Privacy policy
What we collect, who handles it and how to get it deleted. Draft until Milvey opens.
What we collect today
| Data | How it’s used |
|---|---|
| Who is responsible | Digitalize Plus Enterprise, SSM 202303050800 (JR0144285-P), Unit 3A-07, Tower A, The Vertical Business Suite, 8, Jalan Kerinchi, Bangsar South, 59200 Kuala Lumpur, Malaysia. |
| Email list | Your email and the page you joined from go to Loops, our email provider. We use them to tell you about Milvey. Every email has an unsubscribe link. |
| Bot check | When you join the email list, send a report or claim free credits, Cloudflare Turnstile checks that a person sent it. Cloudflare receives technical details from your browser, such as your IP address, to run the check. |
| Reports | What you send on the report page, and your email if you give it, so we can act on it and reply. We keep a report and what we did about it after the case closes. |
| Request limits | We count requests with a keyed one-way code made from your IP address, so we can stop abuse. Each count is removed once its time window ends. |
| Site visits | Cloudflare hosts the site and handles technical request data, such as IP address, browser and page, to serve it and keep it secure. |
| Workflows | A ComfyUI JSON you open on this site is read in your browser only. |
| Cookies and analytics | This site uses no analytics or advertising cookies. |
Last updated 6 Nov 2026. See also the terms and refund policy.
What we’ll collect when accounts open
| Data | How it’s used |
|---|---|
| Account | Your email and login details, including your Google profile if you sign in with Google. A login cookie keeps you signed in. |
| Scrambled email | When you claim free credits we keep a one-way scrambled copy of your email, so each person gets them once. It stays after you delete your account, and it can’t be turned back into your address. |
| First-run answers | What you want to do first, what you make and how you heard about us, if you answer. We use them to set up your first screen and learn where people find us. They’re deleted with your account. |
| Safety records | When our check or a supplier refuses a run, we record the model, the time, the reason and any rule it matched, linked to your account. We don’t store a prompt our check refuses. If you delete your account, these records stay with no person attached. If we block an account, its owner can’t delete it and needs to email us. |
| Your work | Prompts, uploads, workflows and outputs, so we can run your jobs and show you the results. |
| Usage and credits | Runs, credit movements and spend, so we can bill you correctly and fix problems. |
| Payments | Stripe collects your card details. We never see the full number. We keep the payment record, amount and date. |
None of this is collected yet.
Who handles your data
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting, bot check, file storage | Global |
| Loops | Email list and product email | United States |
| Supabase | Database and login | Singapore |
| Stripe | Payments | Global |
| Sign-in and our own email | Global | |
| GPU and model suppliers | Run your jobs. They receive the prompts and files that job needs | Depends on the model |
Keeping, deleting and your rights
| Topic | Policy |
|---|---|
| Moving data abroad | Some of these providers are outside Malaysia, so your data can be processed in other countries. We only send what each one needs to do its job. |
| How long we keep it | Email list details stay until you unsubscribe or ask us to remove them. Outputs in a project or starred stay until you delete them or your account. Other outputs and your uploads are deleted after 30 days. Account data stays until you delete your account. Payment records stay as long as tax law requires. |
| Your rights | You can ask to see, correct or delete your data, or withdraw your consent. Email hello@milvey.com and we’ll reply within 21 days. Deleting an account also removes its uploads and outputs, but not payment records we must keep. |
| If you’re in Malaysia | The Personal Data Protection Act 2010 protects your data, and you can complain to the Personal Data Protection Commissioner. |
| Children | Milvey is for people aged 18 or older. If you think a child has given us their data, tell us and we’ll delete it. |
| Security | Data is encrypted in transit, and payment and supplier keys stay on the server. If a breach puts you at risk, we’ll tell you and the authorities as the law requires. |
| Changes | We’ll update the date on this page, and email you first about a big change. |