Data Processing Addendum

Last updated October 29, 2026

This addendum is part of the Terms of Service between FL Computer Tech, the operator of Taskift ("we", "us"), and the customer that owns a Taskift workspace ("you"). It applies automatically when you use Taskift; no signature is needed. Questions, or a copy for your records: hello@taskift.com.

Who does what

You decide what personal data goes into your workspace and why, so you are the controller. We process it only to provide Taskift to you, so we are your processor. If you are an agency or MSP putting your clients' data into Taskift, you may be a processor for your clients yourself; then we are your subprocessor and this addendum still applies.

What we process

• People: your owners, admins and members, your client guests, people who fill in your forms, and anyone named in your workspace content.
• Data: names, email addresses, profile pictures, workspace content (boards, projects, tasks, comments, notes, files, time entries and form submissions), the sites you add to Site Health, IP addresses and request logs.
• Purpose: to run Taskift for you: store and show your content, sign people in, send the emails the service needs, run the AI features you use, keep the service secure, and back it up.
• Duration: for as long as you use Taskift, plus the deletion periods below.

Our commitments

• We process your data only on your instructions: the Terms, this addendum, and how you use and set up Taskift. If the law ever requires us to do otherwise, we will tell you first unless the law forbids it.
• Access to production systems and backups is limited to people who need it to run and support the service, and they are bound to keep it confidential. Today that is the owner of FL Computer Tech.
• We don't sell your data, and we don't use your workspace content for advertising or to train AI models.

Security measures

• Encryption in transit: every connection to taskift.com and app.taskift.com uses HTTPS with TLS 1.2 or 1.3; older versions are refused.
• No direct way in: Taskift's services publish no ports to the internet. Web traffic reaches them only through an encrypted Cloudflare tunnel.
• Private database: the database sits on a private network inside the server, reachable only by the Taskift app, and is never exposed to the internet.
• Workspace isolation: board data is separated by workspace with row-level security in the database, so a request working for one workspace can't read or change another workspace's rows. Normal requests use a database role that can't bypass it.
• Hashed secrets: sign-in sessions, sign-in codes, API keys and connected-app keys are stored only as one-way hashes, so a copy of the database would not let anyone sign in.
• Limited connected apps: an AI app you connect can reach only the one workspace you approved, can't delete anything, can't create sharing links or keys, and an owner or admin can disconnect it at once.
• Encrypted backups: the database, including uploaded files, is backed up every night. Since October 28, 2026 every backup is encrypted (with age) before it is written. Copies are kept on our server, with Wasabi (sent over an encrypted connection), and on FL Computer Tech's own backup drive. The key that unlocks them is not stored on our servers or with Wasabi.
• Limits and logs: sign-in codes, forms and invites are rate limited, and staff actions in our admin tools are recorded in an audit log.

We don't hold SOC 2, ISO 27001 or similar certifications, and Taskift is not built for HIPAA or PCI DSS data. Please don't store health records, payment card numbers or government ID numbers in Taskift.

Subprocessors

These companies process customer data for us. Each gets only what it needs for its job.

• Hostinger (United States, Boston): the server that runs the app, the database and the taskift.com website. Handles all workspace and account data.
• Cloudflare (global network): DNS, network security and the encrypted tunnel to our server. Handles traffic passing through, including IP addresses.
• Amazon Web Services, Amazon SES (United States): sends Taskift's emails. Handles recipient addresses and email contents.
• Wasabi (United States): stores our encrypted database backups. Handles all workspace and account data, encrypted before it leaves our server.
• Anthropic (United States): AI features. Handles the content of each AI request you make. It does not train its models on that content under the terms we use.
• Stripe (United States): payments and invoices. Handles billing name, email, address and payment details, never your workspace content.

Not our subprocessors: Google and GitHub, which are only involved if you choose to sign in with them, and AI apps you connect yourself (such as Google Gemini, Claude or ChatGPT), which you choose and which handle what they read under their own terms.

We will email workspace owners at least 14 days before adding or replacing a subprocessor. If you object on reasonable data-protection grounds and we can't resolve it, you can cancel and we will refund any prepaid time you haven't used.

Personal data breaches

If we become aware of a breach affecting your data, we will tell the workspace owner by email without undue delay, with what we know, what data is affected and what we are doing about it, and keep you updated as we learn more.

Helping you

• Most requests from people about their data (access, correction, export, deletion) can be handled in the app. When one can't, we will help.
• We will give you the information you reasonably need for security reviews, data protection impact assessments or a regulator's questions, and once a year we will answer a reasonable security questionnaire.

Deletion when you leave

• You can export your projects and tasks at any time.
• When a trial or subscription ends, the workspace becomes read-only and stays exportable. Deleting your account deletes every workspace you own alone from the live service right away. You can also email us to delete a workspace and we will do it within 30 days.
• After deletion, copies remain only in our encrypted backups until they age out: 14 days on our server, and 30 days on our backup drive and with Wasabi.

Transfers

Taskift stores and processes data in the United States. If you are outside the US and your law requires a transfer mechanism, such as the EU Standard Contractual Clauses, email us and we will work with you on it.

Liability and precedence

This addendum is subject to the limits of liability in the Terms of Service. Where this addendum and the Terms disagree about personal data, this addendum wins.

Changes

We may update this addendum. If a change matters, we will email workspace owners at least 14 days before it takes effect.