Privacy Policy

Scope and GDPR Roles

For account and billing data, we act as a data controller. For customer content processed on your behalf, we generally act as a data processor under your instructions.

Data We Collect

• Account details (name, email, organization, authentication data).
• Billing and transaction data, including plan and payment status.
• Service usage data, device/browser logs, and diagnostics.
• Support communications and feedback you send to us.

Lawful Bases (GDPR)

• Contract performance to provide and maintain the service.
• Legitimate interests to secure, improve, and operate the platform.
• Legal obligations, including accounting, tax, and compliance duties.
• Consent where required, which you may withdraw at any time.

How We Use Data

We use data to deliver features, authenticate users, process payments, provide support, prevent abuse, meet legal requirements, and improve product performance and reliability.

Sharing and International Transfers

We share data only with vetted service providers, professional advisors, or authorities when legally required. Where data is transferred outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses.

Data Retention

We retain personal data only for as long as needed for the purposes above, then delete or anonymize it, unless longer retention is required by law or to resolve disputes and enforce agreements.

Your Rights

• Access, correct, or delete your personal data.
• Restrict or object to certain processing.
• Request data portability where applicable.
• Withdraw consent and lodge a complaint with a supervisory authority.

AI Assistant (optional add-on)

When you use the mobile AI Assistant, voice is transcribed on your device. Only the text transcript and minimal context (such as assignee names from your organization directory) are sent to our backend in the EU (AWS eu-central-1) for interpretation via Amazon Bedrock. Processing stays within AWS; we do not send transcripts to third-party LLM APIs outside AWS. You must review and approve every suggestion before any task or form change is applied. Transcripts are not logged in production application logs.

Security and Contact

We apply technical and organizational measures to protect personal data. If you have privacy requests or concerns, contact us through our support or legal contact channel.

U.S. State Privacy Rights (including California / CCPA–CPRA)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have additional rights regarding personal information we collect for our business purposes.

• Right to know / access: request categories and specific pieces of personal information we have collected about you, and the purposes of collection.
• Right to delete: request deletion of personal information, subject to exceptions (for example legal retention, security, or completing a transaction).
• Right to correct: request correction of inaccurate personal information we maintain about you.
• Right to opt out of “sale” or “sharing”: we do not sell personal information for money. We may use analytics/advertising cookies on our marketing site only with consent where required; you can refuse or change this in Cookie settings. We honor Global Privacy Control (GPC) signals as a request to decline non-essential tracking cookies.
• Right to non-discrimination: we will not discriminate against you for exercising privacy rights.
• How to exercise: email privacy@taskshot.app or support@taskshot.app with “Privacy Request” in the subject. We may need to verify your identity before fulfilling a request.
• Authorized agents: California residents may designate an authorized agent; we may require proof of authorization and identity verification.
• This section summarizes rights commonly available under CCPA/CPRA and similar U.S. state laws and does not expand or limit rights beyond what applicable law requires. EU/EEA users retain their GDPR rights described above.