Taskora Privacy Policy

1. Who we are

Taskora Ltd, a private limited company registered in England and Wales (company number 16736403). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

• Privacy questions, requests and complaints:privacy@taskora.ai
• Support: support@taskora.ai
• General: hello@taskora.ai

You can also write to us at the registered office. This version of the policy took effect on 6 October 2026.

2. What this policy covers

We do two different jobs with data, and the law treats them differently. It matters, so we state it up front.

"Customer" means the organisation — or the individual — that owns a workspace. Every customer is the controller of the data in its workspace, and the DPA covers every customer, company or individual alike. If you use the app as a member of someone else's workspace, the customer — not Taskora — is the controller for your account and content, and requests about it go through them (section 12).

3. A few terms

• The Website — taskora.ai pages, the blog, our newsletter and waitlist forms, and our email inboxes.
• The Services — the Taskora app: workspaces, boards, projects, sprints, tasks and comments.
• Workspace — a shared space a customer creates in the Services.
• Personal data — information that identifies a person, directly or indirectly.

4. Data we collect on the Website

Here we are the controller.

4.1 The pages you view

Each page load sends one small report to our own server. It records:

• the page you opened;
• the page that brought you here (referrer), and any campaign tag attached to the link;
• a trimmed browser description (a shortened user-agent string);
• your country, taken from Cloudflare's country header — never a precise location;
• the time.

That is the whole record the visit tracker keeps: no IP address in it, and nothing written to your device. Separately — as every web server must — our server reads your IP address to deliver the page, and keeps it in technical and security logs for error monitoring, rate limiting and abuse prevention. Those log lines, which include IP addresses and request metadata, are handled by New Relic, our monitoring provider, as sections 9, 10 and 14 disclose. Known bots and crawlers are filtered out of the visit records. We use the visit records to see which pages are read and where visitors come from — nothing else.

4.2 Newsletter and waitlist sign-ups

When you sign up with your email, we store:

• your email address;
• whether you asked for marketing emails when you signed up;
• technical details of that moment: your IP address, country, browser, the page you signed up from, the campaign tag or form label, a request reference and the time.

The technical details exist to prevent abuse and to show us where sign-ups come from. Your address is kept in our own database and, where the connection allows, also forwarded to MailerLite, which sends the confirmation email and the newsletter. You can unsubscribe at any time via the link in any email, or by writing to us.

4.3 Emails you send us

If you write to privacy@taskora.ai, support@taskora.ai or hello@taskora.ai, we keep your message, your email address and our reply, so we can help you and keep a record of what was done. These conversations are our records, and we are the controller for them — even when you write to us about a workspace. The workspace content itself stays under the customer's control (section 5).

5. Data in the Services

Here, the customer is the controller. We process on its instructions, under our Terms of Use and the DPA.

5.1 Your account

You sign in using the method offered at signup — today a secure link sent to your email address. We hold that address, your sign-in events and which workspaces you belong to. Sign-in and the product database run on Supabase in the Frankfurt region (AWS eu-central-1, Germany).

5.2 Workspace content

The work you and your team put in: boards, projects, tasks, comments, files you attach, and anything else you add. This content belongs to the customer. We host it and run the service on it — nothing more. Files you attach are stored in Supabase's file storage, in the same Frankfurt region as the database. We do not train AI models on workspace content and we do not share it with anyone outside the companies that run the service for us (section 14).

5.3 Invitations

If someone invites you to a workspace, the inviting organisation gives us your email address so we can send the invitation and set up your membership.

5.4 Billing

Taskora is free to start and no card is needed. Paid plans begin on 1 November 2026. The payment processor for paid plans is still to be determined, and will be announced in this policy, in the terms and at checkout before billing starts. When that happens, card details and payment data go to that processor, never to us, and the processor's own privacy policy governs them; the processor will be a separate company and an independent controller of your checkout and payment data. We will receive from the processor only what we need to run your account, and we hold our billing records as controller for our own accounting.

5.5 AI features

AI assist is in development. It is not live. The features are built on Mistral AI, a European AI company, but they are switched off for every account: no AI provider processes your data today. When AI features launch, Mistral AI joins our subprocessor list through the notice our data processing agreement requires, we update this policy, and customers hear it first. Our licence to use customer content stays limited to running the service. We will not train AI models on your workspace content, and if that is ever going to change we will say so clearly before it applies.

