Privacy Policy

How TaskFlow handles your personal data.

Version 1.2 · Last updated 2026-10-28

This policy explains what personal data TaskFlow (“we”, “us”) collects through the TaskFlow task-management application and website, why we collect it, how long we keep it, and the control you have over it. It applies to the Android application distributed on Google Play and to the web application at https://tasks.elixisis.digital.

1. Who is responsible for your data

TaskFlow is the data controller for the information described here. For privacy questions, access requests or complaints, contact support@elixisis.digital. Where TaskFlow is operated by your employer under a corporate agreement, that organisation is the controller and we act as its processor; in that case your employer’s own privacy notice governs and you should direct requests to them first.

2. What we collect

Category	Examples	Why we need it
Account data	Username, email address, password (stored only in a protected, non-readable form), profile preferences, account creation and sign-in dates	To create your account, authenticate you and recover access
Content you create	Task titles, descriptions, labels, due dates, priorities, recurrence settings, team names	To provide the core service
Collaboration data	Email addresses you delegate tasks to, team membership, who handed a task to whom	To deliver delegation emails and show accountability
Security and activity logs	Records of security-relevant account activity, including the IP address it came from	Fraud and abuse prevention, security, and audit records
Notification data	Notification identifiers issued by your browser or device	To deliver reminders you choose to receive
Technical data	Aggregate usage, performance and error information	To keep the service running and improve it

What we do not collect. We do not collect location data, contacts, photos, advertising identifiers, or biometric data, and we do not build advertising profiles. The app asks only for the device permissions it needs to work, such as notifications if you choose to turn them on.

3. Lawful basis

Performance of a contract — account data and your task content; without them the service cannot function.
Legitimate interests — security logging, abuse prevention and service reliability, balanced against your rights and limited to what is necessary.
Consent — push notifications, which you enable explicitly and can revoke at any time in the app or in your device settings.
Legal obligation — retaining records where the law requires it.

4. How we share it

We do not sell your personal data. We share it only with service providers who process it on our behalf to run the service, and who are required to protect it:

Hosting and infrastructure providers — store and run the application and its data.
Email delivery providers — send account, reminder, delegation and security emails. Someone you delegate a task to sees the task details and who sent it.
Notification services — operated by your browser or device vendor, deliver reminders you choose to receive.

We may also disclose data where required by law, or to establish, exercise or defend legal claims. If TaskFlow is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction, subject to applicable law.

5. International transfers

Our service providers may process data in countries other than your own. Where that happens we take the steps required by applicable law to keep it appropriately protected.

6. How long we keep it

Account and task data — for as long as your account exists.
After you delete your account — removed from the service. Copies in backups are removed as those backups expire, normally within 30 days.
Security and activity logs — for a limited period, then deleted or anonymised.
Other data — only as long as needed for the purpose it was collected for, or as required by law.

7. Your rights

Subject to local law (including the GDPR, the UK GDPR, POPIA and the CCPA/CPRA) you may access, correct, export, restrict, object to the processing of, or erase your personal data, and you may lodge a complaint with your supervisory authority.

Access and portability — Account → Export my data in the app gives you a copy of your data in a machine-readable format.
Correction — edit your tasks and profile directly in the app.
Erasure — Account → Delete account in the app, or the public form at https://tasks.elixisis.digital/legal/delete-account. Deletion is permanent.
Anything else — email support@elixisis.digital. We respond within the time required by applicable law.

8. Security

Your tasks are private to you. All data is encrypted in transit, and the content of your tasks is also encrypted when stored. We do not read your tasks. They are processed automatically only to provide the service to you — for example, to send a reminder you set up — and never for advertising. Our team accesses your content only if you ask us to (for example, for support), where needed to investigate abuse or a security issue, or where the law requires it.

We use reasonable technical and organisational measures to protect your data, including encryption and restricted access to our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you and the relevant authorities where the law requires it.

9. Children

The service is intended for workplace use and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact support@elixisis.digital and we will delete it.

10. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

11. Changes to this policy

We may update this policy from time to time. We will post any change on this page with a new version number and date, and where a change is material we will take reasonable steps to let you know.

12. Contact

Privacy enquiries: support@elixisis.digital
General support: support@elixisis.digital
Governing law for this policy: South Africa