Last updated: October 6, 2026

Milemarker, Inc. ("Milemarker", "we", "us") provides a data and workflow platform to wealth management firms. This Privacy Policy explains how we handle personal information in two different roles:

• On our websites and in our own business (milemarker.co, docs.milemarker.co, our podcast and newsletters, sales and support). Here we decide how your information is used, so we are the "controller" under the EU and UK General Data Protection Regulation (GDPR) and the "business" under California law.

• In the Milemarker Platform, where we process information on behalf of the investment advisers, broker-dealers and other financial firms that use it ("Client Firms"). Here the Client Firm is the controller, and we act as its processor or service provider. We process that information only on the Client Firm's instructions and under our agreement with it.

If you are a client of a firm that uses Milemarker, your privacy relationship is with that firm. Its privacy notice governs how your information is used, and requests about your data should be sent to the firm. We will help the firm respond to you.

1. Information we collect on our websites and in our business

• Contact and business details, such as your name, email address, phone number, company and role, which you give us through forms, demos, events and correspondence.

• Account information for our documentation and learning sites, such as login details and course progress.

• Communications, such as support requests, emails, chat messages, and call notes or recordings where you agree to recording.

• Website and device information, such as IP address, browser type, pages viewed, referring site, approximate location, and cookie and similar identifiers, collected automatically (see section 5).

• Marketing information, such as email engagement, event attendance, and business contact information from our service providers and partners.

We do not knowingly collect personal information from children under 16.

2. How we use this information, and our legal bases

• To provide the services and accounts you request and to respond to you (performance of a contract; our legitimate interests).

• To operate, secure and improve our websites and services (legitimate interests).

• To market our services to business contacts, including by newsletter (legitimate interests, or consent where the law requires it). You can unsubscribe at any time.

• To measure and advertise our services using analytics and advertising technologies (consent where the law requires it; otherwise legitimate interests).

• To meet our legal, regulatory and tax obligations (legal obligation).

3. Personal information in the Milemarker Platform

Client Firms use the Platform to bring together their own data from custodian, CRM, portfolio and planning systems. This may include information about the firm's clients, advisors and staff, such as identity and contact details, account, holdings and transaction data, and CRM records. We use this information only to provide the Platform to that Client Firm, as our agreement with it allows.

• Each Client Firm's data is held in an environment dedicated to that firm, hosted in the United States.

• We do not sell or share Platform data, and we do not use it for advertising.

• Our AI features process a Client Firm's data only within each user's existing permissions, through providers that are not permitted to train on it. AI requests are logged so the firm can review them.

• We use subprocessors to host and operate the Platform. Our current list is published at docs.milemarker.co/trust.

Linked financial accounts. A Client Firm may allow its clients to link accounts held at other institutions through an account-aggregation provider such as Plaid. You sign in directly with your institution through the provider. We never receive your banking login credentials, and the provider's own privacy policy governs its handling of your information.

4. How we share information

• Service providers that host, support and operate our websites and services, under contracts that restrict their use of the information.

• Analytics and advertising partners, for website and marketing information only (see sections 5 and 6).

• Professional advisers, auditors and insurers, under duties of confidentiality.

• Authorities, where the law requires us to.

• A buyer or successor in a merger, acquisition or similar transaction, subject to equivalent protections.

5. Cookies and similar technologies

Our websites use cookies and similar technologies that are necessary for the sites to work, that measure how the sites are used, and that support our advertising. These include technologies from Google (Analytics), HubSpot, LinkedIn, RollWorks (AdRoll) and its advertising partners, GoSquared, Ahrefs and RB2B. You can set your preferences using the cookie banner on our website, block or delete cookies in your browser settings, and use the opt-out tools that these providers offer.

6. California privacy rights

Under California law, our use of advertising technologies on our websites may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell or share Platform data. To opt out of the sale or sharing of your website information, email us at the address in section 10 with the subject "Do Not Sell or Share".

California residents may also request to know, access, correct and delete their personal information, and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. We respond within 45 days, and an authorized agent may make a request on your behalf with your signed permission.

7. Your rights in the EU, UK and elsewhere

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to restrict or object to how we use it, and to withdraw consent at any time. We respond within one month, and will tell you if we need up to two further months for a complex request. You also have the right to complain to your data protection authority; in the UK, this is the Information Commissioner's Office.

To make a request, contact us using the details in section 10. We will verify your identity before acting on a request. If your request concerns Platform data, we will pass it to the relevant Client Firm and help it respond.

8. International transfers

We are based in the United States, and our services are hosted there. Where we receive personal information from the European Economic Area, the United Kingdom or Switzerland, we protect it with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, in our agreements with clients and with our subprocessors.

9. Security and retention

We protect personal information with administrative, technical and physical safeguards, which are independently assessed in our SOC 2 Type II report. We keep website and business information only for as long as we need it for the purposes in this policy and to meet our legal obligations. We keep Platform data for the term of the Client Firm's agreement and delete it afterwards as that agreement provides.

10. Contact us

For privacy questions or to make a request, email connect@milemarker.co with "Privacy request" in the subject line, or write to us at:

Milemarker, Inc.
16192 Coastal Highway
Lewes, Delaware 19958
United States

11. Changes to this policy

We will post any changes on this page and update the date at the top. If we make a significant change, we will give notice on our website or by email.