One honest footnote: the companies that run the service have subprocessors of their own — Supabase's published list, for example, includes other providers. Those chains are governed by our providers' own data processing agreements, which we review on appointment.

6. Why we use your data

On the Website:

Where we rely on legitimate interests, we have weighed them against your privacy and kept the data as small as the job allows — that is why the visit record holds no IP address. You can object at any time (section 12).

In the Services, we do not choose the purposes — the customer does, under its relationship with its members. For our own record-keeping we rely on: contract (running your account and billing), legal obligation (tax and accounting records) and legitimate interests (keeping the service secure and working).

7. What we don't do

A short list we are happy to be held to:

• No ad-tech on the Website. No advertising networks, no marketing pixels, no cross-site tracking.
• No third-party analytics, no consent question today. The site's only web analytics is our own visit record (4.1) — it stores nothing on your device, and no analytics script from anyone else runs on the site. If any analytics is ever added that writes to your device, first-party or third-party, we will ask first.
• We do not sell or rent personal data. Not to anyone, for any purpose.
• We don't train AI on your content. Workspace content, emails and support conversations are not AI training data.
• The visit record holds no IP address. The page-view record we keep stores none — though, like every web server, ours reads addresses transiently and logs them for security and monitoring (section 4.1).
• No AI features are live. When that changes, we will say so before you use them.

8. Cookies

One kind of cookie today — strictly necessary — and one rule: nothing non-essential without your consent.

Essential. Cloudflare, which sits in front of our site, sets the __cf_bm cookie (about 30 minutes) to tell people apart from bots. Sign-in to the app runs on Supabase Auth: your session lives in Supabase's own auth cookies — the sb- cookies holding your sign-in token and the refresh token that keeps it alive, set for the app's own domain so only the app reads them. These are strictly necessary — the app cannot keep you signed in, or secure, without them — so no consent is asked.

Analytics. The site's only analytics is our own visit record (4.1): it sets no cookies and stores nothing on your device, so the consent rules do not attach to it. There is no consent banner today; if we ever add analytics that needs one, we will ask before it loads and describe it here.

Global Privacy Control. If your browser sends a GPC signal, we treat it as a refusal of analytics — honoured today, and if a consent question ever returns.

9. Where your data lives

We are a UK company, and your account data and workspace content are stored in the European Union — Frankfurt, Germany. The honest picture:

• Your accounts and workspace content sit in Frankfurt, Germany. The product's database, sign-in and file storage run on Supabase in AWS's eu-central-1 region (Frankfurt). Supabase's contracting company is based in Singapore, so the arrangement itself counts as an international transfer — covered by Supabase's DPA (EU standard contractual clauses plus the ICO's UK Addendum), with the data at rest in Frankfurt.
• Hosting. The app and this Website run on Northflank, a UK company, in its Frankfurt region (europe-west-frankfurt) — so the application layer sits in the EU, next to your data. The UK treats the EEA as offering equivalent protection, so UK users' data hosted there needs no extra transfer safeguard, and for EU users it is in-region. For anything processed outside the UK and EU, standard contractual clauses with the ICO's UK Addendum in our agreement with the provider apply — as described below.
• Cloudflare is a US company. It runs a global edge network, and at the edge it briefly processes traffic data — including IP addresses and routing information, sometimes in the US. Its DPA covers this with standard contractual clauses, the UK Addendum, and certification under the UK Extension to the EU-US Data Privacy Framework (the "Data Bridge").
• New Relic is a US company, on its EU data region. Our monitoring provider receives the server log lines described in section 4.1 — IP addresses and request metadata — for error tracking and performance monitoring. Our account runs on New Relic's EU data region, so the logs are stored in the EU. New Relic keeps some of its own operational and account data in the US, and its DPA covers that with standard contractual clauses and the ICO's UK Addendum.
• Google (Workspace email). Messages you send us (section 4.3) are handled there under Google's processing terms — standard contractual clauses plus the UK Extension to the EU-US Data Privacy Framework (the "Data Bridge").
• MailerLite. Our newsletter provider stores subscriber data in the EU, on Google Cloud infrastructure according to its own disclosures; the EU needs no extra transfer mechanism under UK adequacy. Its own sub-processor chain does include US companies, and those transfers are covered by MailerLite's DPA (standard contractual clauses and the UK Addendum).
• Resend (Plus Five Five, Inc., US). Our transactional-email provider sends sign-in links and workspace invitations. Its primary processing is in the US, and it is covered by standard contractual clauses plus the ICO's UK Addendum in our Data Processing Agreement — it is also certified under the EU-US Data Privacy Framework and its UK Extension (DPA Annex III).
• Payment processor. Still to be determined before paid plans start on 1 November 2026. It will be an independent controller of checkout and payment data under its own privacy policy, and we will disclose it here — with the transfer safeguards in its agreement — before it processes any payment data.

