Privacy Policy

1. Introduction

TaskOH ("we", "us", or "our") operates the TaskOH platform at taskoh.app and its associated services, including the web application at app.taskoh.app.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use TaskOH, our client task management software with a client portal. By using TaskOH, you agree to the practices described in this policy.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Display name
• Account preferences and settings

Project Data

When you use TaskOH, we store the content you create and upload:

• Projects, tasks, and ticket details (titles, descriptions, statuses, priorities)
• Comments and feedback
• Files you attach to tasks and client requests
• Activity logs and audit trails

AI Processing Data

When you import a Word (.docx) document, its text and embedded images are sent to OpenAI to draft tasks. On Pro and Business, the same applies to emails or notes you paste for import. The Word file itself is deleted from our servers as soon as it has been read; the resulting drafts and the tasks you save are stored within your project. We do not use your documents, pasted content or extracted data to train AI models.

OpenAI processes this content under its API terms: it does not use API data to train its models and may keep it for up to 30 days for abuse monitoring. This processing may take place outside the EEA (in the United States) under OpenAI’s applicable data protection terms. Read OpenAI’s privacy policy.

If you connect your own AI assistant (for example Claude or ChatGPT) with a personal access token, that assistant’s provider receives the project data your assistant requests, under your own agreement with that provider. You can revoke a token at any time in Integrations.

Payment Information

Payments are processed by Stripe. We do not store your credit card numbers, bank account details, or other sensitive payment credentials on our servers. Stripe may collect and store payment information in accordance with their own privacy policy.

Usage Data

We automatically collect certain technical information:

• IP address and approximate location
• Browser type and version
• Pages visited and features used
• Date and time of access
• Referring website

We also keep security logs of failed authentication attempts (including the client IP address and request path) for abuse prevention.

3. How We Use Your Information

We use the information we collect to:

• Provide the service — create and manage your account, projects, tasks, and team memberships
• Draft tasks with AI — analyze imported Word documents and pasted emails or notes to draft tasks
• Authenticate users — send sign-in link emails for passwordless sign-in
• Process payments — manage subscriptions and billing through Stripe
• Send transactional communications — notifications about project activity, approval requests, and account changes
• Improve the service — analyze usage patterns to fix bugs and improve features
• Ensure security — detect and prevent fraud, abuse, and unauthorized access

4. Data Sharing & Third Parties

We do not sell your personal data. We share data only with the following categories of service providers, and only as necessary to operate TaskOH:

• Payment processing — Stripe processes subscription payments on our behalf
• AI processing — OpenAI drafts tasks from imported Word documents and pasted emails or notes (see “AI Processing Data” above)
• Email delivery — Mailgun, from its EU region, sends sign-in links, invitations and notifications; it processes recipient email addresses and the content of those emails
• Network and security — Cloudflare delivers our websites and protects them from abuse; it processes technical request data such as IP addresses
• Analytics (optional) — Google Analytics, only after you allow it (see section 8)
• Cloud hosting — our application and database run on servers within the European Union

We may also disclose information if required by law, regulation, legal process, or governmental request.

5. Client Portal & Shared Access

TaskOH allows workspace admins and project managers to invite team members and clients to a project:

• Team members work with tasks, comments and files according to their project role. Admins and project managers can create and edit tasks, invite people and request approvals; only admins can delete projects or manage the subscription
• Clients (the Guest role, on Solo, Pro and Business) see only the tasks shared with them in the projects they are invited to. In the client portal they can submit requests, comment, attach files, respond to estimates, and approve deliveries or request changes. Internal notes and tasks you have not shared are not visible to them
• Sign-in — invited people receive a time-limited invitation link. Afterwards they sign in with a single-use email link that expires after 15 minutes, or with a password if they set one

Project owners are responsible for managing who has access to their projects. When you share a project with someone, they will be able to see the project data you have chosen to make visible.

6. Data Storage & Security

We take the security of your data seriously:

• All data is transmitted over HTTPS (TLS encryption in transit)
• Passwords are optional — you can sign in with an e-mailed link instead; a password you do set is stored only as an Argon2id hash
• Database access is restricted to internal application containers only
• Our servers are hosted within the European Union

Storage Limits

File storage is subject to your subscription plan limits:

• Free and Solo: 100 MB per workspace
• Pro: 5 GB
• Business: 50 GB

Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data and project data within 30 days, except where we are required by law to retain it longer.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Deletion — request deletion of your account and associated data
• Data portability — request an export of your data in a machine-readable format
• Restriction — request that we limit processing of your data
• Objection — object to processing of your data for certain purposes

To exercise any of these rights, contact us at legal@taskoh.app. We will respond within 30 days.

GDPR (European Economic Area)

If you are in the EEA, our legal basis for processing your data is: (a) your consent, (b) performance of our contract with you (providing the service), and (c) our legitimate interests in operating and improving the service. You have the right to lodge a complaint with your local data protection authority.

8. Cookies & Local Storage

TaskOH uses the following browser storage mechanisms:

• Authentication tokens — JWT tokens stored in local storage to keep you signed in
• Session preferences — your UI preferences (e.g., selected view, filters)

Optional Google Analytics measures public page visits, signup clicks, completed registrations, successful project creation and confirmed subscription purchases only after you choose “Allow analytics.” We do not load Google Analytics or send it events before your consent. We do not send account details, project content, private project URLs, card details or authentication tokens. Subscription purchase events include the plan, actual amount and currency, and an opaque transaction identifier; this is used to avoid counting the same checkout twice. Project creation events contain no project identifiers or content. Advertising features and Google signals are disabled. Google processes technical information such as browser, device and approximate location to provide aggregate reports; processing may involve transfers outside the EEA under Google’s applicable data protection terms. Read Google’s privacy policy.

Your analytics choice is stored in a first-party preference cookie for six months and shared between taskoh.app and app.taskoh.app. If you opt in, Google Analytics uses first-party _ga cookies with a maximum six-month lifetime. Use “Privacy settings” on either site to change your choice; rejecting analytics removes these cookies from this browser. After an opted-in purchase, this browser also stores up to 100 opaque transaction identifiers to prevent duplicate reporting. They expire from deduplication after six months and are removed on the next app visit or consent check; rejecting analytics clears them when the app next checks that preference. Withdrawing consent does not remove reports already collected. Contact us about data rights using the details above.

9. Children's Privacy

TaskOH is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us at legal@taskoh.app and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice within the application. The "Last updated" date at the top of this page indicates when the policy was last revised.

Your continued use of TaskOH after changes are posted constitutes your acceptance of the updated policy.