Privacy Policy

1 Introduction

Who we are, and who controls your information.

MiLT Technologies, Inc. ("MiLT," "we," "us," "our") provides a workforce management, patrol, dispatch, and incident-reporting platform (the "Service") used by security companies, guard agencies, and similar employers ("Customers") for their own personnel ("Users"). This Privacy Policy explains what information we collect, why we collect it, and the controls you have. For the technical and organizational measures behind these commitments, see How MiLT protects your personal data.

In most deployments, the Customer is the data controller with respect to User personal information, and MiLT acts as a data processor on the Customer's documented instructions, governed by the Data Processing Addendum referenced in the Subscription Agreement. Where MiLT acts as a controller in its own right — for example, for Customer billing contacts or our own marketing site — this Policy applies to MiLT directly.

2 Information MiLT collects

Three sources: what you provide, what the app records automatically, and what arrives from integrated systems.

Things you or your Customer provide

• Account and profile details — name, badge ID, email, phone, job title, role/permission level, and password (stored as a salted hash)
• Employer, site or post assignment, certifications, and shift schedule
• Emergency contact information, where your Customer collects it for SOS routing
• Content you create — incident reports, notes, and any photo, video, or audio you attach
• Support and chatbot conversation content

Things MiLT collects automatically

• Location and movement — precise GPS while clocked in or on background-tracked shifts, geofence entry/exit events, patrol route history, checkpoint scans, and Saturn 3D navigation interaction data
• Biometric confirmation — where enabled, a pass/fail signal from your device's own Face ID, Touch ID, or fingerprint sensor. MiLT never receives the underlying biometric template
• Communications data — push-to-talk (ROIP) audio and metadata, in-app messages
• Device and usage data — device model, OS version, crash logs, IP address, app version, and push notification tokens
• Dispatch data — CAD call logs, unit status, and SOS activation events
• MiLT Intelligence Agent (AI) data — prompts, voice or text queries, and the summaries, answers, or suggested actions the Agent generates in response, when you use this feature

Things MiLT receives from Customer-integrated systems

Where a Customer connects an RMS, CAD platform, HR/payroll system, or SSO provider, MiLT receives whatever data the Customer configures that integration to share — for example, a roster feed from SSO.

3 Why MiLT collects data

Every collection ties back to a purpose the Service needs it for.

4 Your privacy controls

What you can change yourself, and what your administrator controls.

• Location, camera, microphone, and notification permissions can be adjusted any time in your device's OS settings — though disabling one your role requires may block features like clock-in
• Biometric login is optional and can be turned off in-app in favor of password/MFA sign-in
• Administrators can turn the MiLT Intelligence Agent (AI) on or off for their organization, and Users can choose not to use it; declining does not affect access to the rest of the Service
• Preference and analytics cookies can be limited through your browser's cookie controls; essential cookies can't be disabled without breaking sign-in
• Administrators can configure retention windows, and can export or delete data on your behalf — see Exporting & deleting
• You can object to or request restriction of certain processing by contacting your administrator or MiLT — see Compliance & cooperation with regulators

5 Sharing your information

Who sees your data, and on what basis.

Within your organization

Location, patrol, and activity data is visible to your employer's administrators and supervisors through the dashboard. MiLT does not control how a Customer uses this data internally.

Subprocessors

We share data with vetted vendors who help us run the Service. See Partners for the category list.

Law enforcement and RMS/CAD systems

Where a Customer integrates an agency RMS or CAD system, data may pass through under the Customer's own authorized access. MiLT does not independently query NCIC or state DCI systems. See Disclosures & safe harbor for how government requests are handled.

No sale of data

6 Keeping your information secure

The commitment; the detail is in section 10.

We use encryption in transit and at rest, role-based access controls, audit logging, network segmentation, and regular third-party penetration testing. See How MiLT protects your personal data for the full detail behind this commitment.

7 Exporting & deleting your information

How to get a copy of your data, or have it removed.

You can request a copy of your data, or its deletion, through your Customer administrator, who can export or remove records directly, or escalate to MiLT. Deletion requests are honored subject to legal retention obligations.

Where MiLT is the controller for your data, contact us at privacy@miltpro.com; we verify identity before fulfilling a request and generally respond within 30–45 days depending on applicable law.

8 Retaining your information

Default windows by data category. Several are Customer-configurable.

9 Compliance & cooperation with regulators

How to escalate if we haven't resolved your concern.

We cooperate with data protection authorities and respond to lawful government requests consistent with applicable law. See Disclosures & safe harbor for detail on regulatory and government-request disclosures.

If you believe MiLT hasn't addressed your concern, EU/UK/EEA residents may lodge a complaint with their local supervisory authority, and California residents may contact the California Privacy Protection Agency.

10 How MiLT protects your personal data

The technical and organizational measures behind section 6. Last updated August 26, 2026 · Version 1.0.

We take a defense-in-depth approach: no single control is relied on alone, and controls are layered across infrastructure, application, and process.

