1Who is responsible for your data
Aifnet Ltd. provides Taskloader and is the controller of the personal data processed through it, within the meaning of the EU General Data Protection Regulation (GDPR).
- Company
- Aifnet Ltd.
- Registered office
- 88 Bulgaria Blvd., entrance 3, floor 2, office 6, 1680 Sofia, Bulgaria
- Registration
- Bulgarian Commercial Register, UIC 205591406
- VAT number
- BG205591406
- [email protected]
We have not appointed a data protection officer. Write to [email protected] about anything in this policy, and we will answer you ourselves.
2The data we process, and why
Your account
To create an account you give us your name, your email address and a password. We keep the password only as a one-way hash, so nobody, including us, can read it. We also record when the account was created and last changed.
We use this to create and run your account, sign you in, and show your name to the people you work with. The legal basis is the performance of our contract with you, the Terms of Service (Article 6(1)(b) GDPR).
Signing in with Google
If you choose Continue with Google, Google tells us your name, your email address and whether Google has verified it. We store your Google account identifier and the sign-in token Google issues, which also contains a link to your Google profile picture; we do not use or show the picture. Google also sends an access token, which we store encrypted and never use. We ask Google for nothing else. The legal basis is our contract with you (Article 6(1)(b)). Google handles your Google account under its own privacy policy.
Emails about your account
We email you only about your account: a link to confirm your email address when you create an account with a password, a link to choose a new password when you ask for one, and a note when your password has changed. A confirmation link works for 24 hours, a password link once and for one hour. We record whether your address is confirmed. We send no newsletters or marketing. Cloudflare delivers these emails for us and receives your email address and the message; the message is not stored for viewing. The legal bases are our contract with you and our legitimate interest in keeping accounts safe (Article 6(1)(b) and (f)).
Staying signed in, and keeping accounts safe
For each signed-in session we keep a random session token, which your browser holds in a cookie, the IP address and browser description (user agent) the session started from, and when it expires. To slow down password guessing and misuse of our emails, sign-in attempts and requests for emails are counted by IP address for about a minute. The legal bases are our contract with you and our legitimate interest in protecting accounts and the service (Article 6(1)(b) and (f)).
Your projects and what is in them
Taskloader stores what you and your teammates put into projects: project names and descriptions; tasks with their status, owner, due date and priority; checklists; comments; the history of changes (who changed what, and when); files with their names, sizes, types and image dimensions; and invitations, with the role they grant, who created them and when they expire. An invitation link is stored only as a one-way hash.
The members of a project see its content, and each other’s names and email addresses. The legal basis is our contract with you (Article 6(1)(b)). You decide what you add; if it includes other people’s personal data, the Terms explain your part.
Ask Taskloader
When you ask Taskloader’s assistant something, we send OpenRouter your question, the earlier messages of that conversation, and the parts of the project it needs to answer: the project’s name and description; its tasks with their titles, statuses, owners, due dates, priorities and checklists; and, when it looks them up, task descriptions, comments and the history of changes, with the names of the people involved. OpenRouter passes the request to the AI model we use (currently OpenAI’s GPT-6 Luna) and returns the answer. Email addresses, the contents of files and anything from other projects are never sent.
Your conversations are saved so that you can come back to them, and only you can see them. Changes the assistant proposes are only applied when you choose to apply them, and then as your own edits. The legal basis is our contract with you, because you ask the assistant (Article 6(1)(b)). OpenRouter’s data processing agreement requires it to delete requests and responses promptly once the answer is generated, and we have not turned on its optional logging. Please don’t put sensitive personal data, such as health information, into a question or a task.
Messages you send us
When you write to us, we receive your email address, your message and anything you attach, and we keep our reply. We use them to answer you and to keep a record of requests, including requests about your data. The legal bases are our legitimate interest in answering and keeping records, and our legal obligation to handle data protection requests (Article 6(1)(f) and (c)).
Server logs and Cloudflare
Taskloader’s web server keeps no access logs. When a request fails, the error log can record the IP address and the address that was requested. Taskloader’s own logs say what kind of failure happened, not who it happened to. The legal basis is our legitimate interest in keeping the service secure and working (Article 6(1)(f)).
Every request to taskloader.com passes through Cloudflare, which protects the site and serves its public pages and files from a data center near you. To do that it processes your IP address and the requests you make; we have not turned on its request logs. The legal basis is our legitimate interest in a secure and fast service (Article 6(1)(f)).
How fast pages load
We measure how quickly the home, sign-in and legal pages load with Cloudflare Web Analytics. A small script reports the page’s address, the page you came from, your browser and type of device, your country, and timings such as how long the page took to appear. It sets no cookies and stores nothing on your device, Cloudflare removes your IP address before keeping the measurements, and they are not linked to your account. The legal basis is our legitimate interest in keeping Taskloader fast (Article 6(1)(f)).
What we don’t do
- We use no advertising services, and we don’t track you across sites. The only measurement is how fast pages load, without cookies (above).
- We don’t sell or rent personal data, or share it for advertising.
