DRAFT. Not legal advice. Not reviewed by a lawyer. Placeholders [[TODO_...]] must be completed. Legal bases, retention periods and transfer mechanisms must be confirmed.1. Controller
The data controller is [[TODO_COMPANY]], [[TODO_COMPANY_ADDRESS]]. Privacy contact: [[TODO_PRIVACY_EMAIL]]. EU/UK representative or DPO (if required): [[TODO_DPO]].
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | first and last name, username, email, password hash, country, time zone, language, profile photo, bio | You |
| Authentication | Google sign-in identifier, 2FA data, sessions, login history, device information, IP address | You / device |
| Verification (KYC) | full name, country, date of birth, wallet address, possibly identity documents [[TODO_KYC_SCOPE]] | You / KYC provider |
| Work data | tasks, submitted results, execution logs, AI run records, review decisions, rejection reasons | You / platform |
| Financial | credit transactions, earnings, withdrawal requests, transaction hashes, purchase records (card data is handled by the payment provider and not stored by us) | You / payment provider |
| Communication | messages with Taskrora Team, notifications, email preferences | You / platform |
| Extension | pairing and device identifiers, connection status | Extension |
| Technical | cookies and similar technologies (see Cookie Policy), error logs, anti-abuse signals | Device |
We do not intentionally collect data from persons under 18.
3. Why we use it and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, tasks, credits and earnings | Contract (Art. 6(1)(b)) |
| Process credit purchases and payouts | Contract; legal obligation |
| KYC, anti-fraud, AML and sanctions checks | Legal obligation; legitimate interest |
| Security, abuse and multi-account prevention, audit logs | Legitimate interest |
| Service emails (security, transactions) | Contract; legitimate interest |
| Marketing emails | Consent (withdraw any time) |
| Analytics and non-essential cookies | Consent |
| Improving the AI service and quality review | Legitimate interest [[TODO_LEGAL_REVIEW]] |
4. AI processing
To run the agent, task instructions and your inputs are sent from our servers to AI providers (currently Anthropic and OpenAI). The Extension itself holds no AI keys. We do not take decisions with legal or similarly significant effect solely by automated means: approval, rejection, levels and payouts are decided by people. See the AI Usage Policy.
5. Who receives data
Processors and recipients, based on current plans: hosting and database (Vercel, managed PostgreSQL [[TODO_PROVIDER]]), file storage (S3-compatible [[TODO_PROVIDER]]), email (Resend), payments (Dodo Payments), AI providers (Anthropic, OpenAI), error monitoring (Sentry), authentication (Google, if you choose it), and KYC/crypto compliance providers [[TODO_PROVIDER]]. We may disclose data to authorities when legally required. We do not sell personal data.
Clients do not receive your personal data unless we say so and you have agreed.
6. International transfers
Some providers are outside the EEA/UK. Where required we rely on adequacy decisions or Standard Contractual Clauses: [[TODO_TRANSFER_MECHANISM]].
7. Retention
Account data is kept while the account is active. Financial and KYC records are kept for the periods required by law: [[TODO_RETENTION_PERIODS]]. Execution logs and submissions: [[TODO_RETENTION_PERIODS]]. After a deletion request we erase or anonymize data unless we must retain it by law.
8. Your rights
Where GDPR/UK GDPR or similar law applies you may request access, rectification, erasure, restriction and portability, object to processing, and withdraw consent at any time. You may lodge a complaint with your supervisory authority. Contact [[TODO_PRIVACY_EMAIL]]. You can also request account deletion in your settings.
9. Security
We use access control, 2FA, encryption of sensitive data, rate limiting, audit logs and backups. No system is perfectly secure; we will notify you and authorities of breaches as required by law.
10. Children
The service is for adults (18+). If we learn a minor has registered, we will close the account.
11. Changes
We will post updates here and notify you of material changes.