Privacy Policy

How Miles collects, uses, shares, and protects your information.

Last updated: June 24, 2026 · Miles Labs, Inc.

1. Introduction

Miles helps families understand and improve how their household drives, respond quickly if there’s a crash, and if they choose, turn safe driving into savings on auto insurance. Because our product is built on driving data, we take privacy seriously and try to explain our practices in plain language.

This Privacy Policy explains what information Miles Labs, Inc. and its subsidiary Miles Labs Insurance Services, LLC (together, “Miles,” “we,” “us,” and “our”) collect, how we use and share it, and the choices and rights you have. It applies to the Miles Plug device, the Miles app, our website at mileslabs.com, and the related services (together, the “Services”). Our supplements — the Miles Score & Insurance Disclosure and the AI Assistant Disclosure — form part of this Policy.

2. Who This Policy Covers

This policy applies to the account holder who purchases and sets up the Services, and to the drivers the account holder authorizes — for example, household members or, for a business account, employees or other drivers — whose vehicles use a Miles Plug device. The account holder is responsible for informing those drivers — including any teen drivers — about how the Services collect and use driving data, as described in Section 13. It also applies to anyone who drives a vehicle that has a Miles Plug device installed, whether or not they are part of the household — for example, a borrower or other permitted driver. If you let someone else drive a Miles-equipped vehicle, you should tell them the device is active and that the Services collect location and driving data.

3. Information We Collect

3.1 Information You Provide

Account and contact information — name, date of birth, email, phone number, address, and vehicle details. (Sign-in is passwordless, by email link or one-time code, so we do not collect a password.)
Payment information — processed by our payment and e-commerce providers. Miles does not store full payment card numbers; see Section 7.
Emergency contacts and optional emergency information — people you designate to be contacted, and any optional details (such as medical or emergency information) you choose to provide for crash response.
Support and communications — information you share when you contact us or respond to surveys.
AI assistant chat — the messages you type to the in-app Miles assistant, and any documents (such as insurance cards, registrations, maintenance receipts, and photos) you upload for it to read. See Section 7A.

3.2 Telematics Data From Your Miles Plug Device

When you use the Miles Plug device, it collects the following categories of data ("Telematics Data"). Some of this comes from the device's own GPS receiver and motion sensors — for example, your location and heading, and driving events such as hard braking, acceleration, and cornering — and some is read from your vehicle's On-Board Diagnostics (OBD-II) port — for example, engine and diagnostic data, VIN, and odometer readings. These categories include, but are not limited to:

Driving behavior data: vehicle speed, acceleration events, hard braking events, cornering intensity, idle time, and seatbelt status.
Trip data: trip start and end times, duration, frequency, time-of-day and day-of-week patterns, mileage per trip, total mileage, and odometer readings.
Location data: GPS coordinates (latitude, longitude, altitude), vehicle heading, course, speed at location, and route information, collected at up to 60 data points per minute while the vehicle is in motion.
Vehicle and engine data: RPM, throttle position, accelerator and brake pedal percentage, steering wheel angle, fuel level and consumption rate, and engine hours.
Diagnostics data: diagnostic trouble codes (DTCs), malfunction indicator lamp (MIL) status, and other OBD-II parameter IDs supported by your vehicle.
Vehicle identification: VIN, vehicle year, make, and model.
Named places and geofences: locations you label (such as home, school, or work), including their coordinates and radius, and records of when a vehicle enters or leaves them.
Push notification tokens and device identifiers: the push token used to send notifications to your device, the device platform, and a device fingerprint.
Bluetooth (BLE) proximity and attribution data: where a phone relays trip data over Bluetooth, we process device identifiers, hashed proximity/attribution credentials, and BLE relay frames to associate a trip with the correct driver and vehicle.

3.3 Crash and Roadside Data

If you use crash response or roadside assistance features, we collect data needed to detect a crash and coordinate help: motion and crash-sensor signals, precise location, vehicle information, your and your emergency contacts’ details, any optional emergency/medical information you provide, and records of related calls or interactions with our monitoring or roadside providers. See Section 6.

