This is a pre-launch draft, written to accurately describe how Milea actually works today. Milea is
currently built by an individual developer and is not yet operated through an incorporated company.
This document has not been reviewed by a lawyer and should be treated as a good-faith draft, not final
legal advice, until it is.
Who we are
Milea is a mobile app that helps freelancers in the EU track business expenses and mileage, and prepare
those records for tax filing. Milea is not a licensed tax, legal, or financial advisor. Nothing in the
app or this policy is tax advice.
What data we collect
Account data: the email address and your name (first name, and a last name if you give one) you register or sign in with
(including via Google or Apple sign-in), your selected country and tax regime, an optional
age, occupation (chosen from a fixed list), experience filing taxes (chosen from a short list) and an EU VAT number if you choose to enter them (when you set up your account or later in Settings → Edit profile; you can skip them or remove them at any time), and your
subscription status. A VAT number you enter is sent to the EU's public VIES service to check it. While you add it, we show you the
business name VIES has registered for it so you can confirm it is yours, and our server compares that name with your own; we store
the number, the result of that check and the registered business name and address VIES shows for it, so we can find your account if you contact us. If you add a VAT number, Milea prints it on the PDF exports you create.
Records you create: expenses (vendor, amount, VAT, category, date), trips (origin
and destination addresses, distance, purpose), income entries, clients you tag records to, and any
corrections you submit after a record is locked.
Receipt photos: when you tap "Extract data from image" on a receipt photo, the photo is read
to extract the vendor, amount, date and VAT. Nothing is read unless you tap it. The image is stored in your account only once you save
the expense.
Addresses and routes: addresses you type for a trip are looked up, and a driving
route is calculated, to work out the distance. Milea does not track your location in the
background.
Notification tokens: if you allow notifications, an identifier for your device so
reminders can reach it.
Feedback: messages you choose to send from inside the app.
Usage and diagnostics: basic app usage events (which features you use and whether
an action worked, never what you typed), the date you last opened the app, and crash/error reports,
used to keep the app working, fix problems and understand how the app is used. For each day you open
the app we also keep a short record that you were active that day, with your plan, country and
platform; these day records are deleted after 400 days. We note which version of Milea you use and the
major version of your phone's operating system (for example "17"), so we can fix problems on particular
versions.
Where you came from: when you install Milea, we record which campaign or link led
you to the app (for example an advertisement, or an invitation from a colleague) as a few short labels
on your profile. We do not read your advertising identifier and do not ask for tracking permission.
If you use "Invite a colleague", the link you share contains a short code derived from your account
that cannot be turned back into your account number. If you were invited, you can enter the inviter's
code when you set up your account (or install through their link on Android, or open it in the web app); we then record which
account invited yours, so we can see how invitations spread. This is visible only to us, never to the
other person.
Milea in your browser: the web app at app.milea.pro runs the same app in your browser
and stores your data in your browser's own storage on your computer, as well as in your account like on
your phone. When you arrive through a campaign or invitation link, the few short labels in that link
(for example the campaign name or an invitation code) are kept in your browser until your account is set
up, then recorded on your profile as described above and removed from the browser. We do not use
advertising cookies. Reminders are sent only by the iOS and Android apps.
Why we collect it
To provide the core service (recording and organizing your expenses/trips for filing), to calculate
mileage and VAT figures using the rates for your selected country, to send the reminders you turn on,
and to manage your subscription. If you choose to enter your age, occupation or experience filing taxes, we use them only to understand who uses Milea and what to explain first:
the age is turned into a broad band (such as 25–34) in our app analytics, the occupation and experience are the fixed choices you picked and never free text,
none of them is used for advertising, and none is shared
beyond the service providers listed below. Financial records
are also retained to meet the record-keeping periods required by tax law in your selected country. Once
a month, we also aggregate the deduction rates users have set for each expense category, per country, to
improve the suggested default rates Milea offers. This produces only anonymised, country/category-level
totals (no individual user's data is identifiable in the result), and groups smaller than 20 users are
excluded entirely.
Where your data is stored
Records are stored locally on your device and synced to Google Firebase (Firestore, Cloud Storage
and Cloud Functions), hosted in the EU (europe-west3, Frankfurt). Milea is designed to work offline-first, with
your device holding a full local copy of your records.
Who we share data with
We use the following service providers to run Milea. They process data only to provide their service to us:
Google Firebase: hosting, authentication, database, file storage, push
notifications, app analytics and crash reports (Firebase Crashlytics).
Google Gemini API: reads the receipt photos you scan to extract their details.
Google Maps Platform: looks up trip addresses and calculates routes.
Sentry: also receives crash and error reports so we can fix bugs.
Apple and Google Play: process payments for paid plans bought in the iOS and Android apps. Milea receives
your subscription status, not your card or payment details.
Paddle: our merchant of record for purchases on the web (app.milea.pro). Paddle
collects your payment details, billing country and email, charges the right VAT, issues your invoice
and handles refunds, under its own privacy policy.
Milea receives your subscription status and the amount, currency, tax and country of each payment, not
your card details.
Google / Apple: only if you choose to sign in with those providers.
We do not sell your data, and we do not share it with anyone else.
Data retention
Financial records (expenses, trips, filing periods) are retained for the period required by the tax
authority of your selected country, even if you ask us to delete your account. This is a legal
requirement, not a choice Milea makes. So that those records stay identifiable as yours, we also keep your
name and email address (and your VAT number, if you gave one) with them, for as long as the tax law requires, and delete them once that period
ends. Other account data not needed for that purpose (like your preferences) can be deleted on request.
That period is counted from the day you delete your account. When it ends we erase everything we still hold
for you automatically: your records, receipt photos, feedback messages, and your profile. We keep two
things after that: a record of your paid subscription and top-up purchases (store reference, plan, amount and
date, tied only to an account number, with no name or email), which we need for our own accounting, and a short
note that an account was deleted (its country, plan and dates, with no name or email), used only for
statistics about how the app is used.
Your rights
If you're in the EU, you have the right to:
Access the personal data we hold about you.
Correct inaccurate data.
Export your data: the app's built-in Export feature lets you download your full records as a CSV
or PDF at any time.
Request deletion of data that isn't subject to a legal retention requirement.
Object to processing, and lodge a complaint with your local data protection authority.
Security
Data in transit is encrypted (HTTPS/TLS). Authentication is handled by Firebase Auth. Financial records
are locked at the database level once a filing period is submitted. After that point they can only be
amended by an appended correction, never overwritten.
Children
Milea is not directed at children and is not intended for use by anyone under 18.
Changes to this policy
If this policy changes, the "Last updated" date above will change with it.