Privacy Policy

At Taskify, we leverage the personal data we collect to deliver, improve, and personalise our task management platform as well as your overall experience with our brand. Specifically, we use your data to:

1. Provide and Maintain Our Services: Host, secure, update, and troubleshoot the Taskify platform and website. Fulfil your transactions, such as provisioning new user accounts or workspaces, and deliver any related documentation or onboarding materials. Share necessary information with third-party service providers (e.g., cloud hosting or payment processors) to complete the service you've requested.
2. Customer Support & Inquiry Management: Respond to your support tickets, help-desk inquiries, and feedback submissions — whether you contact us via email or phone. Escalate and track open issues to resolution, ensuring we have the right context and history to assist you quickly.
3. Product Development & Improvement: Analyse usage patterns, feature adoption, and performance metrics to prioritise new functionality or UX enhancements. Conduct A/B tests and pilot programmes — drawing on depersonalised user cohorts — to validate product changes before broad rollout.
4. Personalisation & User Experience: Tailor in-app dashboards, notifications, and help content to your role (e.g., project manager vs. team member) and previous interactions. Recommend relevant best practices, integrations, or learning resources based on your industry segment and feature usage.
5. Marketing, Advertising & Outreach: With your consent, send promotional emails, newsletters, and invitations to Taskify events. Use aggregated analytics and cookie-based signals to deliver more relevant ads on third-party sites. Respect your opt-out preferences at every step via clear unsubscribe links or preference-centre controls.
6. Business Operations & Compliance: Satisfy our legal obligations (e.g., financial reporting, audit trails) and internal governance requirements.
7. Gmail Integration: If you choose to connect your Google Account to Taskify, we access limited Gmail data solely to provide the core, user-facing features you request. This access is opt-in, tied to your explicit authorisation through Google's OAuth consent screen, and can be revoked by you at any time (see Section 14 for full detail). We request read-only access to view message content, metadata, and labels so we can surface, summarise, prioritise, and organise your inbox within Taskify. We do not compose, send, or modify messages, and we do not access Google Calendar or Google Drive/Docs data unless and until you separately authorise those scopes.
8. Ask Taskify AI & Reminders: Ask Taskify AI, our in-dashboard chat assistant, answers your questions using the tasks, email metadata, calendar entries, and reminders already synced to your account — never the raw text of your emails or documents. Reminders you create are stored so we can display them on your Calendar and notify you when they are due. Chat history is kept per account and can be cleared by you at any time.

We do not use Google user data for advertising, and we do not sell Google user data to any third party. Full detail on our handling of this data, including our Limited Use disclosure under the Google API Services User Data Policy, is set out in Section 14.

When Taskify acts as a data controller, we rely on the following lawful grounds for processing your personal data under the UAE PDPL:

• Consent: You have affirmatively opted in (e.g., by checking a consent box, or by completing the Google OAuth consent flow) to receive marketing communications, to enable non-essential cookies, or to connect a third-party account such as Google.
• Contract Performance: Processing is necessary to deliver the Taskify services you've subscribed to — such as creating your user account, billing, or granting access to workspaces under your plan.
• Legal Obligation: We must process certain data to comply with applicable laws (e.g., tax reporting, UAE PDPL obligations, employment requirements).
• Legitimate Interests: We process data when it is necessary for our legitimate business interests — like improving platform security, preventing fraud, or analysing service usage — provided those interests do not override your rights and freedoms.
• Research & Analytics (Depersonalised Data): We may aggregate and anonymise personal data for statistical research and product-development purposes, which poses minimal privacy risk and cannot be traced back to you.
• Data Processor Instructions: When we process your data on behalf of a customer, we do so under their documented instructions and rely on their legal basis for that processing.

Taskify may share your personal data with the following categories of recipients, only for the purposes outlined below:

• Group Companies & Affiliates: To coordinate international support, billing, and product localisation across our Taskify network.
• Service Providers & Vendors: Cloud-hosting platforms, payment processors, CRM systems, marketing-automation tools, and analytics providers that perform services on our behalf. These partners are contractually bound to use your data only as instructed by Taskify and to maintain appropriate security measures.
• Legal & Regulatory Authorities: To comply with court orders, subpoenas, or legal processes; to protect Taskify's rights and property; or to ensure the safety of our employees and customers.
• Mergers, Acquisitions & Corporate Restructuring: In the event Taskify is involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity, subject to this policy.

Google user data is never included in the categories above except as described in Section 14 (service providers who process it strictly on Taskify's behalf, and legal disclosures where required by law). Google user data is never shared for advertising or marketing purposes.

You have control over how Taskify collects, uses, and shares your personal data. To exercise any of the rights described below, please contact our Privacy Team at info@taskify.ae or use our online Privacy Request Form. We will respond in accordance with applicable legal timeframes under the UAE PDPL.

