Privacy Policy

This policy explains how Georgi Dragomirov, trading as Task5 (“we”), handles personal data when you use Task5. We are the controller for account and billing data. For content in a workspace used by a business, we process it on that business's behalf under our Data Processing Terms. Contact: georgi.macbookpro@gmail.com, 7 Somerset Road, Swindon, SN2 1NE. We are registered with the Information Commissioner's Office under number ZC285281.

What we collect

• Account: your email address, name and photo from your sign-in provider, two-step verification status, and your workspace memberships.
• Workspace content: projects, tasks, notes, dictation, plans, agent results, initiatives, ventures and their reports.
• Connected accounts (only if you connect them): email messages (sender, subject, date and text), calendar events, Teams meeting transcripts, and the repositories you choose on GitHub. Access tokens are encrypted (AES-256).
• Uploads: recordings, transcripts and chat exports you upload. Recordings are deleted after they are transcribed.
• AI keys: the Anthropic or OpenAI API keys you add, stored encrypted and never shown again.
• Billing: your plan and subscription status. Card details are collected and held by Stripe; we never see your full card number. To give each card one free trial, we store a one-way hash of the card's fingerprint and of connected email addresses.
• Usage and security: an audit log of actions in each workspace, AI usage and cost, device push-notification subscriptions, and technical logs.

How we use it and why

• To provide the service you signed up for: turning sources into tasks, running agents, sending notifications (contract).
• To take payment and manage subscriptions (contract, and legal obligations for accounting records).
• To keep Task5 secure, prevent abuse of free trials, and fix problems (legitimate interests).
• To tell you about important changes to the service or these policies (contract and legitimate interests).

We don't sell personal data, show ads, use tracking cookies, or use your content to train AI models.

AI processing

When an agent works, the relevant content (for example an email or a task and its context) is sent to the AI provider you chose, using your own API key, under your account with that provider. With OpenAI we ask for requests not to be stored. Please read your provider's terms on retention. Content is untrusted input: agents are instructed never to follow instructions found in it.

Google user data

Task5's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We read Gmail and Google Calendar data only to create tasks, briefs and agent context for you; we don't use it for advertising, don't sell it, don't let people read it except with your permission, for security or where the law requires, and don't use it to train general AI models.

Who processes data for us

Our hosting and our other service providers are listed on the subprocessors page. Data is stored in Google Cloud in London (europe-west2). Some providers (for example Stripe, Anthropic and OpenAI) may process data in the United States; transfers rely on the UK–US data bridge or the UK International Data Transfer Addendum.

How long we keep it

• Email text imported for triage: 30 days. Meeting and chat transcripts: 90 days. Uploaded recordings: until transcribed.
• Workspace content: until you delete it, the workspace or your account.
• Data exports: deleted from our storage within a day.
• Billing records: as long as the law requires (usually six years).
• Trial hashes: kept to prevent repeat trials; they can't be turned back into your card or email.

Your rights

Under UK data protection law you can ask for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You can export a workspace (Settings → Workspace) and delete your account (Settings → Security) yourself. For anything else, email georgi.macbookpro@gmail.com; we reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

Cookies and local storage

We use only what is needed to run the app: your sign-in session and preferences such as the selected workspace, stored in your browser. No analytics or advertising cookies, so we don't ask for cookie consent.

Security

Data is encrypted in transit and at rest; tokens and keys are additionally encrypted. Workspaces are isolated by access rules, and privileged actions run on our servers and are recorded in the audit log.

Children

Task5 is not for people under 18.

Changes

We will tell you about material changes to this policy before they apply.