Privacy policy

1. Who we are

taskl.ie is operated by Rían Errity, trading as Paradaux (“we”, “us”). For privacy questions or requests, email rian@paradaux.io. This policy covers our website, application, authentication service, and related support.

We are the controller for account administration, website analytics, security, and our own communications. For personal data that an organisation puts into its workspace, that organisation normally acts as controller and we act as processor. Our data processing addendum governs that processing. Contact your workspace administrator about their use of your data; we will help route requests where needed.

2. Data we collect and why

• Account and identity: name, email, profile image where provided, identity-provider identifier, membership, permissions, and session information, to create accounts and manage access.
• Workspace content: issues, projects, comments, documents, attachments, messages, activity history, and integration content you or your organisation supply, to deliver collaboration, search, and enabled automation.
• Support: correspondence and information you send us, to answer requests and resolve problems.
• Technical and security information: IP address, browser and device information, request timestamps, errors, and access logs, to operate, secure, and troubleshoot the service.
• Website usage: page visits, referrers, approximate location, device/browser categories, and interactions such as clicks on sign-in or get-started links, to understand how the public website is used.

We receive data directly from you, from workspace members and administrators, and from integrations you authorise. Required account information is necessary to provide access. Optional integrations are not required to use an account.

3. Google sign-in

When you choose Google sign-in, we request openid, profile, and email. Google provides your account identifier, email and verification status, and basic profile information such as name and profile image where available. Our self-hosted authentication service uses this information to sign you in, link your account, and display your identity to authorised workspace members. Sign-in does not grant access to Gmail, Google Drive, or Calendar.

We store the account information needed to maintain your identity and sessions. We do not sell Google user data, use it for advertising, or use it to train AI models. Access is restricted to service delivery and authorised support, security, or legal needs. taskl.ie’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

You can revoke access in your Google account connections. Revocation stops future authorised access; it does not itself delete your taskl.ie account or existing workspace records. Request deletion at rian@paradaux.io.

4. Legal grounds

Where the EU or UK GDPR applies, we rely on performance of our contract to provide accounts and requested services; legitimate interests to secure the service, prevent abuse, answer enquiries, and understand basic website usage; legal obligations where records or disclosures are required by law; and consent where required for optional processing. We weigh legitimate interests against your rights, and you may object. You may withdraw consent at any time without affecting earlier lawful processing. Workspace processing follows the customer’s documented instructions and legal basis.

5. Analytics and cookies

We use Umami analytics on our own servers at umami.paradaux.io, backed by our own database. We do not use Umami Cloud. The public website uses cookie-free analytics to measure visits and selected interactions, not advertising profiles. Network requests still transmit technical information such as an IP address to our infrastructure; cookie-free does not mean no data is processed.

The application and authentication service use cookies or similar storage needed for sign-in, session security, and preferences. We do not use advertising cookies or sell analytics data. You can restrict scripts or cookies in your browser; blocking essential cookies may prevent sign-in. Where consent is legally required for non-essential tracking, it must be obtained before that tracking is used.

6. AI processing and no training

We use OpenAI’s API for AI features, including enabled assistance, triage, and semantic search. Depending on the feature, relevant prompts, issue or document content, messages, and contextual information are sent for inference or embedding generation. Workspace configuration and connected workflows determine which content is processed. Outputs and embeddings may be stored with workspace data.

We do not train AI models on your data or authorise our AI providers to use your data for model training. OpenAI’s API does not use inputs or outputs for training by default. This does not mean zero retention: abuse-monitoring logs and feature-specific state may be retained under OpenAI’s API data controls. Do not assume that AI processing takes place exclusively in the EU. External AI tools you connect through MCP are governed by your relationship with their providers.

7. Who receives data and where

Our primary application infrastructure is hosted on servers in France and Germany through OVHcloud and netcup (netcup.de). We operate services including authentication, databases, and Umami ourselves. Hosting in Europe does not mean every recipient processes data only in Europe.

• OVHcloud and netcup: server and infrastructure hosting.
• Cloudflare: DNS infrastructure and object storage used for infrastructure/database backups. Backup location depends on the configured storage jurisdiction; not all infrastructure backups are restricted to France or Germany.
• OpenAI: AI inference and embeddings for enabled features; processing may occur outside the EEA.
• Chosen integrations: Google for sign-in, and services such as GitHub, Discord, or external MCP clients when connected. They receive the information needed for the connection or actions you authorise and may act as independent controllers.
• Other recipients: authorised personnel and professional advisers where necessary, and authorities when legally required. A business transfer would be subject to applicable privacy obligations and any required notice or consent.

Workspace administrators control membership and visibility. Content made public by a workspace may be visible to anyone and indexed by search engines. We do not sell personal information or share it for cross-context behavioural advertising.

For restricted international transfers, we require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses and, where necessary, the UK addendum or IDTA, with supplementary protections as required. Contact us for information about safeguards relevant to your data. The DPA subprocessor list describes processing on customers’ behalf.

8. Retention and security

Account and workspace information is kept while needed to provide the service and follow the workspace controller’s instructions. Following a valid deletion request or termination, we delete or anonymise data unless retention is required for legal obligations, disputes, security, or another lawful purpose. Security logs and support records are kept only as long as reasonably needed for their purpose. Backup copies expire through backup rotation and remain restricted from ordinary use; deletion from live systems is not instantaneous deletion from every backup. Ask us for retention information for your workspace or data category.

We use access controls, encrypted network connections, secrets management, backups, and operational monitoring to protect data. No system can guarantee absolute security. Workspace administrators and users also need to protect credentials and configure sharing appropriately.

9. Your rights

Depending on your location and the applicable law, you may request access, a copy, correction, deletion, portability, restriction, or object to processing, including processing based on legitimate interests. You may withdraw consent and complain to your local data protection authority, including an EEA supervisory authority or the UK Information Commissioner. We do not use your data to make solely automated decisions with legal or similarly significant effects.

Where applicable US state privacy laws, including the CCPA/CPRA, apply, you may also request information about collection and disclosure, use an authorised agent, and appeal a refused request by replying to our response. We do not sell or share data for targeted advertising, and do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising privacy rights.

Send requests to rian@paradaux.io. We may ask for proportionate identity or authority verification. We respond within applicable statutory periods (normally one month under GDPR; generally 45 days under applicable US state laws), and explain any lawful extension or refusal. For customer-controlled data, we assist the relevant workspace controller.

10. Children and changes

taskl.ie is intended for users aged 18 or over and is not directed at children. Contact us if you believe a child has supplied personal data. We update this policy as the service changes, show the revision date, and notify affected users of material changes. Where required, we obtain consent before new uses of data.