Privacy Policy

👥Who is responsible for what

Task Job is sold to businesses. When your employer signs up, they decide what goes into the account, who on their team may see it, and how long to keep it. They are responsible for that. We host and operate the software on their behalf, and we only handle their data in order to run the service for them.

So if you are an employee and you want to know why a particular record about you exists, or you want it changed, the fastest route is your own company's Task Job administrator. If they cannot help, write to us and we will.

📋What we hold

Your account

• Your name, username, and the role and permissions your company gave you.
• Your email address and phone number, if your company recorded them.
• Your profile photo, if you upload one, and your initials and avatar colour.
• Your password, stored only as a scrypt hash with a random salt per account. We cannot read it, and neither can anyone else with the database in front of them.

The work your company records

This is the substance of the product, and all of it is entered by your company rather than collected from you in the background: tasks and their comments, customer records (company name, contact name, email, phone), invoices, quotes and payments, expenses with their receipts, income entries, projects, uploaded files, internal messages and direct messages between colleagues, and support tickets raised with us.

Attendance, if your company switches it on

Attendance is a separate feature that not every account has. Where it is in use we store:

• Check-in and check-out times, and the method used (QR code, kiosk, or in the app).
• The GPS coordinates recorded at the moment you check in and check out, so the record can be matched against the workplace your company defined. We store those two readings. We do not track your location at any other time, and the apps do not follow you in the background.
• Your work location and shift, lateness and hours worked, leave and overtime requests, and payroll lines your company calculates from them.
• One identifying photo of you, if your company adds it, so a supervisor can confirm who checked in.
• Photos and videos posted to the attendance timeline by whoever posts them.

Technical records

• Your IP address and browser or device identification string, recorded against each sign-in attempt, successful or not. This is how an account break-in is spotted and is kept for security.
• An audit log of significant actions — who approved an expense, who deleted a task — so a company can answer its own questions about its own records.
• A push-notification token, only if you turn notifications on. It identifies a device to the notification service, not you to us.
• A sign-in token, held in your browser's own storage on your own device so you are not asked to sign in on every screen.

🌏Where it is kept, and who else touches it

Application data sits in a database on our own server, hosted with Amazon Web Services in Singapore. Files and attachments — receipts, photos, videos, documents — are stored in Cloudflare R2 and are never publicly readable: each download is authorised per request.

These are the only outside services involved in running Task Job, and each one is listed because it necessarily sees something:

We will also hand over data where the law genuinely requires it, and we will tell the affected company that we have done so unless we are forbidden from saying.

🔒How it is protected

• Every connection is over HTTPS. The apps refuse plain HTTP outright.
• Passwords are hashed with scrypt and a per-account random salt — never stored in a form anyone can reverse.
• Every database query is scoped to one company. That is enforced on the server, not in the app on your phone, so one business cannot reach another's records by any route.
• Inside a company, what each person can see is decided by the permissions their administrator granted. Money figures in particular are withheld from people who were not given access to them, at the server, rather than merely hidden on screen.
• Attachments are not on a public URL. A link only works for someone signed in and entitled to it.

No system is beyond reach. If we ever discover a breach affecting your data, we will tell the affected companies what happened, what was exposed, and what we did about it.

🗑How long we keep it, and how to have it deleted

We keep an account's data for as long as the account exists, because that is the point of it — last year's invoices and expenses are records a business is generally required to hold.

Ask us on the support page and we will delete a company's data, or one person's, and confirm to you when it is done. That form needs no account, deliberately: somebody who has left a company still has the right to ask. We do not charge for this and we do not require a reason. If the request comes from an employee rather than the account holder, we will check with the account holder first — their business records are theirs, and we are not the right party to erase them on somebody else's word.

✋Your rights

Whatever jurisdiction you are in, we will honour a request to see what we hold about you, to correct it, to get a copy of it in a portable form, or to have it deleted. Ask your company's administrator, who can do most of it directly in the product, or write to us.

🧒Children

Task Job is a tool for businesses and their staff. It is not designed for or directed at children, and we do not knowingly hold data about anyone under 13. If you believe we do, tell us and we will remove it.

✉️Changes, and how to reach us

If we change this policy in a way that matters, we will change the date at the top and say so in the app rather than quietly editing the page.

Questions about any of the above: use the form on the support page, which needs no account. Signed-in users can instead raise a ticket from Profile → 🛟 Contact support, which reaches the same desk and carries the context of your account with it.