Privacy policy
Effective October 29, 2026 ยท Last updated October 29, 2026
1. Who we are and what this policy covers
Millwren LLC ("Millwren," "we," "us") makes cloud software for accounting firms. This policy explains how we collect, use, share, and protect personal information through our website (millwren.com), our software and APIs (the "Services"), and our communications with you.
We handle personal information in two roles:
As a business. We decide how to use information about visitors to our website, people who contact us, and the people at our customer firms who use and pay for the Services. This policy governs that information.
As a service provider. Our customers (accounting firms) store information about their own clients and staff in the Services, such as names, contact details, financial records, and Social Security numbers ("Customer Data"). We process Customer Data only on our customers' behalf and according to our contracts with them. Each firm's own privacy policy governs how it uses that information. If you are a client of a firm that uses Millwren, please contact that firm about your information.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Contact and account information | Name, firm name, job title, email, phone, sign-in credentials | You, or your firm's administrator |
| Billing information | Billing contact and address, subscription details. Card details go directly to our payment processor, Stripe; we never see or store full card numbers. | You and Stripe |
| Usage and device information | Pages and features used, sign-in times, IP address, browser and device type, error logs | Automatically, through the Services and our website |
| Proposal engagement | When a firm's client opens, views, or signs a proposal sent through the Services | Automatically, on the firm's behalf |
| Communications | Messages, support requests, and feedback you send us | You |
| Customer Data | Information firms store about their clients and staff, including financial information and Social Security numbers | Our customers (see Section 1) |
3. How we use information
We use the information we collect to:
Provide, maintain, secure, and support the Services.
Create and manage accounts, and bill for subscriptions.
Show firms when their clients view or sign proposals, as part of the Services.
Detect, investigate, and prevent fraud, abuse, and security incidents.
Improve the Services, using usage information that does not include the contents of Customer Data.
Send service notices, and, if you are a business contact, occasional product updates you can opt out of at any time.
Comply with law and enforce our agreements.
We use Customer Data only to provide the Services to the firm that supplied it, as our contract with that firm allows.
Cookies and similar technologies. We use cookies that the Services need to work, such as keeping you signed in and protecting against forged requests. On our website we use Cloudflare Web Analytics to count visits and see which pages are used. Cloudflare designs it to work without cookies, fingerprinting, or tracking you across other sites. We do not use advertising cookies or pixels, and we do not track you across other companies' websites. Because we do no cross-site tracking, our website treats browsers the same whether or not they send a Do Not Track signal. You can block cookies in your browser settings, but parts of the Services will not work without essential cookies.
4. How we share information
We do not sell personal information, and we do not share it for targeted advertising.
We share personal information only:
With service providers that host, secure, and run the Services for us, under contracts that require them to protect it and use it only for our instructions. These include Neon (database hosting), Inngest (background processing), Cloudflare (network and security), Microsoft (email and identity), and Stripe (payments).
Within your firm, as your firm's administrators configure the Services.
When the law requires it, such as a valid subpoena or court order, or to protect the rights, safety, or property of our customers, Millwren, or others.
In a business transfer, such as a merger or sale of Millwren, where the information stays subject to this policy.
With your consent, or at your direction, such as an integration your firm turns on.
No AI training. We never use Customer Data to train artificial intelligence or machine learning models, and we never use it for marketing.
5. Security, data location, and retention
Security. We follow a written information security program. Information is encrypted in transit and at rest, Social Security numbers are encrypted separately with their own keys, and every account that can reach customer information requires multi-factor authentication. No system is perfectly secure, but if a breach affects your information, we will notify the affected firm, or you, as the law and our contracts require.
Data location. We store and process all Customer Data, including backups, in the United States.
Retention. We keep account and billing information while your firm's account is active and afterward as long as we need it for tax, legal, and accounting purposes. We delete or return Customer Data within 90 days after a firm's subscription ends, unless the firm's contract or the law requires otherwise. Security logs are kept for at least one year.
6. Your choices and rights
Account information. You can update your profile in the Services or ask us to correct or delete it.
Marketing emails. Every marketing email has an unsubscribe link. Service notices, such as security and billing messages, continue while you have an account.
Customer Data. If your information is in the Services because a firm stored it, please send requests to that firm. We will help the firm respond as our contract requires.
State privacy rights. Depending on where you live, including California and other states with privacy laws, you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, and opt out of its sale or use for targeted advertising (we do neither). You may use an authorized agent.
To make a request, email us at the address in Section 7. We will verify your identity before acting and respond within 45 days, as these laws require. We will not treat you differently for exercising your rights.
7. Children, changes, and contact
Children. The Services and our website are for businesses and are not directed to children. We do not knowingly collect personal information from children under 13 for our own purposes. Firms may store information about their clients' dependents as Customer Data, which we handle only on the firm's behalf.
Changes. We review this policy at least once a year and update it when our practices or the law change. We will post any change here with a new "Last updated" date, and we will notify customers by email at least 30 days before a material change takes effect.
Contact us. Questions or requests about this policy:
Millwren LLC
Email: privacy@millwren.com