Privacy Policy

01Who this policy covers

This policy applies to the Hexagon application at app.joinhexagon.com and to its in-product AI assistant, Milo, wherever you use it, including the web app, the Milo plugin for Chrome, and connected messaging surfaces such as Slack, Microsoft Teams and Google Chat. It covers data from connected accounts, including Google and Microsoft, as well as information you provide directly through the service.

02The Google data Hexagon accesses — and how Milo uses it

Hexagon connects directly to Google. The permissions requested are shown on Google's consent screen before you authorize them and may include your basic profile, Gmail, Calendar, Drive, Docs, Sheets, Slides, and read-only Contacts. The set requested can vary by connection flow. Milo can use only the permissions you grant; additional access may require you to connect again.

• Your basic profile (name, email address)To create and identify your Hexagon account and address you correctly. (openid, email, profile)
• Gmail — read, organize, and sendSo Milo can read and triage your inbox, summarize what matters, apply labels and archive on your instruction, draft replies in your voice, and send email on your behalf under your instructions. Milo also reads your send-as signature so drafted email uses your real signature. (gmail.readonly, gmail.modify, gmail.send, gmail.settings.basic)
• Google Calendar — read and manage eventsSo Milo can read your schedule, find open time, and create, move, or update events when you ask it to book or reschedule something. (calendar)
• Google Drive, Docs, Sheets, and Slides — files and documentsWith your permission, Milo can find the right file, pull context from your documents, and create or edit spreadsheets, documents, and slide decks when you ask it to. (drive, drive.readonly, spreadsheets, documents, presentations)
• Google Contacts — read-onlyWith your permission, Milo can resolve the people you mention (“email Ramon”) to the right address when drafting email or scheduling meetings. (contacts.readonly)

Hexagon accesses data you have authorized only as needed for Milo to carry out a task or user-enabled routine you requested, or to maintain the live context needed to answer your questions. You can disconnect your Google account at any time (see Data retention and deletion), which stops access through that connection.

Milo in Google Chat

When you or your Google Workspace administrator add the Milo app to Google Chat, Google sends Milo only the messages that are meant for it: what you write to Milo in a direct message with the app, and a message in a space or group conversation that mentions Milo or uses one of its commands, together with the name and email address Google shows for the person who wrote it, the space's name, and, in a direct message, any file attached to it. Google also tells Milo when someone adds or removes the app, or presses a button on one of its cards. Milo does not receive or read the other messages in a space.

Unless you let it send as you (below), Milo acts in Google Chat only as the Milo app, with Google's chat app permission (chat.bot). It uses it to post and update its own messages, to see who the members of a space it is in are (their names and whether they belong to your organization), so it knows who can read what it says there and whose Milo should answer, to find your direct message with it so it can bring you a reminder or a finished task, and to read a file attached to a message sent to it. Through Google Chat it reads nothing else in your Google account. Milo matches the person who wrote to the account they use to sign in to Milo, so your own Milo answers you with what you have already connected; the Google data it uses that way is covered by the sections above and by the Limited Use commitments below. Remove the app from a chat or space, or ask your administrator to uninstall it, and Google stops sending Milo anything from there.

If you choose to let Milo send in Google Chat as you, you approve it on Google's own screen, which asks for permission to compose and send messages in Chat (chat.messages.create) and to create new conversations in Chat (chat.spaces.create). Milo uses them only to send the messages, files, and direct messages you ask it to send, from your own account. It does not use them to read your messages, your conversations, or who is in them. It keeps a record of each message it sends, so it can tell you later what it sent and where. You can disconnect it on the Connections page at any time, which also removes the permission at Google, unless another Milo account still uses the same Google account.

03Other information we collect

Information you provide

The messages, instructions, and approvals you send to Milo, and any content you provide through Hexagon. We use these to understand and carry out your requests.

