Privacy Policy

For account holders and website visitors, TaskTuck decides how your data is used. We are the “controller” under GDPR and the “data fiduciary” under the DPDP Act.

For a business's own customers (people who send a request, receive a quote or invoice, or message a business), the business using TaskTuck is the controller or data fiduciary. TaskTuck processes that data only on the business's instructions, to run the service for them. If you are one of those customers, please contact the business first. We will help them handle your request, and you can also write to us.

• Account details: name, email address, sign-in method, role, team invitations, and an optional WhatsApp number you give us.
• Business details: business name, services, prices, time zone, currency and settings.
• Customer records a business enters or receives: customer names, emails, phone numbers, service addresses, requests and messages, quotes, jobs, schedules, checklists, job photos, notes, invoices and payment status.
• Messages: emails forwarded to TaskTuck, website requests, and SMS, WhatsApp and voice messages, including voice transcriptions.
• Data from apps you connect: Microsoft 365 mailbox messages and calendar events, Google Calendar events, and QuickBooks records, only when you connect them.
• Technical data: IP address, browser and device details, and security logs. For public request forms we store only a scrambled (hashed) form of the IP address, to stop spam.
• Billing: plan, billing status and invoices from Paddle. Card details stay with Paddle.
• Feedback you send us, and any screenshot you attach.

We do not sell personal data, show advertising, or use advertising or analytics trackers.

• To provide the service you signed up for, including sign-in, workspaces, the Inbox, quotes, jobs, scheduling, invoices, WhatsApp Command and connected apps. Basis: performing our contract with you.
• To keep TaskTuck secure, prevent spam, fraud and abuse, and fix problems. Basis: our legitimate interest in a safe, working service.
• To send service messages, such as sign-in links, invitations and important changes. Basis: contract and legitimate interest.
• Optional review-request emails from a service business: a business can send a preference confirmation only when you have asked for it. Review requests require your separate confirmation, are limited to one per email address per business every 30 days, and include a no-login unsubscribe link. We record your choice, time and the notice version. Declining does not affect your service. An email already submitted to the delivery provider may still arrive after withdrawal.
• To send optional WhatsApp messages to your own number, only after you tick the consent box. Basis: your consent, which you can withdraw at any time in Settings.
• To bill subscriptions and meet tax and accounting duties. Basis: contract and legal obligation.
• For a business's customers: we process their details to run the service for that business. The business is responsible for its own basis, such as the consent customers give on the request form.

Under the DPDP Act, we rely on your consent, given through a clear notice like this one, or on a legitimate use the Act allows, such as data you provide voluntarily for a service you asked for.

Some features use AI models running on Cloudflare's network to read incoming requests and messages. They classify requests, summarise them, spot missing details, and turn plain-language WhatsApp messages into commands. AI-assisted quoting uses your business's configured services and price rules rather than inventing prices. Some owner-enabled follow-up automations can send messages without an additional confirmation for each message; other operations, including explicit WhatsApp commands, require confirmation. You can review or disable communication automation in workspace settings. We do not use your data to train our own AI models.

We use these service providers (“processors”). Each receives only what it needs for its job and is bound by contract to protect the data. Optional services are used only when you turn them on.

• Cloudflare, Inc.

  What for

  Hosting the app, the database and file storage (including job photos), the AI features, email routing, and security and abuse protection.

  When

  Always

  Location

  United States, global network

• Resend

  What for

  Sending sign-in, invitation, quote and invoice emails; customer-requested review preference confirmations and opted-in review requests.

  When

  For email delivery; review requests only after recipient confirmation

  Location

  United States

• Twilio Inc.

  What for

  SMS, voice and WhatsApp messages, including WhatsApp Command.

  When

  When a business turns on SMS, voice or WhatsApp

  Location

  United States

• Meta Platforms (WhatsApp)

  What for

  Delivering WhatsApp messages sent through Twilio.

  When

  When WhatsApp is used

  Location

  United States, Ireland

• Paddle.com Market Ltd

  What for

  Selling and billing TaskTuck subscriptions as merchant of record. Paddle handles payment details under its own privacy policy; TaskTuck never sees full card numbers.

  When

  When you subscribe

  Location

  United Kingdom

• Google LLC

  What for

  Sign in with Google, Google Calendar sync, and route planning between job addresses (Google Maps Routes).

  When

  When you choose these features

  Location

  United States

• Microsoft Corporation

  What for

  Reading a connected Microsoft 365 mailbox into the Inbox and syncing its calendar.

