Privacy Notice

Who is responsible

Taskr is responsible for account, service-security, support and product-improvement data. A customer organisation is responsible for deciding what personal data its users place in tasks, evidence and workspace records; Taskr processes that material to provide the service. The applicable legal operator will be identified in a customer’s order or written agreement before paid service begins.

Data we use

• Account identity, verified email, profile preferences, security factors and session records.
• Organisation memberships, assigned work, checklist answers, evidence metadata, files, approvals and audit history.
• Support messages and their reply address.
• Server-derived lifecycle events using a pseudonymous actor hash, event name, organisation reference and a small allowlisted property set.
• Security and service logs needed to detect faults, abuse and unauthorised access.

Purposes and lawful bases

We use account and workspace data to perform the service requested by users and customer organisations. We use security, reliability and minimal product-usage data for legitimate interests in protecting and improving Taskr. Where law requires consent, it is requested separately; accepting these documents does not opt you into marketing.

Service providers

Cloudflare provides Worker compute, D1 data storage, R2 evidence storage and transactional email. Slack or Microsoft Teams receive operational messages only when a workspace administrator configures those destinations. Stripe will process billing information only after Taskr billing is activated. Providers may process data in other countries subject to their contractual transfer safeguards.

Retention

Authentication tokens expire automatically. Product analytics events are deleted after 400 days. Workspace administrators control operational retention within Taskr’s backup and legal-hold safeguards. Support and security records are kept only as long as needed to resolve the request, protect the service and meet legal obligations.

Your choices and rights

Account holders can export their account data and request deletion from Account settings. Depending on applicable law, you may also ask for access, correction, restriction, objection or portability, and may complain to the UK Information Commissioner’s Office. Organisation-controlled workspace data requests should first be directed to that organisation.

Contact

Submit a privacy or data request through Taskr Support and choose “Data and privacy”. The generated reference lets the request be traced without putting sensitive details into URLs.