Information collected automatically

Basic technical and usage data — such as log data (including your IP address), device and browser information, and how you interact with the product — used to operate, secure, and improve the service. We do not use this category to identify the contents of your Google data.

04How we use information

• To provide the assistant features you request — reading, summarizing, drafting, sending, scheduling, and editing — and to act on your behalf only as you direct.
• To maintain the live context Milo needs to answer your questions accurately.
• To secure the service, prevent abuse, debug problems, and meet legal obligations.
• To operate and improve the Hexagon product experience, subject to the limits in the next section.

05Google API Services — Limited Use

Hexagon's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use your Google data to provide and improve the user-facing features you see in Hexagon and use through Milo — the email, calendar, document, contact, and Google Chat features described above.
• We do not use your Google data for advertising of any kind, and we do not sell it.
• We do not let humans read your Google data, except: (a) with your affirmative consent for specific messages or files; (b) where necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized so it can no longer identify you.
• We do not use your Google Workspace data — including Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, and Google Chat data — to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.

06Microsoft — Teams, Outlook, and files

For teams that run on Microsoft, Milo connects to Microsoft 365 the same way it connects to Google: through permissions you — or your Microsoft administrator — approve on Microsoft's own consent screens, used only to carry out the tasks and routines you ask for. This section describes the Microsoft data Milo accesses. It adds to, and does not change, the Google disclosures and commitments above; the commitments restated at the end of this section — no advertising, no sale, restricted human access, and no training of generalized AI models — apply to your Microsoft data exactly as they do to your Google data.

Milo in Microsoft Teams

When your team's administrator adds Milo to Microsoft Teams and consents to its permissions, Milo can read the following inside the specific teams and chats where it is installed. These are Teams resource-specific permissions, granted per team by the team owner at install:

• Channel messagesMessages posted in a channel where Milo is installed. Today Milo answers in a channel only when it is addressed — an @mention, or a reply in a thread it is already part of — and it grounds that answer on the conversation it is part of, not on the rest of the room. This permission is what would let a future capability read a channel's wider history to summarize or catch you up; Milo does not read the room that way today. (ChannelMessage.Read.Group)
• Chat messagesMessages in a group chat where Milo is installed, on the same addressed-only basis as channels, so Milo can respond when you bring it into the conversation. (ChatMessage.Read.Chat)
• Chat membersWho is in a group chat where Milo is installed, and how far back each of them can see the chat's history, so that when Milo reads a group chat's history to answer there, it reads no further back than everyone in it can. (ChatMember.Read.Chat)
• Team membershipWho belongs to the team, so Milo can resolve the people named in a request to the right person. (TeamMember.Read.Group)
• Channel membersWho is in each channel of the team, which for a private or shared channel is not the whole team, so Milo knows who can read what it says there. (ChannelMember.Read.Group)
• Channel settingsA channel's basic settings, such as its name, so Milo can refer to a channel correctly. (ChannelSettings.Read.Group)
• Meeting basicsFor a meeting whose chat Milo is in, or a meeting held in a channel where it is installed: the meeting's basic details (such as its title, time and organizer) and when it starts and ends, so the organizer can ask Milo to recap the meeting's chat. Milo never receives a meeting's audio, video or transcript through these permissions. (OnlineMeeting.ReadBasic.Chat, ChannelMeeting.ReadBasic.Group)

Two Teams features send Milo content only when a person uses them. When someone chooses “Ask Milo about this” on a message, Milo receives that message so it can answer that person privately. When someone pastes a Milo link (a link on app.joinhexagon.com) into a Teams message, Teams sends Milo that link so it can show a preview card.