3.4 Information Collected Automatically

When you use our app and website, we automatically collect usage information (pages and features used, app interactions), device and connection information (device type, operating system, identifiers, IP address), and information collected through cookies and similar technologies (see Section 8).

3.5 Information From Third Parties

We may receive information from our partners and service providers — for example, order and fulfillment information from our e-commerce and logistics partners, and, if you pursue insurance, information from carrier partners related to your inquiry.

4. How We Use Your Information

Provide and operate the Services — driving insights, trip summaries, route maps, vehicle health alerts, location-based alerts, and account management.
Provide driving insights, and at our option generate internal driving assessments (such as trip-level grades) within our own systems to help users better understand their driving; and, if you choose to enable the Miles Score, support that feature as described in Section 5.
Detect crashes and coordinate emergency response, and provide roadside assistance when requested (Section 6).
Process purchases and subscriptions, and provide customer support.
Operate the in-app AI assistant, including answering your questions, reading documents you upload, and explaining diagnostic trouble codes (Section 7A).
Map driving-score events to locations on your route so you can see where your driving affected your score.
Improve the performance, safety, and accuracy of the Services, including through de-identified analytics.
Communicate with you, including service messages and (with your choices respected) marketing.
Comply with law, enforce our terms, and protect the rights, safety, and security of users and the public.

5. Driving Data and Your Miles Score

Miles’s own driving insights. Miles may generate its own driving insights or assessments — for example, trip-level grades — within Miles’s own systems to support product features. Any such internal assessment is computed and held within Miles’s environment, is for your own information, is not shared with any consumer reporting agency or any insurance carrier, and is not a consumer report. It is separate from the Miles Score described below, and turning off the Miles Score does not affect it.

The Miles Score (optional). If you choose to enable it, Miles shares a defined subset of your driving data with a consumer reporting agency to generate a telematics-based, insurance-grade driving score based on the vehicle (the “Miles Score”), which can be made available to insurance carriers only if you take a separate and later step to unlock it. This sharing is off by default, happens only with your opt-in, and you can re-lock it or opt out at any time. Because a consumer reporting agency is involved, you have rights under the Fair Credit Reporting Act (FCRA).

Full details — exactly what data is shared, the partner involved, how the two consent steps work, and your FCRA rights and contacts — are in our Miles Score & Insurance Disclosure.

6. Crash Response and Roadside Assistance

Crash response and roadside assistance are part of the optional Guard subscription upgrade. If you subscribe to Guard, we and our third-party providers use your data to help you in an emergency.

Crash response. The Miles Plug device monitors accelerometer and signals to detect events that appear to be a vehicle crash. Crash dispatch is available to Guard members who opt in. When a suspected crash is detected, the alert that Miles sends to our professional crash-monitoring and dispatch provider (the “Monitoring Provider”), carries only your vehicle’s coordinates and a signed, time-limited link or identifier — it does not carry your name, license plate, or contacts. The identifying details needed to coordinate a response — the driver’s first name and last initial, vehicle details including license plate, household name, your emergency contacts’ names and phone numbers, and the crash severity and classification — are held behind that signed incident page, which the Monitoring Provider accesses only for the duration of the incident and which is revoked when the incident closes. Depending on the apparent severity, the Monitoring Provider may dispatch first responders and then contact you, or contact you and then dispatch as needed, and may also reach your designated emergency contacts. The Monitoring Provider may share relevant information with emergency responders (911 / Public Safety Answering Points) and your emergency contacts. We protect this information with safeguards including encryption of stored contact phone numbers and the signed, time-limited incident page described above.
Roadside assistance. When you request roadside assistance through the app, we share your location, vehicle information, and contact details with our roadside assistance provider so it can dispatch help to you.

Crash response is an assistive convenience feature and is not a substitute for calling 911. The detailed terms, limitations, and disclaimers for these features are in the Miles Terms of Service. By designating an emergency contact, you confirm you have that person’s consent to be contacted and to have their information used for this purpose.

7. How We Share Information

We share information only as described here. We do not sell your Telematics Data for others’ independent use.

