EFFECTIVE DATE: MARCH 31, 2026
Milestone Bank ("we," "us," "our," or "Milestone") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, secure, and retain personal information about our customers, prospective customers, applicants, and visitors to our website. This Privacy Policy applies to individuals located in the United States.
If you have questions about this Privacy Policy or our privacy practices, please contact us at (877) 262-7922 or visit our website at www.milestonebank.com.
Information We Collect
We collect personal information (meaning information that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with you or your household) in the following categories:
- Personal identifiers, including those listed in other California statutes: real name; alias; Social Security number; passport number; other government issued number; Green Card number; driving license number; telephone number; email address; postal address; account name; Signature; IP address; or a unique personal identifier created by Milestone.
- Characteristics of protected classifications: date of birth/age; gender; military or veteran status; marital status; nationality; citizenship; request for family care leave; request for leave for employee’s own serious health condition; request for pregnancy leave; disability; other medical/health information or health insurance information; insurance policy numbers.
- Biometric information: voice recordings, from which an identifier template, such as a voiceprint, can be extracted.
- Professional or Employment: title; salary; job or employment history or files; references; performance evaluations or other employment data.
- Education information: details of your education and qualifications.
- Financial details: personal and business bank account numbers; debit/credit card numbers; cardholder or accountholder name and details; transaction details; or stock investment portfolios.
- Commercial Information: records of personal property; products and service purchased, obtained or considered; purchasing or consuming histories or tendencies.
- Internet or other electronic network activity information: browsing history, search history, information regarding your interaction with a website, application or advertisement.
- Geolocation data: any information used to identify your physical location.
- Communications, recordings, images: audio, electronic, visual.
- Sensitive Personal Information: includes certain government identifiers (such as SSN, driver’s license, passport number); an account log-in, financial account, password, or credentials allowing access to an account; precise geolocation (which means within 1,850 feet of a particular person); contents of mail, email, and text messages; biometric information processed to identify an individual; information concerning an individual’s health, information about racial or ethnic origin.
Sources of Personal Information
- Directly from you, when you provide it to us digitally or physically (e.g., when you apply for an account, contact us via email or telephone, visit our website, or by any other means)
- As well as from:
- public sources, when you manifestly choose to make it public, including via social media (e.g., we may collect information from your social media profile(s), to the extent that you choose to make your profile publicly visible).
- service providers and third parties who provide it to us (e.g., third-party originators; brokers; ; credit reference agencies; and law enforcement authorities).
- your visits to any of websites or your use of any features or resources available on or through our website. When you visit a website, your device and browser may automatically disclose certain information (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting and other technical communications information), which may constitute Personal Information. We currently do not share any of this information with third parties.
How We Use Your Information
We collect and use personal information for the following business and commercial purposes:
- Marketing/Prospecting: communicating with you via any means (including via email, telephone, text message, social media, post or in person) subject to ensuring that such communications are provided to you in compliance with applicable law; and maintaining and updating your contact information where appropriate.
- Operation of our websites: operation and management of our websites; providing content to you; displaying advertising and other information to you; and communicating and interacting with you via our websites.
- IT operations: management of our communications systems; operation of IT security; and IT security audits.
- Financial management: sales; finance; corporate audit; and vendor management.
- Research: conducting market or customer satisfaction research; and engaging with you for the purposes of obtaining your views on our products and services.
- Security: physical security of our premises (including records of visits to our premises and CCTV recordings); and electronic security (including login records and access details, where you access our electronic systems).
- Investigations: detecting, investigating and preventing breaches of policy, and criminal offences, in accordance with applicable law.
- Legal compliance: compliance with our legal and regulatory obligations under applicable law.
- Legal proceedings: establishing, exercising and defending legal rights.
- Improving our products and services: identifying issues with existing products and services; planning improvements to existing products and services; and creating new products and services.
- Risk Management: audit, compliance, controls and other risk management.
- Fraud prevention: detecting, preventing and investigating fraud.
- Providing our products and services in ways not already described in the categories above.
How We Share Your Information
We may share your personal information with the following categories of recipients:
- You and, where appropriate, your family, your associates and your representatives.
- Anti-fraud services providers.
- Accountants, auditors, financial advisors, lawyers and other outside professional advisors to Milestone, subject to confidentiality.
- Data aggregation services.
- Service providers (examples include payment services providers; loan or lease servicers; marketing partners, shipping companies; deposit partners and servicers).
- Credit reporting agencies.
- Governmental, legal, regulatory, or other similar authorities and/or local government agencies, upon request or where required.
- Other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise, to protect the rights, property or security of our customers or third parties.
- Any relevant third party acquirer(s), in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganization, dissolution or liquidation).
- Other parties, if you specifically direct or expressly consent to us disclosing your personal information to them.
Data Retention
We take reasonable steps designed to ensure that your personal information is only processed for the minimum period necessary for the purposes set out in this disclosure. The criteria for determining the duration for which we will retain your personal information are as follows:
- We will retain copies of your personal information in a form that permits identification only for as long as:
- We maintain an ongoing relationship with you (e.g., while you are still receiving services from us); or
- Your personal information is necessary in connection with purposes set out in this disclosure
plus:
- The duration of any applicable limitation period under applicable law; and where required by applicable law or a retention policy established in accordance with applicable law.
In addition, if any relevant legal claims are anticipated/brought, we may continue to retain your personal information for such additional periods as are necessary in connection with that claim.