Through Teams itself Milo receives only what these per-install permissions deliver, inside the teams and chats where it has been added. Milo is in a private or shared channel only if someone in that channel adds it there, and what it says in a private channel stays in that channel. Separately, your Microsoft administrator may choose to approve two organization-wide permissions for Milo's Teams app: reading basic profiles of people in your organization (name, email and job title), so Milo can find the colleague a request names, and adding the Milo app for that colleague, so Milo can reach them in Teams. Milo has neither unless your administrator approves it on Microsoft's consent screen. (User.ReadBasic.All, TeamsAppInstallation.ReadWriteSelfForUser.All)

Milo with Outlook, calendar, and files (Microsoft Graph)

If you connect your Microsoft work account, Milo uses Microsoft Graph permissions — shown on Microsoft's consent screen when you connect — to do for your Microsoft mailbox, calendar, and files what it does on the Google side. Permissions are requested only when you connect, and any capability added after your original connection is requested only when you reconnect:

• Work email — read, organize, draft, and sendSo Milo can read and triage your Outlook inbox, draft replies in your voice, and send email on your behalf under your instructions, including sending from your own address. (Mail.ReadWrite, Mail.Send)
• Outlook calendar — read and manage eventsSo Milo can read your schedule, find open time, and create, move, or update events when you ask. (Calendars.ReadWrite)
• OneDrive and SharePoint filesSo Milo can find the right file and pull context from it, and — when you ask — save, rename, organize, and edit Word, Excel, and PowerPoint files in your OneDrive, and share a file with a person you name. SharePoint access is read-only: Milo can search the SharePoint sites you can already open, but never writes to them. (Files.ReadWrite.All, Sites.Read.All)
• Contacts and your work directoryRead-only, so Milo can resolve the people you mention (“email Ana”) to the right address — using your saved contacts, the colleagues you most work with, and your organization's basic directory (name, email, job title, and similar work-profile fields a colleague can already look up in Outlook). (Contacts.Read, People.Read, User.ReadBasic.All)
• Your basic profile and mailbox settingsTo identify your account and address you correctly, and — so drafts and scheduling match how you actually work — to read and, on your instruction, adjust mailbox settings such as your automatic replies, time zone, working hours, and inbox rules. (openid, email, profile, User.Read, MailboxSettings.ReadWrite)

You can disconnect Microsoft inside Hexagon at any time to stop access through that connection. A Microsoft administrator can also remove Milo from Teams or revoke its permissions in Microsoft 365. Disconnecting an account is separate from deleting information already stored in Hexagon; see Data retention and deletion.

07How Milo uses AI

Milo is powered by large language models. To carry out a request, Milo sends the minimum content necessary for that request to third-party AI providers. Their use of that content is governed by their data-processing terms, and those providers may use what Milo sends them to improve their AI models. The Google and Microsoft sections above, and the voice and Chrome plugin sections below, say more about those kinds of data.

Camera and screen in voice conversations

In a voice conversation you can turn on your camera or share a window so Milo can see what you are talking about. Both are off until you turn them on.

• Only while it is on and Milo is answering you. Pictures from your camera or shared window are sent only while the camera or the share is on and you are talking with Milo. After two minutes without anyone speaking they pause, and the next voice wakes them, which can be a TV or someone nearby talking.
• Milo's servers keep no video. Pictures pass through our servers' memory on the way to our voice partner and are never written to disk, logs or analytics. They are dropped when the conversation ends. The one exception is a picture Milo keeps in your chat, below.
• Our voice partner. Pictures are processed to answer you and are never used for training. Our voice partner keeps them for up to 55 days for safety checks, and they may be processed outside your country. If you are in Brazil (LGPD) or the European Union, this means your data is transferred outside Brazil or the EU for this purpose.
• Pictures Milo keeps are handled like photos you send it. When a task Milo hands over depends on what it sees, it can keep one picture in your chat. You can say “Don't keep” for a camera picture; a screen picture, or any picture in a shared conversation, is kept only if you say yes. A kept picture reaches the assistant that does the work, under the same terms as a photo you send: it goes to the AI providers described above, which may process it outside your country (including outside Brazil or the EU).
• What Milo says about what it sees is part of your conversation. Its spoken words stay in your chat like anything it says. They are kept out of the summary your other chats read, and Milo is instructed to keep them out of its memory unless you ask it to remember something. The conversation's note records only facts: how many minutes the camera or screen was on and how many pictures were kept.
• People in view are seen too. Anyone in front of your camera is seen by Milo. It does not identify people or guess who someone is.
• Screen sharing shares one window or tab, never your whole screen.
• Removing a kept picture. “Remove from chat” removes the picture from your chat, deletes the note it was handed to Milo on, and asks our storage to delete its stored copy. Milo's replies about the picture stay in your chat like anything it says. Removing the picture does not yet reach the working copy the assistant used for that task or anything Milo noted from it. To have those removed too, email support@joinhexagon.com or delete your account (Section 10).