Recipient	Purpose
Service providers (hosting, data storage, security, and analytics)	Operate, host, secure, and improve the Services. They process data on Miles’s behalf, in the United States, and may not use it for their own purposes.
Communications providers	Send email, SMS, push, and in-app messages. SMS providers receive your phone number and the message content.
Maps and location services	Render maps, routes, and place names in the app.
AI provider	Powers the AI assistant — chat, document understanding, and diagnostic-code explanations — and receives your chat content and the context the assistant assembles, which can include precise location and vehicle or trip data. See our AI Assistant Disclosure.
Image-processing providers	Enhance or remove the background from vehicle photos you add; receive the vehicle image.
Hardware, device, and diagnostics providers	Manufacture and relay the Miles device and provide vehicle-reference lookups, to operate the device and its diagnostics.
Payments, commerce, and fulfillment providers	Process payments, subscriptions, orders, and shipping. Miles does not store full payment card numbers.
A consumer reporting agency (only if you enable Miles Score)	Generates the Miles Score from a subset of your driving data. Off by default and only with your opt-in. See our Miles Score & Insurance Disclosure.
Insurance carriers (only if you unlock carrier access)	Access your Miles Score with a permissible purpose under the FCRA.
Crash-response and roadside providers (Guard upgrade)	Coordinate emergency dispatch and roadside assistance when you use those features. See Section 6.
Legal and safety	When required by law, to enforce our terms, or to protect the rights, safety, and security of users and the public.
Business transfers	In connection with a merger, financing, or sale, subject to this policy.

We require our service providers to protect your information and to use it only to provide services to Miles.

7A. AI Assistant

The Miles app includes an AI assistant that answers your questions, reads documents you upload, and explains vehicle diagnostic trouble codes. To do this, what you type and the context the assistant assembles — which can include precise location (GPS) and vehicle or trip data — is processed by a third-party AI provider under its contractual terms; we do not mask this information before it is sent. Under the commercial terms that apply to Miles, the provider does not use these inputs or outputs to train its models by default and deletes them within about 30 days. The app’s setup flow is a fixed, step-by-step process and does not use the AI model.

The assistant is informational only and is not a substitute for professional advice from a qualified mechanic or other automotive professional, or for insurance, legal, or emergency advice, and is not used to make automated decisions about your insurance. In particular, its explanations of diagnostic trouble codes and other vehicle information are general and for your awareness only — they are not a professional diagnosis and are not a substitute for inspection, diagnosis, or repair by a qualified, licensed mechanic; never rely on the assistant to decide whether your vehicle is safe to drive. We may use more than one AI provider and may substitute an equivalent provider with notice. See our AI Assistant Disclosure for details, including the provider we currently use and how vehicle-photo features work.

8. Cookies, Analytics, and Advertising

Our website and app use cookies and similar technologies to operate the Services, remember your preferences, measure usage, and support marketing. You can control cookies through your browser settings, and where required we provide additional choices and honor applicable opt-out preference signals. We use analytics providers to understand how the Services are used; some advertising or analytics activity may be considered “sharing” or “targeted advertising” under state law, and you may opt out as described in Sections 11–12.

9. Data Retention

We keep your information only as long as we need it, and we set maximum retention periods according to our internal Data Retention & Deletion schedule. The periods below are ceilings — we may hold data for a shorter time. We keep the data we derive from your driving so we can show you long-term insights and trends, while deliberately keeping the most sensitive raw data for shorter periods.

Account and identity information (profile, household, vehicles, billing), your derived driving data (trips, driving events, scores, geofence activity), vehicle diagnostic and maintenance records, and crash and safety records: kept up to the life of your account, so we can provide the Services and show long-term insights and trends.
Raw precise location (your exact GPS trail) and raw device telemetry (OBD readings and vehicle-health snapshots): kept up to 12 months.
Bluetooth phone-relay location frames: kept up to 12 months.
AI assistant chat (your conversation text): kept up to 90 days.
Consent and legal records (including parental, terms, and deletion consents): retained as a legal and compliance record and not auto-deleted. Security audit logs are kept for one year live plus an archive of about seven years.
Backups: retained up to 14 days, then purged, so deleted data clears from backups within that window.