Subject to applicable law, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct or update inaccurate or incomplete information.
• Erasure (“Right to be Forgotten”): Request deletion of your personal data when it's no longer needed for the purposes described in this policy.
• Restriction of Processing: Ask us to limit how we use your data — for example, to suspend processing while we verify a dispute.
• Object: Opt out of processing based on our legitimate interests or for direct marketing purposes.
• Withdraw Consent: If we rely on your consent, you can revoke it at any time (without affecting the lawfulness of prior processing). For Google Account access specifically, see Section 14 for how to revoke.
• Data Portability: Receive your personal data in a structured, commonly used electronic format and, where technically feasible, have it transmitted to another controller.
• Opt-out of Targeted Advertising & Profiling: Stop the use of your data for profiling or tailored advertising.
• Complain to a Supervisory Authority: Lodge a complaint with the UAE Data Office (www.dataoffice.gov.ae) if you believe we have infringed your rights.

Taskify respects your marketing preferences and will only send you promotional communications if you have opted in or where otherwise permitted by law. You can manage your preferences at any time by:

• Clicking the unsubscribe link included in every marketing email.
• Visiting our Preference Centre to update your contact and marketing choices.
• Contacting us directly at info@taskify.ae.

Please note that while you may opt out of marketing emails, we may still send you important transactional or service-related messages (such as account updates, billing notices, or security alerts) that are necessary to maintain your Taskify account.

Taskify operates primarily within the UAE. Where we transfer personal data internationally to affiliates, service providers, and partners located in other countries, we implement appropriate transfer mechanisms in accordance with the UAE PDPL, such as:

• Standard Contractual Clauses (SCCs): We include SCCs in our agreements with data importers to ensure your data receives appropriate protections.
• Binding Corporate Rules (BCRs): Where applicable, we rely on our internal data-handling policies to govern intra-group transfers.
• UAE Data Office Approved Mechanisms: For transfers outside the UAE, we comply with frameworks recognised by the UAE Data Office.

Whenever local law requires additional safeguards or approvals, we comply before initiating any cross-border transfer. If you would like more information about our specific transfer safeguards, please contact our Privacy Team.

Our website and applications use cookies and similar technologies (e.g., web beacons, local storage) to deliver and improve services, personalise your experience, and support security functions. We group cookies into the following categories:

• Essential Cookies: Necessary for core functionality such as login, navigation, and security. Always active when you visit our site.
• Performance & Analytics Cookies: Help us understand how you use Taskify (e.g., page visits, feature usage). Enable us to optimise speed, reliability, and user experience.
• Functional Cookies: Store preferences and settings (e.g., language, date format). Enhance usability and remember your choices across sessions.
• Marketing & Advertising Cookies: Track your activity to deliver relevant ads on third-party platforms. Support remarketing and campaign measurement.

Managing Your Preferences: On first visit, you'll see a cookie consent banner where you can accept or decline non-essential cookies. You can withdraw or modify your consent at any time via our Cookie Settings link in the website footer. Most browsers allow you to block or delete cookies via their settings.

If your employer or another organization grants you access to Taskify (for example, using a corporate email address or single-sign-on), that organization acts as the data controller for your account. In these cases:

• Account Administration: Your organization can manage your user permissions, reset passwords, and access activity logs.
• Data Access & Processing: Your employer may view or export certain data you enter into Taskify (e.g., tasks, project data) in accordance with their internal policies.
• Support & Compliance: Any privacy inquiries or data-subject requests related to your use of Taskify under your organization's account should be directed first to your internal administrator.

Taskify is not responsible for the privacy or security practices of your organization. We recommend reviewing your employer's privacy policies or contacting your administrator for more details on how they handle your information.

Taskify retains your personal data for as long as necessary to fulfil the purposes outlined in this policy and to comply with applicable legal, regulatory, or contractual requirements. Specifically:

• Active Relationship: We keep data while you maintain an active account, attend our events, or otherwise engage with Taskify.
• Post-Relationship Period: After our direct relationship ends — such as when you close your account — we retain your data for a defined period to: comply with statutory retention obligations (e.g., financial records, tax audits); defend against or pursue legal claims; resolve any outstanding support issues or complaints; and conduct historical analysis and improve our services.

Once retention periods expire, we either securely delete or anonymise your personal data so it can no longer be associated with you. Google user data specifically is retained only per the schedule in Section 14.

The security of your information is a top priority. Taskify implements a multi-layered security programme that includes:

• Administrative Controls: Regular staff training, data-protection policies, and role-based access restrictions.
• Technical Safeguards: Encryption of data at rest and in transit, intrusion-detection systems, network segmentation, and routine vulnerability assessments.
• Physical Measures: Secure data centres with controlled access, surveillance, and environmental protections.