The Milo plugin for Chrome

The Milo plugin lets Milo do a job in your own Chrome when the job needs it, like a site only your Chrome is signed in to. It takes jobs only from the Milo account you connect it to.

• It works in the background. Milo opens its own tab in a tab group named “Milo”, or works in a tab you already have open when the job is about it. Milo's tabs open behind yours and your mouse is never moved, though a pop-up a site opens, such as a sign-in or payment window, can still come to the front.
• You can stop it. While Milo works in a page, Chrome shows a bar saying Milo started debugging this browser. Closing it while Milo is attached stops its current work and jobs already waiting in this Chrome. The bar can remain after Milo detaches; to stop a task, use Dismiss on it in Milo. Actions already sent to a site may still finish. You can also ask Milo to stop.
• What it reads. During a job, it reads the pages it works on: their words, links, buttons and form fields, including what the fields hold, such as names, addresses, messages, prices or payment details. It also reads the names and web addresses of your open tabs, so Milo can find the tab a job is about. While a site marks a field as a password, it sees only whether the field is filled, never its value. If the site reveals the value as ordinary text, the plugin can read it, including a password Chrome filled in. While attached to a page for a task, the plugin also receives page events, such as dialog text and requests to open a new window, including between steps. It stops receiving those events after it disconnects from those pages.
• What it does not access. Chrome's cookie store, password manager, or history of the sites you visited before. It takes no pictures of your screen. Outside its task page connections, it checks each page's address to spot Milo's own connect page, so it can connect, and keeps none of those connect-page checks.
• Where it goes. While Chrome is open, the plugin connects to Milo so a job can reach it. Besides the sites in your job, it talks only to Milo: to app.joinhexagon.com and, when the Milo app for Mac is on the same computer, to that app (below). What it reads goes through our servers to the third-party AI providers Milo uses (above), to do the job you asked for. Those providers may also use what Milo sends them, which can include what the plugin read from your pages and the reports it sends back, to improve their AI models. The plugin's reply to a job, which can include what it found, waits in our job queue until Milo reads it and is normally deleted then; a reply never read, or one whose deletion did not go through, is deleted from that queue by a regular sweep, normally within an hour. We also keep usage records, this Chrome's install ID and when it last connected. As with every request to Milo, we keep logs with your IP address (Section 3).
• When the Milo app for Mac does the job. When the Milo app on the same computer does a job in this Chrome, it sends the plugin its steps directly on your computer, through a connection Chrome provides for this, without going through our servers for those steps. The plugin takes them one step at a time and answers each with what it did or read, which can include what a page shows. The app sends those answers through our servers to the AI providers Milo uses, which may also use them to improve their models. Our servers do not keep those answers, only the job's record (What Milo keeps, below). The app keeps them only for the job, in memory and in the job's working files on your Mac, and normally deletes them by the time the job ends, or, after a crash, before the app's next job starts. Beyond those, it saves only a short record of each step, not page text; those records stay with the Milo app's data on your Mac until that data is deleted. What Milo tells you about the job, such as its notes and its result, is kept like any other message from Milo. The plugin connects only to the Milo app on your computer, and only while it is signed in to Milo; the app works with it only when both are signed in to the same Milo account.
• What Milo keeps. For a job that reaches this Chrome through our servers, Milo keeps the reports it reads for your task like anything else it reads for you, such as an email, and keeps its own record of each job: what it asked the plugin to do and whether the job finished (see Data retention and deletion). For a job the Milo app for Mac does, Milo keeps the job's own record and what it told you, not the plugin's answers (above). That record can include details Milo read on a page, such as an order number or the confirmation that shows the job done.
• What stays on your computer. A random install ID, your Milo sign-in for this Chrome, and a key that proves jobs come from Milo. Job reports and a few working notes stay only in Chrome's memory, until you quit Chrome or the plugin is turned off or updated. Reports are also dropped when this Chrome connects to another Milo account, normally at once or at the plugin's next check, about a minute later. When the Milo app on this computer uses this Chrome, the plugin also keeps the ids and time limits of the steps it took for the app, so a step the app sends twice runs only once, even after a restart; older records are cleared as new steps arrive, and none holds page text. Remove the plugin to delete its local data. Tabs Milo opened stay in its Milo tab group until you or Milo close them, and the sites it visits stay in your Chrome history and may keep cookies, like sites you visit.
• No ads, no sale. We do not sell this data or pass it to ad platforms or data brokers, and we do not use it for ads, to judge credit, or to make loans. We share it to do your job (the service providers in Section 8, including the AI providers above, which may also use it to improve their models), to follow the law, or to stop fraud and abuse; in a merger or sale of Hexagon, only with your OK first. People at Hexagon do not read it, unless you say yes for a specific job, it is needed for security, the law requires it, or it is pooled and anonymous.