Aggregated and de-identified data: kept indefinitely. Once data has been aggregated or de-identified so that it can no longer reasonably be linked to you or your household, it is no longer subject to the periods above. We may retain and use such data indefinitely — for example, to operate, improve, and develop the Services and to produce aggregated insights — and we maintain it only in de-identified form and do not attempt to re-identify it. If we combine de-identified or aggregated data with personal information, we treat the combined data as personal information for as long as it remains combined.

If you enable Miles Score, data furnished to the consumer reporting agency is also subject to that agency’s own retention policies.

10. How We Protect Your Information

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, access controls, and ongoing monitoring, as described in our internal Information Security Policy. Customer accounts are passwordless — you sign in with an email magic link or one-time code, so there is no customer password to steal and multi-factor authentication is not required of you. We enforce multi-factor authentication for our own staff and administrators who access internal systems.

We add an extra layer of field-level encryption (AES-256-GCM, with keys wrapped by Google Cloud KMS) to particularly sensitive fields, including your VIN, billing email and address, uploaded-document fields, emergency-contact phone and email, driver date of birth, and phone number. Raw device (OBD) telemetry is not separately field-encrypted in this way; it is protected by encryption in transit and by the data store’s at-rest encryption. No system is perfectly secure, but we work to protect your information and to respond promptly if an incident occurs.

11. Your Privacy Choices and Rights

Account and communications. You can update your account information and manage marketing-communication preferences at any time; service messages may still be sent.
Miles Score controls. You can re-lock carrier access, turn off score generation, or stop all data collection, as described in Section 5.
State privacy rights. Depending on where you live, you may have rights to access, delete, correct, and port your personal information, and to opt out of its sale or sharing and of targeted advertising or certain profiling. We do not discriminate against you for exercising these rights.

To make a request, contact us at privacy@mileslabs.com or by mail at Miles Labs, Inc., 1500 N. Grant St #4877, Denver, CO 80203. We will verify your request and respond within the timeframe required by law (generally 45 days). You may use an authorized agent where the law allows.

Deleting your account. When you delete your account, we act in two stages. First, your account and household are made inaccessible right away — memberships are removed, the household is hidden, and active sessions are ended. Then a background process durably purges your data across all of our systems, including your derived trip, event, and crash history, saved places and geofence activity, maintenance and diagnostic records, attribution data, vehicle records, raw location history, stored images and documents, and AI assistant chat history, before removing your profile and sign-in credential; any connected hardware is released back to inventory. Deleted data clears from our backups within the backup window (up to 14 days). Note that removing an individual driver from a household is different from deleting an account: it ends that driver’s access and hard-deletes that driver’s trips, driving events, and crash records, but it does not close the login account or remove vehicle- or household-level data.

12. State-Specific Privacy Disclosures

Depending on where you live, you may have additional rights under your state's privacy law, including the California Consumer Privacy Act (as amended by the CPRA), the Colorado Privacy Act, the Texas Data Privacy and Security Act, and comparable laws in other states. These rights supplement the choices described in Section 11.

Your rights. Subject to your state's law and to verification, you may have the right to: know and access the categories and specific pieces of personal information we have collected, its sources, the purposes for collecting or sharing it, and the categories of third parties it is disclosed to (see Sections 3, 4, and 7); delete personal information we collected from you, subject to legal exceptions; correct inaccurate information; obtain a portable copy; opt out of the "sale" or "sharing" of personal information and of targeted advertising; opt out of certain profiling that produces legal or similarly significant effects; limit the use and disclosure of sensitive personal information (California); appeal a refusal to act on your request (Colorado, Texas, and certain other states); and not be discriminated against for exercising these rights.

Sensitive personal information. Some data we collect — in particular precise geolocation — is treated as "sensitive" under several state laws. We collect and use it to provide the Services with your consent, and do not use or disclose it except as described in this Policy.

