TASQ-ONE ("we", "us", "our") is a multi-tenant task management Work OS operated from India (Delhi / Pune). We do not sell your personal data, nor do we train public AI models on your task content.
1. Who We Are & Contact
TASQ-ONE is operated from India with engineering and infrastructure centered in Delhi / Pune. For any privacy queries, data access requests, or regulatory questions under the DPDP Act 2023, please reach our dedicated Data Protection Desk:
2. Data We Collect
2.1 Account & Organization Data (Provided by You)
- Full name, email address, and salted password hash (we never store or see your plaintext password) — collected at company signup (/signup) or when accepting an invite (/accept-invite).
- Organization name, department squads, and workspace configuration.
- Role assignment (admin, manager, or employee).
2.2 Content You Create & Manage
- Task deliverables, descriptions, acceptance criteria, checklists, comments, due dates, priorities, and dependency DAG relations.
- File attachments and assets uploaded (stored in Cloudflare R2 with tenant-isolated paths ${orgId}/${taskId}/...).
- Text submitted to "Enhance with AI" (processed in ephemeral memory via Groq Llama 3.3 70B TLS 1.3 tunnels).
2.3 Automatically Collected Telemetry & Logs
- Authentication timestamps, IP address, and browser headers for distributed rate limiting (Upstash Redis).
- Immutable audit trail: every deliverable update, status change, and assignee transfer is logged with actor ID for organizational compliance.
2.4 Data We Do NOT Collect
- We do not collect credit card or payment credentials during the ₹0 Free Starter Pilot.
- We do not knowingly collect personal data from anyone under the age of 18.
3. How We Use Your Data (Legal Basis)
| Purpose | Legal Basis (DPDP Act 2023 / GDPR) |
|---|---|
| Operate Work OS (Kanban, dashboards, checklists) | Performance of Contract with your organization |
| Authenticate & enforce strict 3-way RBAC | Performance of Contract & System Security |
| Dispatch transactional notifications & Slack cards | Performance of Contract |
| AI Task Decomposition (Groq 70B inference) | Explicit User Action / Contract Performance |
| Detect & mitigate DDoS / brute-force attacks | Legitimate Interest & Security Obligation |
4. Third-Party Sub-Processors
We partner exclusively with enterprise-grade cloud infrastructure providers that enforce strict data isolation:
- Supabase Cloud: PostgreSQL database engine & GoTrue authentication (Asia-South Mumbai cloud region).
- Groq Cloud: Ultra-low latency Llama 3.3 70B inference (zero data retention policy).
- Cloudflare R2: S3-compatible encrypted object storage for attachments.
- Upstash: Serverless Redis for distributed sliding-window rate limiting.
- Slack Technologies: Incoming webhook dispatch (configured strictly by Workspace Admins).
- Resend: High-deliverability transactional email dispatch.
5. Your Rights Under Indian DPDP Act 2023
As a registered user or organization data principal in India, you hold complete statutory rights:
- Right to Access & Summary: Request an export of all workspace tasks, profiles, and audit records.
- Right to Correction & Erasure: Update profile info or request complete tenant deletion with zero residual retention.
- Right to Grievance Redressal: Dedicated response within 2 business hours via tasqoneworkos@gmail.com.
6. Data Retention & Workspace Deletion
When an Admin deactivates an employee account, their authentication session is terminated immediately (soft-delete), while task authorship is preserved for audit compliance. If a Workspace Admin requests full organization deletion, all tenant records across Supabase, Cloudflare R2, and Upstash are permanently purged within 30 days.