10.1 Independent Security Verification: CASA Assessment

CASA (Cloud Application Security Assessment) is an independent security standard developed by the App Defense Alliance, an industry group founded by Google in partnership with leading cybersecurity firms. It is built on the OWASP Application Security Verification Standard (ASVS), one of the most widely respected security benchmarks in the industry. Any application that requests access to sensitive Google user data (like Gmail or Google Drive) is required to pass a CASA assessment before that access is approved. The review is carried out by an independent, Google-authorised security lab, which tests the application's authentication, session management, access controls, encryption, and data-handling practices against dozens of specific security criteria. Only after passing this review is an app issued a Letter of Validation (LOV) confirming it meets the required security bar — CASA verification is not a badge a company can award itself; it is a third-party audit that confirms an application handles user data the way it claims to.

Taskify connects to your email and calendar to automate the busywork that eats into your day, which means we are handling some of the most sensitive data in your digital life. That is why Taskify has undergone a CASA assessment through an independent, Google-authorised lab. This means an external security team has independently verified that Taskify:

• Encrypts your data in transit and at rest
• Enforces strict access controls over who and what can reach your information
• Follows secure authentication and session-management practices
• Can fully delete your data on request
• Is re-assessed annually to make sure these standards are maintained, not just met once

For you, this means the same access that lets Taskify manage your email on your behalf is backed by an independent security review, not just an internal promise.

Although we strive to provide robust protection, no system is impervious to every threat. In the unlikely event of a data incident, we will promptly investigate, notify affected individuals and the UAE Data Office as required, and take corrective action to prevent recurrence.

When organizations use Taskify to manage their own end-user relationships — such as teams logging task data or customers registering for support — those organizations act as the data controllers. In these cases:

• Taskify operates solely as a data processor, handling personal data under the controller's instructions.
• Our Data Processing Addendum governs these engagements and ensures that we meet or exceed legal requirements for data handling, security, and confidentiality under the UAE PDPL.

For questions about how your data is used by a Taskify customer, please consult their privacy policy or reach out to their data-protection officer.

Our platform and communications may include links to external sites or services operated by third parties. Taskify is not responsible for the privacy practices or content of those sites. We encourage you to review each site's privacy policy before providing any personal information.

Taskify may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or new features. Each version will display a “Last Updated” date at the top. If we make material changes that significantly affect how we process your personal data or your rights, we will:

• Post notice of the changes on our website.
• Where required by UAE law, obtain your consent again or provide you with an opportunity to review and accept the changes.
• All updates become effective on the date we post the revised policy unless we specify otherwise.

This section applies specifically to personal data Taskify accesses through Google APIs when you connect your Google Account to Taskify.

14.1 Data We Access

With your explicit, opt-in authorisation via Google's OAuth consent screen, Taskify requests read-only access to your Gmail data (https://www.googleapis.com/auth/gmail.readonly), plus limited profile information (your email address and name). This allows us to:

• Read email message content, headers, and labels;
• Surface, summarise, prioritise, and organise your inbox inside Taskify.

We do not request or use broader Gmail scopes such as send, compose, modify, or delete. We do not access Google Calendar, Google Drive, or Google Docs data unless and until you separately authorise those scopes.

14.2 How We Use This Data

• Solely to provide, maintain, and improve the Gmail-connected features you have requested within Taskify.
• We do not use Google user data to serve advertisements.
• We do not use Google user data to train or improve generalised, non-personalised AI/ML models. Where AI features process your Gmail content, that processing is limited to generating output for your own use within Taskify.
• We do not sell Google user data, and we do not transfer it to third parties except: (a) with your explicit direction; (b) to service providers who process it strictly on Taskify's behalf under contractual confidentiality and security obligations; (c) as necessary to comply with applicable law, regulation, legal process, or enforceable governmental request; or (d) as part of a merger, acquisition, or asset sale, subject to this policy and continued Limited Use compliance.

14.3 Limited Use Disclosure

Taskify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

14.4 Storage, Retention & Deletion

• Google user data is encrypted in transit and at rest and stored on the cloud infrastructure described in Section 10.
• We retain Google user data only for as long as needed to provide the connected feature, or until you disconnect your Google Account or delete your Taskify account, whichever is earlier.
• You may request deletion of previously accessed Google user data at any time by contacting info@taskify.ae; we will delete it within the timeframe required under the UAE PDPL, except where retention is required by law.

14.5 Revoking Access

You can revoke Taskify's access to your Google Account at any time by:

• Visiting Google's Security Checkup / Third-Party Access page at myaccount.google.com/permissions and removing Taskify's access; or
• Disconnecting your Google Account from within Taskify's account settings.

Revoking access stops future data collection; it does not automatically delete data already retained by Taskify — use the deletion request process in Section 14.4 for that.

If you have questions, requests, or concerns about this Privacy Policy or our data-processing practices, please get in touch:

Taskify Privacy Contact

• Email: info@taskify.ae
• Website: www.taskify.ae

By using Taskify, you acknowledge that you have read, understood, and agree to this Privacy Policy.