Skip to content

Legal

Privacy notice

Last updated 20 August 2026.

Who we are

Milleso is back-office software for professional watch dealers. The controller for the information described here is the company operating Milleso, contactable at privacy@milleso.com.

Two different roles

We hold two kinds of information and our responsibilities differ for each.

For a dealer's own account, we are the controller: the name, email and role of each person who signs in, the organisation's trading details, and the record of what they did in the system.

For everything a dealer records about their own customers and suppliers, we are a processor. That data belongs to the dealer. We hold it so their software works, we act on their instructions, and we do not use it for anything of our own.

What is held

Account and organisation records. Stock records, including photographs, purchase and sale prices and VAT treatment. Client and supplier records, which may include names, addresses, telephone numbers, email addresses and dates of birth. Repair and valuation jobs. Invoices, credit notes and the payment ledger. Anti money laundering records, which include verified identity documents such as passport and driving licence scans. Orders that arrive from a connected sales channel, which carry the buyer's name, email and delivery address.

Identity documents

Identity documents are held differently from everything else, deliberately. They are stored in a private file store with no public address, so there is no link that can be shared or guessed. They are never rendered in a page or an image tag. Each time one is opened, the request is authorised again and the file is streamed through the server, and only a manager or above can do it. A deletion destroys the file and keeps the record that it existed, which is what the money laundering regulations require.

Where it lives

The database is hosted by Neon on Amazon Web Services in London, in the eu-west-2 region. The application is hosted by Vercel. Files are held in Vercel Blob storage, in two separate stores so that stock photographs and identity documents can never be confused with one another.

Who else processes it

We use these services, and nothing else receives your information:

Two further services supply market data only and receive nothing about anyone: a metal price feed and a currency rate feed.

Cookies and analytics

The public website, meaning these marketing pages, uses Google Tag Manager and Google Analytics to measure how people find the site and which pages they read. Until you choose on the banner it runs in Google's consent mode with every storage type denied: nothing is written to or read from your device, no cookie is set, and what reaches Google carries no identifier that could link this visit to you or to a later one. Choose Allow and a first-party analytics cookie is set, which is the thing that lets a second visit be recognised as the same browser; if you arrived from a partner link, that partner's code is remembered the same way and only then. Decline and the site works exactly the same, no cookie is ever set, and the banner does not return. Either choice is kept in your own browser and nowhere else. No advertising cookies are set on this site at any point, and inside the product itself, where the records live, there is no analytics, no advertising and no third party tracking of any kind.

The cookies the software itself sets are functional and necessary: one that keeps a person signed in, one that carries a team invitation from the link to the sign-up screen, and short-lived ones that tie the two halves of a Shopify or eBay connection to the same browser. All are set with the HttpOnly and Secure flags, and the connection ones expire after fifteen minutes.

How long it is kept

Identity documents and the anti money laundering record are kept for five years after the end of the business relationship, which is the period the Money Laundering Regulations require, and are then destroyed. Records supporting an investment gold transaction are kept for six years under VAT Notice 701/21. VAT records, invoices and the payment ledger are kept for six years. The audit trail is kept for as long as the account exists, because it is the evidence that a record was not altered.

Where a period is set by law, we cannot shorten it at request, including at the request of the person the record is about. That is not a preference of ours.

Your rights

You may ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, object to how it is used, or ask for it in a portable form. Write to privacy@milleso.com.

If the request concerns information a dealer holds about you as their customer, we will pass it to that dealer, because it is their record and they decide. We will tell you who they are.

If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.

Connected sales channels

When a dealer connects a Shopify store or an eBay account, we hold an access token for it until they disconnect. If a shopper asks the store to erase them, or the app is removed, the buyer details we hold from that store are erased and the record of the erasure is kept. The dealer's own stock records are not deleted by that, because they are the dealer's books rather than the channel's.

Security

Each dealer's data is separated at the database itself rather than by application code, so a query that forgot to filter still returns nothing belonging to anyone else. Purchase prices and margins are withheld from staff below manager level. Every change to a stock, client or money record is written to an append-only audit trail that the application cannot delete.

Changes

If this notice changes materially we will tell account holders by email before it takes effect.

Questions: privacy@milleso.com. Back to Milleso.