TaskQo privacy policy

This privacy policy explains how TaskQo ("we", "us" or "our") collects, uses, shares and protects personal data when you visit our websites, sign up for or use our desktop, mobile and web apps (together, the "Services"), or get in touch with us. It also explains the privacy rights you have and how to use them.

Please read this policy together with our Terms of service, which govern your use of the Services. By using the Services or creating an account, you confirm that you have read and understood this policy. If you do not agree with it, please do not use the Services.

We may change this policy from time to time. When we do, we will update the "Last updated" date above and, for material changes, let you know in advance as described in section 14.

1. Contact information

If you have questions, comments or concerns about this policy or our privacy practices, or you want to exercise any of your privacy rights or opt out of communications, contact us at:

• Email: privacy@taskqo.com
• Support: our Customer support page (choose "Privacy or data request" as the topic)

2. Who this policy applies to

This policy covers personal data that TaskQo handles as a controller, meaning we decide why and how it is used. That includes data about:

• visitors to our websites and people who contact us, request a demo or subscribe to updates;
• account owners, administrators and billing contacts of our customers; and
• Members (team members and contractors) in their dealings with TaskQo directly, such as when they contact our support team.

Workforce Data is different. When an organization (your employer or the business you contract with) uses TaskQo to capture work activity, that organization is the controller of the resulting Workforce Data and TaskQo processes it on its behalf as a processor. The organization's own privacy notice governs that processing. If you are a Member and have questions about what is captured about you, please contact that organization first; we will help them respond to your request.

We are not responsible for the privacy practices of third-party services that interact with ours. Please review their privacy policies before using them.

3. Personal data we collect

"Personal data" means any information relating to an identified or identifiable individual, such as a name, email address, phone number, online identifier or location. It does not include aggregated or de-identified data from which a person cannot reasonably be identified.

We rely on the following legal bases to process personal data:

• you have given your consent;
• the processing is necessary to perform our contract with you or to take steps at your request before entering into one;
• it is necessary to comply with a legal obligation, a court order, or to establish or defend legal claims;
• it is necessary to protect someone's vital interests; or
• it is necessary for our legitimate interests, or those of a third party, such as running, securing and improving the Services, provided those interests are not overridden by your rights.

Where we rely on consent, you can withdraw it at any time by emailing privacy@taskqo.com.

Information you give us

• Account information: your name, work email address, company name, team size, role and password, and optionally a phone number and profile photo.
• Workspace information: your organization's name, Members' names, emails and roles, shift and rota settings, pay rates, capture and redaction settings, and integrations you connect.
• Payment information: billing name and address, and details of the plan you buy. Card details are collected and stored by our third-party payment processor; we only receive limited information such as the card type, last four digits and expiry date.
• Support information: what you tell us when you open a ticket, chat with us or send us screenshots or logs. Please do not include sensitive information you do not want us to see.
• Form and correspondence information: details you submit through our website forms (for example, to book a walkthrough) and the content of emails you send us.
• Marketing preferences: whether you have subscribed to or unsubscribed from our updates.

TaskQo does not require customers to provide special category or sensitive personal data (such as information about health, religion, political opinions, sexual orientation, trade union membership, or biometric data). However, depending on customer configuration and on-screen or recorded content, Workforce Data may incidentally contain sensitive information. Customers are responsible for configuring capture, redaction and retention settings appropriately and in accordance with applicable law.

4. Information collected through the Services and automatically

Workforce Data (processed on behalf of our customers)

Depending on the features a customer enables, the TaskQo apps may capture the following about a Member during their scheduled shifts:

• time worked, shift, break, attendance and leave records, and pay calculations;
• periodic screenshots and full-shift screen recordings;
• the names of applications and website URLs in use;
• activity levels, meaning whether the keyboard and mouse are in use, not what is typed;
• call and meeting audio, speaker-labelled transcripts and summaries, where call review is enabled;
• AI verdicts (productive, unproductive or idle), one-line summaries and integrity flags, such as signs of mouse jigglers, remote desktop sessions or virtual machines; and
• device information such as operating system and app version.

TaskQo does not capture typed text by default. If a customer enables typed-text capture, typed content may be collected during configured monitoring periods in accordance with the customer's settings and applicable law, and customers can configure the available redaction controls for sensitive information. Capture only runs inside the shift windows the customer configures, and where redaction rules are enabled, sensitive screens (for example, banking or health apps) are blurred on the device before anything is stored.

Information collected automatically

• Log and device data: IP address, browser type, operating system, device identifiers, pages visited, referring pages, access times and error or crash reports.
• Approximate location: derived from your IP address. We do not collect precise GPS location.
• Cookies and similar technologies: small files stored on your device that keep you signed in, remember preferences and help us understand how our websites are used. Where the law requires it, we ask for your consent before setting non-essential cookies. You can block or delete cookies in your browser settings, although some features may then stop working.
• Analytics: aggregated usage information that helps us understand which features are used and fix problems.

5. How we use and share personal data

We use personal data to provide and operate the Services, set up and secure accounts, process payments, respond to support requests, send service and billing messages, send marketing (which you can opt out of at any time), detect and prevent fraud and abuse, comply with legal obligations, and improve the Services using aggregated or de-identified information.

AI processing. Workforce Data is analyzed by AI models to produce verdicts, transcripts and summaries. This happens using models hosted by TaskQo or models from third-party cloud AI providers acting under contract with us. We do not allow our AI providers to train their models on Customer Data.

