Privacy policy
Privacy Policy
What we collect, why, who processes it for us, how long we keep it, and the choices you have. Written to be read, not skimmed past.
Where this applies
The hosted service currently runs in PayPal's sandbox: no real money moves and PayPal accounts connected to it are sandbox accounts. This policy will be reviewed by counsel before any live deployment, and we will announce changes as described under changes.
Who we are and what this covers
Milestone Ledger ("we", "us") is the hosted service at app.milestone-ledger.com, run by the maintainers of the open-source Milestone Disbursement Engine. This policy covers:
- this website (milestone-ledger.com, served from GitHub Pages),
- the web application and API at app.milestone-ledger.com, including the MCP server for agents,
- the emails we send from mail.milestone-ledger.com.
It does not cover other people's deployments of the open-source engine, or the services of PayPal, GitHub or your identity provider, each of which has its own privacy policy.
What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Your email address; sign-in and session tokens (stored as hashes); the name and email your organization's identity provider sends when you sign in with SSO | To sign you in and send you the links and notices the service depends on |
| Organization | Organization name; the PayPal email address and merchant id it connects; its members and their roles; API keys (stored as hashes); SSO configuration and verified domains | To know who may act for an organization, and where its money goes |
| Agreements | Titles, parties and their contact emails, tranches, amounts, acceptance criteria, the source document you upload for extraction, each party's confirmation of the criteria hash | To run the agreement: this is the product |
| Evidence and deliverables | Files and text you submit; previews; GitHub repository, pull request, commit and check data from repositories you connect; the pinned commit and handover records for withheld work | To verify tranches, hold deliverables until payment, and keep the record both sides rely on |
| Payments | PayPal order, authorization, capture, payout and invoice identifiers and statuses; amounts; dispute records PayPal sends us | To fund, settle and reconcile tranches. We never see card or bank details. |
| Verdicts and audit log | Each check result and verdict, with its citations, confidence, model and prompt version; an immutable log of every action, who took it and when; download records | So every decision can be explained and replayed, and so the compliance packet is complete |
| Technical | IP address, user agent and timestamps in server logs and rate-limit counters | Security, abuse prevention and debugging |
| Correspondence | Emails you send to our addresses; issues you open on GitHub | To answer you |
We do not collect anything on this website beyond what GitHub Pages logs to serve it (see cookies and local storage). There are no analytics, advertising or tracking scripts on the website or in the application.
How we use it
- To provide the service: create and sign agreements, hold and settle tranches through PayPal, verify evidence, hand over deliverables, and show each party what its role allows.
- To notify you: sign-in links, invitations, review requests, rejections with what is missing, pay links, overdue notices, payout and handover notices. These are part of the service, not marketing. We do not send marketing email.
- To keep the record: the audit log and compliance packets that funders, finance teams and auditors depend on.
- To keep the service safe: rate limiting, abuse prevention, debugging and security investigations.
- To meet legal obligations, including those that attach to payment records.
We do not sell personal data, and we do not use your data to train AI models.
AI processing
Two parts of the service use a large language model, Claude, through Anthropic's API:
- Extraction: when you upload a grant or statement of work, its text is sent to the model to propose tranches and criteria. You review and edit the proposal before anything is created.
- Verification: when evidence is submitted, the evidence text (and the text of uploaded documents) is sent to the model together with the criteria, and the model returns a structured verdict with citations. A second, skeptical pass may run before any automatic release.
Anthropic processes this data as our service provider under its commercial terms, which do not permit it to train models on it. The verdict stores the model and prompt version so the decision can be replayed. Deterministic checks (file present, tests green, numbers in range) run without a model. Nothing moves money on a verdict alone unless your organization has turned on automatic release above a confidence threshold it chose.
Who we share it with
The other parties to your agreement
An agreement is between organizations. The payer, the payee and any reviewers see what their role allows: the criteria and confirmations, the evidence (withheld from the payer until capture when the agreement says so), the verdicts, the ledger and the audit log for that agreement. Member email addresses are visible to the other parties as the people who acted.