If you visit from the EU: the European Commission treats the UK as adequate, so your data reaching us needs no extra safeguard.

The plain summary: your account data and workspace content are stored in Frankfurt, Germany, in the European Union — covered by the UK's adequacy designation for the EEA if you are in the UK, and in-region if you are in the EU. The remaining processing outside the UK and EU — at Cloudflare's global edge, and at Google, New Relic and Resend — is covered by the safeguards described above.

10. How long we keep it

One honest caveat on deletion: deleted data can persist in encrypted backups until the rolling backup cycle expires — and deleted data is never restored from backup except to recover the live service. Backups exist only to recover the service, never for any other use. The cycle length is stated in our Data Processing Agreement.

11. Security

• All traffic travels over TLS.
• Data is encrypted at rest on managed infrastructure — Supabase's Frankfurt database and the platform volumes that host our site.
• Access is limited to the few people at Taskora who need it, each with an individual account.
• We deliberately hold very little data. The most secure data is the data you never collected.
• We hold no security certifications, such as ISO 27001 or SOC 2. We would rather say that plainly than dress it up.

12. Your rights

Whatever your basis for being here, you have these rights over your personal data, free of charge:

• Access — ask what we hold and get a copy.
• Rectification — ask us to fix what is wrong.
• Erasure — ask us to delete it, where the law allows.
• Restriction — ask us to pause use while something is disputed.
• Portability — get data you gave us, in a machine-readable format, to take elsewhere.
• Objection — object to processing based on legitimate interests, including direct marketing. We stop unless the law requires us to continue.
• Automated decisions — your rights around decisions made purely by machines. We make none today (section 15).
• Withdraw consent — where we rely on consent (newsletter marketing), withdrawing is as easy as giving it.

How to exercise them. Email privacy@taskora.ai — or hello@taskora.ai if that is easier. Tell us enough to find the data — normally your account email is enough. We will not demand ID to discourage you, and we only ask for more when we genuinely cannot tell it is you. You can ask someone to act on your behalf.

Timing. We respond within one month. The clock starts when we have your request and anything we genuinely need to identify you. If your request needs clarification, we may pause the clock while we wait for your reply. For genuinely complex or numerous requests, we can extend by up to two further months, and we will tell you why within the first month.

Workspace members. For account and content data in the Services, your organisation is the controller. Ask its admin first. If you write to us directly, we will help where we can and point you back to your organisation where the decision is theirs.

Complaints. If you think we have got something wrong, tell us and we will treat it as a formal complaint: we will acknowledge it within five working days and respond substantively without undue delay. You can also complain to the UK's data protection regulator at ico.org.uk — the Information Commissioner's Office became the Information Commission on 30 September 2026; same office, same role, still called the ICO. If you are in the EU, you can complain to your local supervisory authority instead.

EU users. If you are in the EU, the EU GDPR applies to our processing of your data and gives you equivalent rights; this policy is written to meet both regimes.

13. Children

Taskora is for adults. You must be 18 or over to create an account, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Who we share data with

We share only with companies that run the service, under contracts that bind them to our instructions — including data processing agreements where the law requires them. Never with advertisers or data brokers.

The Website — we are the controller:

The Services — we are the processor, matching the DPA:

Transactional email runs on Resend today. Paid plans begin on 1 November 2026; the payment processor is still to be determined and will be disclosed here before billing starts — as an independent controller of checkout and payment data, so it will not sit in our subprocessor list. Our AI features are built on Mistral AI (France, EU) and are currently switched off for every account.

Before we add or replace a subprocessor in the Services, we give customers notice as the DPA requires. If AI features launch, the AI provider joins this list the same way.

15. Automated decision-making

We make no decisions by purely automated means today, profiling or otherwise. If we ever do — say, fraud checks — the law's safeguards apply, including your right to human review.

16. Changes to this policy

We keep this policy current. For material changes we will notify account holders by email or a notice in the app before the change takes effect. The date at the top tells you which version you are reading.

17. Contact

Questions about privacy, requests and complaints: