Privacy Policy

When you use TaskFlow, we collect and store:

• Account info — name, email, and password (stored as a bcrypt hash, never in plain text)
• Workspace content — messages ingested from connected integrations, the tasks/projects/clients your team creates or that our AI creates from those messages, and team member specialties
• Integration credentials — OAuth access/refresh tokens for services you connect (Outlook, Slack, Notion), stored encrypted at rest
• Support chat transcripts — conversations with our in-app AI support widget, including any human handoff
• Billing info — handled by LemonSqueezy directly; we store your subscription status and plan, not your card number
• Usage/error data — logs needed to operate and debug the Service (see Sentry below)

We use your data only to:

• Run the Service — process inbound messages, generate tasks and draft replies, show your reports
• Provide support when you ask for it (including via the AI support widget and human handoff)
• Send account and billing notifications (password resets, workflow alerts, support handoff emails)
• Debug and improve the Service (aggregated/error-level, not reading your message content for this purpose)

We do not sell your data, and we do not use your workspace content to train AI models.

Message content you send to TaskFlow is sent to Google Gemini (Google's AI API) to generate tasks, detect clients, and draft replies. This means message content leaves our infrastructure and is processed by Google under Google's API terms. Don't send data through TaskFlow that you're not permitted to share with our AI sub-processor.

We use these third parties to run the Service. Each only sees the data it needs to do its job:

• Google Gemini — AI processing of message content (see above)
• Vercel — application hosting
• Neon — primary data storage (Postgres)
• Upstash — Redis cache and background job queue (short-lived operational data, not long-term storage)
• LemonSqueezy — payment processing and billing (merchant of record)
• Resend — transactional email delivery (password resets, notifications)
• Sentry — error monitoring (stack traces and request metadata; we redact auth tokens and cookies before they reach Sentry)
• Microsoft, Slack, Notion — only for the integrations you explicitly connect, and only to the extent of the permissions ("scopes") you approve during their OAuth consent screen

We keep your workspace data for as long as your account is active. If you delete your account, we delete your workspace data within 30 days, except where we're required to keep billing records longer for tax/legal reasons. Disconnecting an integration revokes our access and stops new data from being ingested, but doesn't retroactively delete messages already processed — delete your account or contact us if you need that.

You can, at any time:

• Export your data (Reports → Export CSV covers reporting data; contact us for a full export)
• Disconnect any integration from Settings → Integrations
• Delete your account and associated data from Settings
• Ask us what data we hold about you, or ask us to correct or delete it, by emailing us

Passwords are hashed with bcrypt. Integration OAuth tokens are encrypted at rest. We use short-lived access tokens with refresh-token rotation for your own login session, and rate-limit authentication endpoints against brute-force attempts. No system is 100% secure — if we discover a breach affecting your data, we'll notify you without undue delay.

The Service is intended for business use by adults and is not directed at children under 16.

If we make a material change to how we handle your data, we'll notify you by email or an in-app notice before it takes effect.

Questions, data requests, or deletion requests: support@taskflow.com.