Once the periods above have concluded, each to the extent applicable or permitted by applicable law, we will 1) permanently delete or destroy the relevant personal information, or 2) archive your personal information so that it is beyond use; or 3) anonymize the relevant personal information.
Your Privacy Rights
Depending on your state of residence, you may have one or more of the following privacy rights under applicable state privacy laws, including the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and Utah Consumer Privacy Act (UCPA):
- the right to know:
- the categories of personal information we have collected;
- the categories of sources used to collect the personal information;
- the business or commercial purposes for collecting your personal information;
- the categories of recipients with whom we share your personal information; and
- the specific pieces of personal information we have collected about you.
- the right to request, on legitimate grounds, deletion of your personal information that we collected;
- the right to obtain copies of your Personal Information in writing through an existing account. If you do not maintain an account with the Bank, the right to obtain copies of your Personal Information by mail or electronically at your option in a readily usable format that will allow you to transmit the information from one entity to another.
- the right, in certain circumstances, to correct inaccurate personal information we collected about you; and
- the right not to be discriminated against for exercising any of these rights.
We also must provide in this disclosure certain details about our collection and handling of categories of personal information.
How to Exercise Your Rights
To exercise one or more of your rights, you or someone you authorize to make a request on your behalf may call us at (877) 262-7922 or submit a request through our Privacy Request Form at www.milestonebank.com/privacy-request. We will verify your identity and respond to your request within the timeframes required by applicable law.
Sharing and Selling of Personal Information
Milestone Bank does not sell your personal information as defined by applicable state privacy laws. We do not share your personal information with third-party marketing partners for cross-contextual behavioral advertising purposes. Therefore, we do not offer an opt-out from the sale or sharing of personal information for such purposes.
Children's Privacy
Our services are intended for adults. We do not knowingly collect personal information from children under 16 years of age. If you believe a child has provided personal information to us, please contact us and we will take appropriate steps to delete such information.
Sensitive Personal Information
We do not use or disclose sensitive personal information for purposes other than those necessary to provide our products and services, comply with legal obligations, or as otherwise permitted by applicable law. We do not use sensitive personal information for purposes of inferring characteristics about individuals.
Security
We implement appropriate technical and organizational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include access controls, encryption, network monitoring, and regular review of security practices. While no system can be fully secure, we continuously work to enhance our safeguards to protect your information.
Cookies and Similar Technologies
Our website may use cookies and similar technologies to enable core functionality, security, and to help us understand website usage and improve our services. We do not use cookies for profiling or automated decision-making that produces legal or similarly significant effects. You can set your browser to refuse or delete cookies; however, some website features may not function properly without certain cookies.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will post the updated version on our website with a new "Effective Date." When changes materially affect your rights or our processing, we will provide additional notice as required by law. We encourage you to review this Privacy Policy periodically.
Other Privacy Rights
Please note that certain personal information may be subject to other privacy laws that provide different or additional protections, including:
The Gramm-Leach-Bliley Act (GLBA) and our U.S. Consumer Privacy Notice, which applies to personal information we collect in connection with financial products used for personal and household purposes.
The Fair Credit Reporting Act (FCRA), which governs credit reporting information.
Information covered by these laws may be exempt from certain state privacy law requirements. If you have questions about which privacy notice applies to your information, please contact us.
Oregon Residents (OCPA): If you are an Oregon resident, the Oregon Consumer Privacy Act (OCPA) provides you with rights to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt-out of targeted advertising, sale of personal data, and profiling.
Montana Residents (MCDPA): If you are a Montana resident, the Montana Consumer Data Privacy Act (MCDPA) provides you with rights to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt-out of targeted advertising, sale of personal data, and profiling.
Depending on your state of residence, you may have additional rights under state privacy laws. The following sections describe rights that may be available to residents of specific states:
California Residents (CCPA): If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information, including the right to know, access, delete, correct, and port your personal information, as well as the right to opt-out of the sale or sharing of personal information and the right to limit use of sensitive personal information. We do not sell your personal information or share it for cross-contextual behavioral advertising.
Virginia Residents (VCDPA): If you are a Virginia resident, the Virginia Consumer Data Protection Act (VCDPA) provides you with rights to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt-out of targeted advertising, sale of personal data, and profiling.
Colorado Residents (CPA): If you are a Colorado resident, the Colorado Privacy Act (CPA) provides you with rights to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt-out of targeted advertising, sale of personal data, and profiling.
Connecticut Residents (CTDPA): If you are a Connecticut resident, the Connecticut Data Privacy Act (CTDPA) provides you with rights to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt-out of targeted advertising, sale of personal data, and profiling.
Utah Residents (UCPA): If you are a Utah resident, the Utah Consumer Privacy Act (UCPA) provides you with rights to access, delete, and obtain a copy of your personal data, as well as the right to opt-out of targeted advertising and sale of personal data.
Texas Residents (TDPSA): If you are a Texas resident, the Texas Data Privacy and Security Act (TDPSA) provides you with rights to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt-out of targeted advertising, sale of personal data, and profiling.
Contact Us
If you have questions about this Privacy Policy, our privacy practices, or wish to exercise your rights, please contact us:
Phone: (877) 262-7922
Email: customerservice@milestonebank.com
Mail: Milestone Customer Service — 50 W. Big Beaver Rd, Ste 245, Troy, MI 48084
