and email so the connected account can be identified in our interface. This
is read-only: it cannot change, upload or delete anything on the
account.Milo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
An administrator can disconnect the account at any time in Milo, which revokes our token with Google and deletes it from our systems. You can also revoke access directly at myaccount.google.com/permissions. Material already imported and reviewed remains in the knowledge base until deleted there.
Where we act as controller:
| Purpose | Lawful basis |
|---|---|
| Operating this website and keeping it secure | Legitimate interests |
| Responding to your enquiry | Legitimate interests, or steps prior to a contract |
| Waitlist and product updates by email | Consent — withdrawable at any time |
| Providing the platform to a customer | Performance of our contract with that customer |
| Meeting legal and regulatory obligations | Legal obligation |
Where we act as processor, the lawful basis for processing employee and call data is determined by the customer as controller.
We use a small number of sub-processors. We do not add one without a contract requiring protection at least equivalent to our own commitments.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, databases, email delivery | United Kingdom (London region) |
| ElevenLabs | Text-to-speech — converting Milo's spoken coaching into audio | United States |
| Microsoft | Single sign-on, where a customer chooses to use it | Per the customer's own Microsoft tenant |
| YouTube knowledge import, only where an administrator connects an account (section 7) | United States |
We may also disclose data where we are legally required to, to establish or defend legal claims, or to a successor in connection with a merger or acquisition — in which case this policy continues to apply until you are told otherwise.
Within a customer's organisation, access follows the roles that customer configures. Managers and administrators can see the coaching data of the people they manage. Customers are strictly separated from one another: each customer's data is held in its own database, and no query crosses that boundary.
Core processing — recording, transcription, scoring, coaching and storage — takes place in the United Kingdom. Where a sub-processor is outside the UK or EEA (see the table above), transfers are made under the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or another lawful transfer mechanism.
| Data | Retention |
|---|---|
| Call recordings, transcripts and coaching data | For the period the customer configures, and in any case no longer than their agreement with us permits |
| Account records | For the life of the account, then deleted or anonymised |
| Usage telemetry and diagnostics | Retained in identifiable form for as long as it is useful for support and product work, then aggregated |
| Website and waitlist contacts | Until you ask us to remove you, or the enquiry is closed |
| Server logs | A short operational period, for security and troubleshooting |
On termination, customer data is deleted or returned in line with the customer's agreement. Backups are cycled out on their normal schedule.
No system is perfectly secure. If a breach affects your data we will notify the customer and, where the law requires it, the relevant supervisory authority and affected individuals, without undue delay.
Under UK and EU data protection law you have the right to access your data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent where processing relies on it.
If you are an employee of a Milo customer, exercise these rights with your employer — they are the controller, and we are required to act on their instructions rather than to release their data to individuals directly. Send anything else to matt@ask-milo.ai. We respond within one month.
You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). We would rather you raised it with us first.
This website uses only what it needs to work: a session cookie where you sign in, and security cookies such as cross-site request forgery protection. We do not use advertising or cross-site tracking cookies. The Milo applications use equivalent local storage to keep you signed in and to remember your preferences.
Milo is a workplace tool sold to organisations and is not directed at children. We do not knowingly collect data from anyone under 16.
We will update this page when our practices change, and update the date at the top. Where a change materially affects how we handle personal data, we will tell affected customers directly rather than rely on you noticing.
Privacy questions, data requests and complaints: matt@ask-milo.ai
By post: Landmark Learning Group Ltd, 111 High Street, Strood, Rochester, England, ME2 4TJ.