  When

  When you connect Microsoft 365

  Location

  United States

• Intuit Inc. (QuickBooks)

  What for

  Syncing customers, quotes, invoices and payment status with QuickBooks Online.

  When

  When you connect QuickBooks

  Location

  United States

• GitHub, Inc.

  What for

  Tracking product feedback in a private issue tracker. Only the feedback text, the page it was sent from and the browser type are copied. Screenshots and workspace records are not.

  When

  When you send us feedback that we escalate

  Location

  United States

We may also disclose data when the law requires it, to protect people's safety or our rights, or as part of a business transfer, in which case this policy continues to apply.

Your data may be processed outside India and outside the EU or UK, mainly in the United States. Where GDPR applies, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK equivalent) in our providers' terms. Transfers from India follow the DPDP Act, which permits transfers except to countries the Government of India restricts.

TaskTuck uses only cookies and storage that are strictly necessary to run the service. That is why we do not show a cookie banner. We use no advertising, analytics or tracking cookies.

• better-auth.session_token

  Type

  Cookie

  Purpose

  Keeps you signed in.

  How long

  Up to 7 days, renewed while you use TaskTuck; removed when you sign out

• better-auth.session_data

  Type

  Cookie

  Purpose

  Briefly caches your signed-in session so pages load faster.

  How long

  5 minutes

• tt_organization_id

  Type

  Cookie

  Purpose

  Remembers which business workspace you are working in.

  How long

  Up to 1 year

• tt_google_calendar_oauth, tt_microsoft_oauth_state, tt_quickbooks_oauth, tt_gmail_oauth_state

  Type

  Cookie

  Purpose

  Protects the connect-an-app sign-in step against forgery.

  How long

  Minutes, deleted after connecting

• Sign-in check

  Type

  Session storage

  Purpose

  Confirms the account that signed in is the one you typed.

  How long

  Until the tab is closed

• Field app offline queue

  Type

  Local storage, IndexedDB

  Purpose

  Keeps job updates and proof photos taken without signal until they upload.

  How long

  Until cleared, replaced, or invalidated by account/privacy checks; uploaded field records can remain cached for offline use

On the subscription checkout page, Paddle's payment form may set its own cookies for fraud prevention and payment, under Paddle's policy. Cloudflare may also set a strictly necessary security cookie to filter out bots.

For review emails, we retain a minimal business-scoped email hash, preference identifier, private unsubscribe verification key and withdrawal records to respect your choice and keep old unsubscribe links working, including after database recovery or privacy erasure. These controls are held separately from the database backup and contain no raw email address or message body. Recent sending reservations prevent duplicate review requests after recovery. A hash may still be personal data; it is not treated as anonymous. Other consent references and provider-message records are included in privacy-request review and redaction.

We keep account and workspace data while your account is active. Deleting a customer in the workspace currently hides the customer and related operational records but does not immediately erase them from the database, file storage, connected providers or backups. Account closure and privacy erasure requests require identity and business-controller verification, review of tax/accounting and legal retention obligations, and additional manual processing. We will explain any records that cannot yet be erased or that must be retained. Backups, logs and connected systems may continue to hold copies until their applicable retention periods end.

A business decides how long it is authorized to keep its customers' records; its workspace Delete action is a soft deletion, not a complete privacy erasure. Security logs are kept only as long as needed to protect the service.

Data is encrypted in transit (HTTPS) and stored with Cloudflare. Access is limited by role, so each business's data is separated from every other business's. Passwords and connected-app keys are never stored in plain text. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India and, where GDPR applies, the competent supervisory authority.

Under GDPR you can ask to access, correct or delete your data, restrict or object to how we use it, or receive it in a portable format. Where we rely on consent, you can withdraw it at any time; this does not affect anything done before. You can also complain to your local data protection authority.

Under the DPDP Act you can ask for a summary of the personal data we process and who we have shared it with, ask us to correct, complete, update or erase it, withdraw consent as easily as you gave it, nominate someone to act for you if you die or cannot act, and raise a grievance with us. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

To use any of these rights, email privacy@task-tuck.com from the address on your account, or tell us how to identify you. We reply within one month and resolve grievances within the time the law allows. Using your rights is free.

For privacy questions, requests or complaints, contact TaskTuck's privacy contact at privacy@task-tuck.com. For anything else, write to support@task-tuck.com.

TaskTuck is a business tool for adults. It is not meant for anyone under 18, and we do not knowingly collect children's personal data. If you believe a child has given us data, contact us and we will delete it.

We will update this page when our practices change, and change the date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.