Technical safeguards

• Encryption in transit — TLS 1.2 or higher for all data moving between apps, browsers, and MiLT's servers
• Encryption at rest — AES-256 for stored data, including location history, incident media, and backups
• Network segmentation — production systems are isolated from corporate and development environments
• Role-based access controls — access to Customer Data is scoped to what a role needs, enforced in application logic and reviewed periodically
• Audit logging — sensitive actions (location-data exports, permission changes, admin actions) are logged and retained for review
• Secure biometric handling — MiLT never receives biometric templates; matching happens entirely within the device manufacturer's secure hardware

Organizational safeguards

• Least-privilege access provisioning for MiLT employees, reviewed on a regular cadence
• Mandatory security awareness training for all employees, with additional training for engineering staff
• Background checks for employees with access to production systems, consistent with applicable law
• A documented vendor-security-review process before onboarding any new subprocessor
• A named security team responsible for monitoring, incident response, and this page's accuracy

Certifications & audits

Incident response & breach notification

MiLT maintains a documented incident-response plan covering detection, containment, investigation, and notification. In the event of a confirmed security incident affecting personal information, we will notify affected Customers without undue delay and in accordance with our contractual and legal obligations, and will support the Customer's own breach-notification obligations to Users or regulators.

Business continuity & disaster recovery

Production data is backed up regularly and stored redundantly across availability zones. MiLT maintains a disaster-recovery plan with defined recovery time and recovery point objectives, tested periodically, to minimize disruption to the Service in the event of an infrastructure failure.

Sub-processor security requirements

Every subprocessor listed in Partners is contractually required to maintain security measures consistent with this section, undergo a security review before onboarding, and notify MiLT promptly of any incident affecting Customer Data they process.

Your role in keeping data secure

• Use a strong, unique password and enable multi-factor authentication where available
• Keep your device's lock screen enabled, especially on devices with biometric login configured
• Report suspicious account activity or a lost/stolen device to your administrator immediately
• Don't share your login credentials with coworkers, even temporarily

Report a security concern

11 Disclosures & safe harbor

Regulatory disclosures and the safe-harbor protections that apply to specific activities. Effective August 26, 2026 · Version 1.0.

This section collects, in one place, the regulatory disclosures MiLT is required or chooses to make, and the legal "safe harbor" protections that apply to specific activities on the platform — most notably, good-faith incident reporting and international data transfer. It is a reference, not a substitute for the specific terms in this Privacy Policy, the Subscription Agreement, or the User Terms of Service, which control on their respective topics.

Regulatory & government-request disclosures

MiLT may receive requests from government authorities for information about Users or Customer Data. We review each request for legal validity before responding, and where legally permitted, will notify the affected Customer so it can respond or seek protective relief.

MiLT does not independently connect to or query the National Crime Information Center (NCIC) or state DCI/CJIS networks — any such connectivity must be established and authorized by the Customer through its own CJIS-compliant infrastructure and control terminal agency relationship, consistent with 28 CFR Part 20 and the CJIS Security Policy.

MiLT does not use the Fair Credit Reporting Act (FCRA) consumer-reporting framework itself — MiLT is not a consumer reporting agency and does not run background checks; where a Customer conducts background screening on its own personnel, that is between the Customer and its own background-check provider, and any FCRA disclosures required for that process are the Customer's responsibility, not MiLT's.

Good-faith reporting safe harbor

MiLT encourages Users to file honest, good-faith incident reports, including reports that reflect poorly on a colleague, supervisor, or the Customer organization itself (for example, reporting a safety violation or policy breach they witnessed). MiLT does not penalize, and Customers agree in the Subscription Agreement not to instruct MiLT to help penalize, a User for a report made in good faith and based on a reasonable belief that it was accurate at the time it was filed, even if it later turns out to be mistaken.

Safe harbor for user-generated content

Incident reports, notes, and messages Users submit through the Service are content provided by Users, not by MiLT. To the extent applicable under U.S. law, MiLT relies on Section 230 of the Communications Decency Act, which generally provides that a provider of an interactive computer service is not treated as the publisher or speaker of information provided by another content provider. This does not affect a Customer's own responsibility for how it acts on User-submitted content, and does not shield MiLT from its own obligations as a data processor under this Policy.

Limitations on these safe harbors

None of the safe harbors described here excuse a User or Customer from complying with applicable law, the Subscription Agreement, or the User Terms of Service. They do not apply to content or conduct that is knowingly false, malicious, or submitted in bad faith, and they do not limit MiLT's ability to suspend an account for a genuine violation of the acceptable-use provisions found in the User Terms of Service.

How to make a disclosure request

Government authorities seeking user information should direct requests to legal@miltpro.com. Users or Customers with questions about a specific disclosure, or who want to understand whether the good-faith reporting safe harbor applies to a report they filed, can also reach us at that address.

12 Data transfer frameworks

The mechanisms we rely on when data crosses a border.

MiLT serves Customers across multiple countries. Where personal information is transferred across borders — for example, to our hosting infrastructure — we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and, for transfers to the United States, MiLT's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

13 Key terms

Definitions used throughout this Policy.

14 Partners

The categories of subprocessor that help us run the Service.

15 About this policy & updates

How changes are communicated, and what has changed so far.

We may update this Privacy Policy from time to time. Material changes will be communicated to Customer administrators, and where required by law, to affected Users, before they take effect.