"Sale," "sharing," and targeted advertising. We do not sell your personal information for money. If you choose to enable the optional Miles Score, we share a defined subset of your driving data with a consumer reporting agency, and only if you separately unlock it can it reach insurance carriers (see Section 5). Depending on your state, that disclosure and certain analytics or advertising activity may be considered a "sale," a "share," or "targeted advertising." Where applicable, you can opt out via our “Your Privacy Choices” mechanism [mechanism to be finalized], and we intend to honor recognized universal opt-out signals such as the Global Privacy Control [counsel to confirm scope and applicability].

How to exercise your rights. Contact us at privacy@mileslabs.com or use the in-app option. We verify your request using information associated with your account and respond within the time your state's law requires (generally 45 days, with an extension where permitted). You may use an authorized agent where the law allows. If we decline, you may appeal as described in our response.

California. Categories of personal information collected, disclosed, and "sold"/"shared," and the retention of each, are described in Sections 3, 4, 7, and 9; California residents may also limit the use of sensitive personal information.

Colorado and Texas. Colorado (CPA) and Texas (TDPSA) residents have the rights above, including to opt out of targeted advertising, sale, and certain profiling, and to appeal. Texas additionally requires opt-in consent to process sensitive data such as precise geolocation, which we obtain at setup.

Minors and teen drivers. Several states provide heightened protections for the personal information of consumers under 18 (for example, Colorado, Connecticut, and Delaware) or under 16 (for example, California). Consistent with those laws, where a driver is under 18 we do not use their information for targeted advertising, do not sell or “share” it, and do not use it for profiling in furtherance of significant decisions, except to provide the Services with verifiable parental consent (see Section 13). Texas’s SCOPE Act requires parental consent before a known minor’s identifying information is shared, which we obtain from the account holder at setup.

Other states. Residents of other states with comprehensive privacy laws (for example, Virginia, Connecticut, Utah, and Oregon) have comparable rights, which we honor as those laws require.

13. Children’s and Teen Drivers’ Privacy

The Services are intended for use by adults who set up an account for their household. The account holder must be an adult (18 or older). Many household teen drivers are minors, and the Services support them, but we set an absolute minimum age of 14 for any driver and require each driver to hold a valid learner’s permit or license as required in their state: we do not knowingly allow anyone under 14 to be added as a driver, and we reject under-14 drivers at invitation and setup. For drivers who are minors (14 through 17), the account holder must provide parental consent before that driver is added; the system records who consented, when, and how. We do not separately retain a minor’s exact GPS trail beyond the 12-month limit described in Section 9, which we treat as a deliberate safeguard for minors. We do not knowingly collect personal information from children under 13, and if we learn we have, we will delete it.

For drivers who are minors (14 through 17), we apply additional protections: we do not use a minor’s personal information for targeted advertising, do not sell or “share” it, and do not use it for profiling in furtherance of decisions that produce legal or similarly significant effects — except as needed to provide the Services with verifiable parental consent. In particular, the adult account holder may choose to enable the optional Miles Score for a vehicle in their household, and separately to unlock it for insurance carriers; where they do, the driving data associated with that vehicle is processed for the Miles Score as described in Section 5, including for a minor who drives that vehicle. These choices are made by the account holder, not by the minor.

The parental consent we collect is designed to meet the “verifiable parental consent” standard under the federal Children’s Online Privacy Protection Act (COPPA) and the parental-consent requirements of the Texas Securing Children Online through Parental Empowerment (SCOPE) Act before a minor’s information is shared.

14. Third-Party Links and Services

The Services may link to third-party sites and services, including carrier partners. Their privacy practices are governed by their own policies, not this one.

15. Changes to This Policy

We may update this policy from time to time. We will post the updated policy with a new ‘Last updated’ date and, where required, provide additional notice. Your continued use of the Services after an update means you accept the revised policy.

16. Contact Us

Questions about this policy or your privacy can be sent to privacy@mileslabs.com, or by mail to Miles Labs, Inc., 1500 N. Grant St #4877, Denver, CO 80203. For your rights regarding data held by the consumer reporting agency that generates the Miles Score, see our Miles Score & Insurance Disclosure.