Privacy policy
- Service operator
- [Tasklo OÜ – asutamisel]
- Registry code
- [registrikood]
- Address
- [aadress, Eesti]
- support@tasklo.io
This privacy policy explains what personal data the Tasklo mobile app and the website tasklo.io process, why and for how long, who receives it, and what rights you have.
1. Controller
The controller of your personal data is the company named above (Tasklo). For data protection questions write to privacy@tasklo.io.
2. What data we process
Account data
- first, middle and last name, email address, password (stored only as a hash), role (Customer or Provider) and preferred language;
- phone number, which a Customer verifies with an SMS code before publishing their first Job;
- referral code and related discounts.
Jobs, offers and messages
- Job category, description, address and coordinates, time and photos (up to 8 per Job);
- Offers and their prices, Job statuses and history;
- chat messages between the Customer and the Provider, read and typing status;
- reviews and comments;
- dispute reasons, recommendations and decisions.
Location
- the Provider’s live location while the Provider is on the way to a Job (updated every few seconds and visible to the Customer of that Job), and the coordinates where the trip started and where they arrived;
- the notification area (location and radius) and categories chosen by the Provider, used to send matching Jobs.
To turn coordinates into an address the app uses your device’s operating system service, and map tiles are loaded from OpenStreetMap servers.
Provider business data
- company name, registry code, VAT number, address and country; checked against the public business register (Estonian Business Register, Finnish PRH);
- the Stripe payout account ID and status. Identity and business verification (including identity documents) is done by Stripe; that data does not reach Tasklo.
Payment data
- amounts, times and statuses of payments, fees, refunds and payouts, Stripe customer and payment IDs;
- Tasklo never sees or stores card details – they are entered directly into Stripe.
Device and technical data
- push notification token, if you have allowed notifications;
- app crash reports (Firebase Crashlytics): device model, operating system, app version, error message and your user ID. Email and phone number are not included;
- biometric login (fingerprint, face recognition) happens only on your device – Tasklo never receives biometric data.
The app contains no advertising or analytics tools.
Waitlist (website)
- email address, chosen role and language, and a salted hash of your IP address (to limit spam; the IP address itself is not stored).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation, connecting Jobs and Offers, chat, location sharing during a Job, payments and payouts | performance of a contract (1)(b) |
| Accounting, invoices, reporting to the tax authority (including DAC7) | legal obligation (1)(c) |
| Preventing fraud and abuse, limiting contact sharing in chat, resolving disputes, crash reports, security | legitimate interests (1)(f) |
| Push notifications, waitlist announcement | consent (1)(a) – you can withdraw it at any time |
4. Who sees your data
Other Users
- The description, address and photos of an open Job are visible to all registered Users so that Providers can make Offers.
- Customers see the Provider’s name, business and reviews.
- After an Offer is accepted, the Customer and the Provider see the chat, and the Customer sees the Provider’s location during the trip.
- Reviews are visible to registered Users.
Processors and other recipients
| Recipient | Role | Location |
|---|---|---|
| Supabase Inc. | database, authentication, file storage, server functions | data in London (AWS eu-west-2); company in the USA |
| Stripe Payments Europe Ltd and Stripe, Inc. | payments, refunds, Provider payouts and verification (partly an independent controller) | Ireland, USA |
| Twilio Ireland Ltd / Twilio Inc. | phone number verification by SMS | Ireland, USA |
| Google Ireland Ltd / Google LLC (Firebase) | push notifications, crash reports, test build distribution | EU, USA |
| OpenStreetMap Foundation | map tiles (sees your IP address) | United Kingdom |
| Cloudflare, Inc. | website hosting | EU, USA |
| Radicenter | Estonia | |
| Accountant, legal adviser, tax authority | as required by law | Estonia / Finland |
When data is transferred outside the European Economic Area, we rely on European Commission adequacy decisions (e.g. United Kingdom, EU–US Data Privacy Framework) or standard contractual clauses.
Draft note: check each processor’s data processing agreement (DPA) and exact data location.
5. Retention
- Account data – until the account is deleted.
- Accounting and payment data (payments, invoices, Jobs, business details) – 6 years after the end of the financial year, as required by accounting law.
- Crash reports – up to 90 days.
- Waitlist – until we announce Tasklo’s launch, but no longer than 12 months, or until you ask us to delete it.
What is removed immediately when you delete your account, and what is kept, is described in Deleting your account.
Draft note: at the moment account deletion does not anonymise all profile data (email, phone, business details), does not automatically delete Jobs, photos and messages, and nothing is deleted automatically when the 6-year retention period ends. Align the app and this text before publishing.
6. Your rights
You have the right to:
- access your data and get a copy of it;
- have inaccurate data corrected;
- have your data erased unless the law requires us to keep it;
- restrict processing or object to processing based on legitimate interests;
- receive the data you provided in a machine-readable format (data portability);
- withdraw consent at any time (e.g. turn off notifications).
Write to privacy@tasklo.io. We reply within one month.
If you believe we are infringing your rights, you can contact the Estonian Data Protection Inspectorate (aki.ee) or the supervisory authority in your country (in Finland tietosuoja.fi).
7. Security
Data is transmitted encrypted (TLS). Database access is restricted by rules that let each User see only the data meant for them. Passwords are stored only as hashes, and card payments are processed by Stripe.
8. Cookies
The website tasklo.io uses no cookies or analytics. The only thing stored in your browser’s local storage is whether you have closed the language suggestion.
9. Changes
We may change this privacy policy. We will announce material changes in the app or by email.