08How we share information

We do not sell your personal information. We share it only:

• With service providers who run parts of the service for us (such as cloud hosting and log monitoring), and with the AI providers above, under their data-processing terms; the AI providers may use what Milo sends them to improve their AI models (Section 7).
• With your direction or consent — for example, when you ask Milo to send an email or share a document on your behalf.
• For legal and safety reasons, when required by law or to protect the rights, safety, and security of users and the public.
• In a business transfer, such as a merger or acquisition, in which case we will give you advance notice and the data remains subject to this policy or a policy at least as protective. Data from the Milo plugin for Chrome moves in such a transfer only with your OK first.

09How we store and protect your information

We protect your data with industry-standard safeguards. Google access and refresh tokens are stored encrypted and used only to make the API calls needed for the features you use. Data sent over the internet travels over encrypted connections. When the Milo plugin and the Milo app work together on your Mac (the Milo plugin for Chrome, above), what passes between them stays on that computer, over a local connection that is not encrypted. Access within Hexagon Labs, Inc. is limited to what is necessary to operate and support the service, consistent with the human-access limits in Section 5.

10Data retention and deletion

We retain your information only as long as needed to provide the service or as required by law. You are in control:

• Disconnect inside Hexagon to stop further data access through that connection. Disconnecting does not delete your Hexagon account or all information already stored in it.
• Revoke at Google any time from myaccount.google.com/permissions.
• Delete your data. Use Settings → Account → Delete account in Hexagon, or email support@joinhexagon.com to request deletion of your account and associated data. When you delete your account, we delete or de-identify associated data, except where we are required to keep limited records by law.

11Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise any of these, contact us at support@joinhexagon.com. We will not discriminate against you for exercising these rights.

12International users

Hexagon Labs, Inc. is based in the United States, and your information may be processed there or in other countries where we or our service providers operate. We take steps to ensure your information receives an adequate level of protection wherever it is processed.

13Children's privacy

Hexagon and Milo are not directed to children under 18, and we do not knowingly collect their personal information.

14Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of Hexagon or Milo after a change takes effect means you accept the updated policy.

15Contact us

Questions about this policy or your data? Email support@joinhexagon.com. Hexagon is provided by Hexagon Labs, Inc.; Milo is Hexagon's in-product AI assistant.