- We don’t use your projects to train AI models.
- We make no automated decisions that have legal or similarly significant effects on you (Article 22 GDPR). The assistant’s proposals are suggestions that you review.
3Who helps us, and who else receives data
These service providers process personal data for us, only on our instructions and under data processing agreements:
| Provider | What they do for us | Where | Safeguard |
|---|---|---|---|
| Akamai Technologies, Inc. (Linode) | Hosts the server that runs Taskloader, its database and its daily backups | United States (California) | Standard contractual clauses |
| BunnyWay d.o.o. (bunny.net) | Stores the files attached to tasks | Germany (EU) | Inside the EU |
| OpenRouter, Inc. | Passes the assistant’s requests to the AI model, and returns the answers | United States | Standard contractual clauses |
| OpenAI, through OpenRouter | Runs the AI model (GPT-6 Luna) that answers questions and drafts proposed changes | United States | OpenRouter’s agreements with OpenAI |
| Cloudflare, Inc. | Carries all traffic to taskloader.com, protecting it and serving its public pages and files from nearby data centers; measures how fast pages load; delivers the emails Taskloader sends; runs the DNS of taskloader.com | United States, and its network worldwide | Standard contractual clauses and the EU–US Data Privacy Framework |
| Google Ireland Limited (Google Workspace) | Runs the mailbox at [email protected] | EU and United States | Standard contractual clauses and the EU–US Data Privacy Framework |
Personal data can also reach:
- the other members of your projects, who see what the project contains;
- Google, when you choose to sign in with Google;
- courts and public authorities, when the law requires us to disclose it, and our lawyers and accountants, who are bound to confidentiality, when we need their advice;
- a company that takes over Taskloader, if it is ever sold or reorganized. We would tell you before your data moves, and this policy would continue to protect it.
4Transfers outside the EU
The server that runs Taskloader, the AI service the assistant uses, and Cloudflare, which carries the site’s traffic and delivers our emails, are in the United States. These transfers rely on the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), which are part of our providers’ data processing agreements, together with their security measures. Where a provider is certified under the EU–US Data Privacy Framework, that adequacy decision applies as well. You can ask us for a copy of these safeguards; we may remove commercial terms from it.
5How long we keep it
| Data | How long |
|---|---|
| Your account | Until it is deleted. We delete it within 30 days of your request. |
| Sessions: token, IP address, browser | Until the session ends: 7 days after you last used Taskloader, or when you sign out. Expired sessions are removed within an hour. |
| Counts of sign-in attempts | About a minute, in the server’s memory only |
| Emails we send | An email waiting to be sent is deleted an hour after it goes out. Cloudflare keeps a delivery record (address, subject, result) for up to 30 days, and stops sending to an address that does not exist or that marked our email as spam. |
| Projects, tasks, comments, history and invitations | As long as the project exists. Deleting a task deletes its comments, history and files. |
| Conversations with the assistant | Until you delete them, or the project is deleted. Leaving a project ends your access to them. |
| Backups of the database | 14 days. A daily copy replaces the oldest one. |
| Server error logs | 14 days |
| Page speed measurements | Kept by Cloudflare as statistics, without IP addresses, for as long as we use Web Analytics |
| Messages to us | As long as we need them to deal with your message, then up to three years, so that we can show how a request was handled |
When your account is deleted, we delete your account, your sessions, and the projects you own with everything in them. In projects that other people own, your membership ends and tasks assigned to you become unassigned; what you added there remains part of that project. Tell us if you want something specific removed from it. Deleted data leaves our backups within 14 days.
We keep data longer only where the law requires it, or where we need it to establish, exercise or defend a legal claim, and only for as long as that lasts.
6Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased, including by deleting your account;
- restrict our use of your data while a question about it is resolved;
- receive the data you gave us in a structured, machine-readable format, and have it transferred to another provider;
- object to processing that relies on our legitimate interests;
- withdraw consent at any time, where we rely on it (we currently don’t);
- complain to a data protection authority.
To use these rights, write to [email protected], preferably from the email address of your account, so that we know the request is yours. It is free. We answer within one month; for complex requests that can be extended by two more months, and we will tell you if it is.
Our supervisory authority is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria ([email protected], www.cpdp.bg). You can also complain to the authority of the EU country where you live or work, or where you believe an infringement took place.
8How we protect your data
Every connection to Taskloader is encrypted. Passwords and invitation links are stored only as one-way hashes, and Google’s access token is stored encrypted. Every request is checked against your membership of the project; Taskloader serves files only after that check and never hands out public links to them. The database cannot be reached from the internet, and it is backed up daily.
No system is perfectly secure. If a breach of your data is likely to put you at risk, we will tell you and the supervisory authority, as the GDPR requires.
9Children
Taskloader is not meant for anyone under 16, and we don’t knowingly collect their data. If you think a child under 16 has given us personal data, tell us at [email protected], and we will delete it.
10Changes to this policy
When this policy changes, we update the date at the top. If a change matters to how your data is used, we tell you in Taskloader or by email before it takes effect.