Privacy policy

1. What we collect

Account details (name, email address, language), the work you upload (files, tasks, comments, approvals), technical usage data (IP address, browser, request timing) and an activity log. At each sign-in we derive an approximate location, the country and city of the IP address, on our own servers from a local copy of MaxMind's GeoLite database; the address is not sent to an external lookup service. Platform super-admins may view the location in the admin console. Your personal data export includes your sign-in events. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com. Cookies and site measurement are described in section 8.

2. Why we use it

To run the service, verify who you are, prevent abuse, bill you, and answer you when you get in touch. Google Analytics shows us how the site and the product are used, so we know what to improve (section 8). We also contact a business once, at the business contact details it publishes (section 7). We do not sell data, we do not hand it to advertisers, and we use no advertising features.

3. Artificial intelligence

A language model only ever receives your organisation's context, never another organisation's. Every call is logged with its cost, and every organisation has a kill switch. The providers we use do not train models on your data.

4. Where the data sits

Our servers, database and files are in the European Union (Google Cloud europe-west1, Belgium), and backups stay in the same region and support point-in-time restore. Some providers process data outside the European Union: email, SMS, payments, error reporting and AI providers, and Google Analytics (section 8).

5. How long

Work content is kept while the organisation is active. After a deletion request we export, mark deleted, and delete permanently after thirty days. The audit trail is kept longer, without identifying detail.

6. Your rights

You may ask for a copy of your data, correct it, delete it or object to processing. Exporting your data, closing a workspace and deleting your account are available directly from the settings screen, without waiting for us. Any other request is answered within thirty days, at the address below.

7. Business outreach

We may email a business once about Tasked, at the business contact address it publishes on its own website or in a public production directory. For that we keep the business name, website, the published email address and phone number, where and when we found them, the message we sent, whether it was delivered, opened or clicked, and any reply. Opens and clicks are measured with an image and a link on our outreach domain. If you reply, Anthropic, PBC, an AI provider in the United States, may process your reply so that we can draft our answer, and a person on our team reads and sends every answer. Every message carries an unsubscribe link, and after you unsubscribe we keep only a one-way code of your address so that we never write again. A contact we never wrote to is deleted after 24 months, delivery records after 13 months and replies after 24 months. If you later sign up for Tasked, we note that on the business contact record, never on your account. You can object, or ask for a copy or the deletion of this data, at any time from the link in the message or at the address below.

8. Cookies and site measurement

Essential cookies keep Tasked working, so they need no consent: tasked_session keeps you signed in, tasked_csrf protects against forged requests, tasked_lang remembers your interface language, tasked_portal opens the client portal and tasked_impersonation marks a support session run by our staff. tasked_consent keeps your cookie choice for 12 months. Display preferences such as the theme stay in your browser's own storage.

Tasked's own first-party counter records five named marketing interactions on the public site, plus one server-recorded count of completed signups. That counter stores aggregate daily counts by event, fixed option and language, with no visitor identifier or IP address, uses no third-party service and sets no cookie of its own.

Google Analytics measures visits to the public site and use of the app: the pages opened, the device and browser, where the visit came from, and an approximate location (country and city) that Google derives from the IP address without storing the address. Page addresses reach Google with organization names and record identifiers removed, and a signed-in user reaches it only as an anonymous code, never as a name or an email address. The client portal, share links, receipts, the platform console and every link that carries a one-time code (password reset, email verification, signup completion, invitations, device pairing, coupons) are never measured. Advertising features, ad personalization and Google Signals are off. Google's cookies (_ga, and _ga_ followed by an identifier) expire 13 months after your last visit; Google keeps the data for 14 months and may process it outside the European Union.

In Europe (including the European Economic Area, the United Kingdom and Switzerland) and in Brazil, measurement starts only after you agree; we tell by your browser's time zone, and when it cannot be read we ask. Elsewhere it runs unless you turn it off, and it starts off in a browser that sends the Global Privacy Control signal. You can change your choice at any time from Cookie settings, at the foot of every public page and in the account menu inside the app. Turning measurement off also deletes Google's cookies.

9. Data from Google

If you sign in with Google, Google shares your email address, name and Google account identifier with us. We use them only to sign you in to an existing Tasked account, and we keep only the account identifier, linked to that account. If your workspace connects Google Drive, Tasked can open only the files a member picks in Google's own file picker, never the rest of the Drive, and copies each picked file into the project the member chose. The Google access tokens are stored encrypted and deleted when the workspace disconnects Drive, and you can also remove Tasked's access from your Google account settings at any time. Tasked's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information, use it for advertising or use it to train AI models, and no one on our team reads it unless you ask us to, security requires it or the law does.