We do not sell personal data for money. We share it only in the following circumstances:

• Service providers: companies that help us run our business, such as hosting, storage, AI processing, payment processing, email delivery, customer support and analytics providers. They may use personal data only to perform services for us and must protect it.
• Your organization: if you are a Member, the administrators and managers in your organization's workspace can see Workforce Data according to the permissions they configure.
• Integrations: third-party tools you or your organization choose to connect, such as Slack or Discord.
• Business transactions: if we are involved in a merger, acquisition, financing, reorganization or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.
• Legal and safety reasons: when we believe in good faith that disclosure is required by law, court order or a valid government request, or is necessary to protect the rights, property or safety of TaskQo, our customers or others.
• With your consent: in any other case where you have asked us to share it.

We may share aggregated or de-identified information that cannot reasonably be used to identify anyone.

6. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• to access the personal data we hold about you and receive a copy;
• to correct inaccurate or incomplete personal data;
• to delete your personal data;
• to restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• to data portability, meaning to receive your data in a structured, commonly used format;
• to withdraw consent at any time, without affecting processing that happened before; and
• to lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@taskqo.com. We will respond within the time required by law, usually within 30 days, and may need to verify your identity first. We may decline or limit a request where the law allows, for example where we must keep information for legal, security or fraud-prevention reasons, and we will explain why.

If you are a Member, your organization controls your Workforce Data, so please send requests about it to your employer or the business you contract with. We will help them respond.

Data retention

We keep account and billing information for as long as your account is active and afterwards for as long as needed to meet legal, tax and accounting obligations, resolve disputes and enforce our agreements. Workforce Data kept in TaskQo storage is kept for the retention period the customer configures. When an agency is closed, its data is deleted 30 days later, and removed from our backups within a further 7 days, unless the law requires otherwise. Website log files are kept for a short period unless they are needed for security investigations.

Opting out of communications

You can unsubscribe from marketing emails using the link in any email or by contacting us. You cannot opt out of essential service messages, such as account verification, billing and security notices, while you have an account.

Do Not Track and Global Privacy Control

Our websites do not respond to browser "Do Not Track" signals. Where the law requires it, we treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal data for that browser.

7. Data security

We take reasonable technical and organizational measures to protect personal data from loss, misuse and unauthorized access, disclosure, alteration or destruction. These include encryption in transit (TLS) and at rest, role-based access controls, least-privilege access for our staff, logging and monitoring, and on-device redaction of sensitive screens.

No system is completely secure, so we cannot guarantee the security of information you transmit to us. Please help protect your account by choosing a strong, unique password, keeping it confidential and signing out of shared devices. If you believe your account has been compromised, or you have found a security vulnerability, contact security@taskqo.com.

8. Data protection responsibilities

Customers who use TaskQo to process personal data about Members act as the controller, and TaskQo acts as their processor. As controller, the customer is responsible for having a lawful basis for monitoring, giving Members clear notice, obtaining consent where required, carrying out any required impact assessments and responding to Members' requests. Our Data Processing Agreement sets out both parties' obligations and is available on request at privacy@taskqo.com.

9. International data transfers

We and our service providers may process personal data in countries other than the one where you live, including the United States. Those countries may have data protection laws that differ from yours. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Where a customer selects regional processing or its own storage, we keep processing within those choices to the extent the feature supports it.

10. Additional notice for California residents

This section applies to California residents and supplements the rest of this policy. It covers personal data TaskQo handles as a business; it does not cover Workforce Data we process as a service provider for our customers.

In the past 12 months we have collected the following categories of personal information: identifiers (such as name, email address and IP address); commercial information (such as plans purchased); internet or network activity (such as pages visited and interactions with our Services); approximate geolocation derived from IP address; and professional information (such as employer and job title). We collect it from you directly, automatically from your use of the Services, and from service providers such as analytics providers, for the business purposes described in section 5.

We disclose these categories to service providers for business purposes. We do not sell personal information for money. If we use advertising cookies, this may count as "sharing" for cross-context behavioral advertising under California law, and you can opt out using a Global Privacy Control signal or by emailing us. We do not knowingly sell or share the personal information of anyone under 16, and we do not use sensitive personal information to infer characteristics about you.

California residents have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale or sharing; and not to be discriminated against for exercising these rights. You may use an authorized agent to make a request on your behalf, and we may ask the agent for proof of authorization and ask you to verify your identity. To make a request, email privacy@taskqo.com.

Under California's "Shine the Light" law, you may also ask us once a year about personal information we disclosed to third parties for their own direct marketing. We do not disclose personal information for that purpose.

11. Other U.S. state privacy rights

Residents of other U.S. states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, may have similar rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale or profiling. To exercise them, email privacy@taskqo.com. If we decline your request, you can appeal by replying with "Appeal" in the subject line, and we will respond within the time required by law. Nevada residents may submit a sale opt-out request to the same address, although we do not sell covered information.

12. Children and data collection

Our websites and Services are intended for businesses and adults. We do not knowingly collect personal data from children under 16. Customers must not enroll anyone under 16 as a Member, and must follow any additional legal rules that apply to monitoring young workers. If you believe a child has provided us with personal data, contact privacy@taskqo.com and we will delete it.

13. Complaints and enforcement

We regularly review our compliance with this policy. If you have a concern about how we handle personal data, please contact us first at privacy@taskqo.com and we will investigate and try to resolve it. You also have the right to complain to the data protection authority where you live or work.

14. Updates to this policy

We may update this policy to reflect changes to our Services, our practices or the law. The current version will always be available on this page. If we make a material change, we will let you know by email or through the Services before it takes effect. You can contact us to request a previous version.