Privacy Policy

1. Who we are

Militime is a time-tracking and billing application operated by Milistack (“Militime,” “we,” “us”), based in the Province of Quebec, Canada. This policy applies to the Militime marketing site and the Militime application. Our registered address is Montreal, Quebec, Canada.

This policy covers personal information we control — for example, the information of our account holders and website visitors. Where you use Militime to store information about your own clients, staff and contacts, you are the person responsible for that information and we act on your behalf as a service provider; our handling of it is governed by our Terms of Service.

2. Person in charge of personal information

In accordance with Law 25, we have designated a person in charge of the protection of personal information (our “Privacy Officer”). You can reach them with any question, request or complaint:

• Privacy Officer, Privacy Officer
• Email: privacy@militime.ai
• Mail: Montreal, Quebec, Canada

3. What personal information we collect

We collect only what we need to provide and improve the service:

• Account information — your name, email address, workspace and role, language preference, and authentication details (we support magic-link/one-time codes and Google or Slack sign-in).
• Workspace content you create — time entries, projects, clients, rates, invoices and related notes. This may include personal information about third parties that you choose to enter.
• Billing information — your subscription, seat count and invoices. Card payments are processed by our payment provider (Stripe); we do not store full card numbers.
• Usage and technical data — log data, device and browser type, approximate location derived from IP, and product analytics needed to keep the service secure and reliable.
• Communications — messages you send us (e.g. support).

4. Why we collect it, and your consent

We use personal information for these purposes:

We rely on your consent and on the necessity of processing to deliver a service you have requested. Where consent is required, we seek it in clear and simple terms, separately from other information, and you may withdraw it at any time (see “Your rights”). Withdrawing consent may mean we can no longer provide part or all of the service.

• to create and operate your account and workspace;
• to provide tracking, billing, invoicing and reporting features;
• to process payments and manage your subscription;
• to provide support and respond to your requests;
• to secure the service, prevent fraud and abuse, and debug issues;
• to send service and, where you have opted in, occasional product communications; and
• to meet our legal and accounting obligations.

5. Privacy by default

As required by Law 25, any product setting that collects or shares personal information is configured to the highest level of privacy by default, without any action required from you. We do not use identifying technologies that profile or locate you without first informing you and offering a choice.

6. Service providers and where data is processed

We share personal information with a small number of vetted service providers strictly to operate Militime, under contracts that require them to protect it and use it only on our instructions:

• Supabase — database, authentication and storage;
• Stripe — payment processing and subscription billing;
• Vercel — application hosting and content delivery;
• Anthropic, via the Vercel AI Gateway — generating optional AI summaries (your prompts are not used to train their models);
• Our email provider — sign-in codes and service email.

Some of these providers may store or process information outside Quebec or Canada (for example, in the United States or the European Union). Before such a transfer, we conduct a privacy impact assessment as required by Law 25, and we put appropriate contractual and technical safeguards in place so your information receives an equivalent level of protection. We do not sell personal information, and we do not disclose it for the commercial gain of others.

7. Automated processing and AI

Militime does not make decisions that produce legal effects or significantly affect you based solely on automated processing of your personal information. Our optional AI features generate plain-language summaries of your own tracked time to assist you; they are advisory, may contain inaccuracies, and remain under your control. If we ever introduce automated decision-making, we will inform you and offer the right to a human review, as Law 25 requires.

8. How long we keep it

We keep personal information only as long as necessary for the purposes above or as required by law (for example, tax and accounting rules for invoices). When you delete content or close your account, we delete or anonymize the associated personal information within a reasonable period, except where retention is legally required. You can export your workspace data before deletion.

9. How we protect it

We use reasonable security measures appropriate to the sensitivity of the information, including encryption in transit, access controls, least-privilege practices, and logging. No method of transmission or storage is perfectly secure, but we work continuously to protect your information.

10. Confidentiality incidents

We maintain a register of confidentiality incidents. If an incident involving your personal information occurs and presents a risk of serious injury, we will notify the Commission d’accès à l’information (CAI) and the affected individuals promptly, and take reasonable measures to reduce the risk of harm and prevent recurrence, as required by Law 25.

11. Your rights

Subject to applicable law, you have the right to:

To exercise any right, contact our Privacy Officer at privacy@militime.ai. We will respond within 30 days. If you are not satisfied with our response, you may file a complaint with the CAI (cai.gouv.qc.ca).

• Access the personal information we hold about you;
• Rectify information that is inaccurate, incomplete or out of date;
• Withdraw consent or request deletion of your personal information;
• Portability — receive the computerized personal information you provided in a structured, commonly used technological format;
• De-indexing — in certain circumstances, request that information be de-listed or its dissemination stopped; and
• be informed of how we process your information.

12. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to keep the service secure, and a minimal amount of privacy-respecting analytics to understand and improve the site. We do not use advertising trackers. Where a cookie is not strictly necessary, we ask for your consent through our cookie banner, and you can change or withdraw your choice at any time using the “Cookie preferences” link in the website footer.

13. Children

Militime is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under the age of 14 without parental consent. If you believe a child has provided us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you. Your continued use of Militime after an update means you accept the revised policy.

15. How to contact us

Questions, requests or complaints about privacy can be sent to our Privacy Officer at privacy@militime.ai or by mail to Milistack, Montreal, Quebec, Canada. For general support, email support@militime.ai.