Service providers
| Provider | What for | What it receives |
|---|---|---|
| PayPal | Holds, captures, payouts, invoices and disputes | Amounts, descriptions, the payer's and payee's PayPal accounts. Your relationship with PayPal is governed by PayPal's privacy statement. |
| Anthropic | AI extraction and verification | Agreement text; evidence text and criteria (see AI processing) |
| Resend | Sending email | Recipient address, subject and body of the notices we send |
| Render | Hosting the application and its Postgres database | Everything the application stores, in the United States |
| Cloudflare | DNS for our domains; R2 object storage for uploaded files | Uploaded files, encrypted by the application before they are stored; DNS queries for our names |
| GitHub | Hosting this website and the source code; the GitHub App for evidence from repositories | Requests to this website; for connected repositories, the installation and the pull requests, commits and checks it reads |
Other disclosures
- When the law requires it, or to respond to a valid legal request. We will tell you unless we are legally prevented from doing so.
- To protect the service, its users or the public from fraud, abuse or security threats.
- If the service changes hands, under this policy, with notice to you.
Cookies and local storage
- This website sets no cookies. If you pick a theme, the choice is stored in your browser's local storage under the key
mde.themeand never sent to us. GitHub Pages, which serves the site, logs requests (including IP addresses) for security, as described in GitHub's privacy statement. - The application keeps your session token in your browser's local storage when you choose "keep me signed in", and in session storage otherwise, so it ends when you close the tab. Sessions expire after 30 days in any case. Your theme is stored the same way as on this site.
- Sign-in and consent pages served by the API set one short-lived, same-site cookie so that a sign-in link opened in one browser cannot sign in a different one. It carries no tracking.
- There are no third-party cookies, scripts or fonts anywhere.
How long we keep it
- Accounts are kept while they are in use. You can ask us to delete yours at any time; see your rights.
- Agreements, verdicts, the ledger and the audit log are kept for the life of the organizations party to them and as long as the law requires for payment records, because both sides and their auditors rely on them.
- Evidence files and deliverables are kept according to a retention setting on the deployment. The hosted service currently keeps them until the organization that owns the agreement asks us to remove them. Removal never happens within 180 days of a payment capture, PayPal's dispute window, and when files are removed their hashes and size are kept so the record stays verifiable. Every removal is recorded in the audit log and both sides are emailed.
- Sign-in links expire after 15 minutes, invitations after 14 days and sessions after 30 days; only hashes of the tokens are ever stored.
- Server logs and rate-limit counters are kept briefly for debugging and security.
- The demo uses sample people at a reserved domain that nothing is delivered to. Anything you do in the demo is sample data and may be cleared at any time. Please do not put real documents or personal information into the demo.
Security
Uploaded files are encrypted at rest with AES-256-GCM before they are stored. Downloads are served by the application after an access check, recorded in the audit log and verified against the stored hash. Tokens and API keys are stored as hashes. Human-only steps, money movements and access between organizations are enforced by role. The security page describes this in detail, and says how to report a problem.
Your rights and choices
Wherever you are, you can ask us to:
- Access the personal data we hold about you, and export it. Much of it is already yours to export: the API, the audit log and the compliance packet contain the agreement record.
- Correct something that is wrong.
- Delete your account and the personal data that is only about you.
- Object to or restrict processing, where the law where you live gives you that right.
Email privacy@milestone-ledger.com. We will confirm the request by writing to the address on your account, and answer within 30 days.
One limit, stated plainly: an agreement's record belongs to every party to it. We cannot delete confirmations, verdicts, ledger entries or audit events that another organization relies on for a payment, a dispute or an audit, and we may have to keep payment records for as long as the law requires. In those cases we will remove or restrict what we can and tell you what we kept and why. If you believe we have not handled your data lawfully, you may also complain to the data protection authority where you live.
Where data is processed
The hosted service runs in the United States, and our providers process data there and wherever they operate. If you use the service from elsewhere, your data is transferred to the United States.
Children
The service is for organizations and the adults who act for them. It is not directed at anyone under 18, and we do not knowingly collect their data. If you think a child has given us data, please write to us and we will delete it.
Changes to this policy
The effective date at the top changes whenever this policy does. For a material change we will email every account before it takes effect and say what changed. The history is in the repository.
Contact
Privacy questions and requests: privacy@milestone-ledger.com. Anything else: support@milestone-ledger.com.