Privacy Policy

This Privacy Policy explains how VSIG Pte Ltd, operating as TasTrack, collects, uses, stores, discloses, and protects personal data when you use TasTrack. It also explains the choices and rights available to you. TasTrack is designed to identify tasks, events, contacts, follow-ups, and other actionable information from connected communications and keep related work updated across the services you choose to connect.

This Privacy Policy applies to the TasTrack website, mobile applications, desktop applications, browser extensions, integrations, individual services, team services, and enterprise services, together referred to as the Service.

By using the Service, you acknowledge the practices described in this Privacy Policy. Where consent is required by applicable law, TasTrack will request it separately and you may withdraw it as described below.

1 Who We Are

TasTrack is operated by VSIG Pte Ltd, a company registered in Singapore with company registration number 201217559W.

Our TasTrack Privacy Team is the public contact for questions about personal data and this Privacy Policy.

2 Our Role When We Process Personal Data

2.1

For individual accounts, TasTrack generally determines why and how personal data is processed and acts as the organization responsible for that processing under applicable privacy law.

2.2

When an employer or another organization provides or manages a TasTrack account, that organization may determine why and how work-related personal data is processed. In that situation, the organization generally acts as the controller or business, and TasTrack generally acts as its processor or service provider under the applicable agreement. Questions about an organization’s instructions, workspaces, or employment-related use should normally be directed to that organization first.

3 Personal Data We Collect

3.1

We collect personal data from you, from the devices and applications you use, from services you choose to connect, from your organization where it manages your account, and from service providers acting for us.

3.2 Account and profile information

3.2.1

When you create or manage an account, we may collect your name, email address, phone number, profile photograph, country, time zone, language, account identifier, login method, work or personal profile settings, and similar account information. Depending on the available sign-in method, you may use email and password, Google, Microsoft, Apple, enterprise single sign-on, or passkeys.

3.2.2

TasTrack uses authentication services, including Firebase and Supabase. TasTrack does not store your password in readable form. Authentication providers may process credentials or authentication tokens according to their own terms and privacy notices.

3.3 Content you provide

3.3.1

You may create or submit tasks, notes, descriptions, events, contacts, labels, comments, files, photographs, screenshots, documents, audio input, videos, and other content. Free-form fields may contain any information you choose to enter, including personal or sensitive information. You should only provide information that you are authorized to use.

3.3.2

When you use voice input, audio is converted into text and only the resulting transcript is retained by TasTrack. Location-based reminders use approximate location processed on your device. TasTrack does not store or track your precise location for this feature.

3.4 Connected email data

3.4.1

If you connect an email account, TasTrack may access sender and recipient details, subject lines, email bodies, conversation threads, labels, folders, drafts, sent messages, email signatures, contact information, message dates, and historical emails. Supported services may include Gmail, Outlook, Zoho Mail, Yahoo Mail, and email accounts connected through IMAP.

3.4.2

TasTrack may process the connected inbox and sent items, including historical messages, to detect tasks, events, commitments, follow-ups, deadlines, contact information, priority changes, and task completion. You may exclude supported senders, domains, folders, labels, accounts, or conversations through available settings.

3.4.3

When email is accessed through an authorized provider connection, TasTrack’s automated systems may process the subject line, message body, conversation thread, and related metadata to generate tasks, summaries, and other requested features. TasTrack is designed to perform this processing without storing the complete original email on TasTrack’s servers by default. The task title may use the original email subject or an artificial intelligence-generated title, depending on your setting. If you choose the original email subject, the subject may be stored as part of the task record until you edit or delete the task, delete your account, or a limited retention exception described in this Privacy Policy applies. Choosing the original subject as the task title does not prevent TasTrack from processing the email body and thread for other features. When you select Preview Source, TasTrack retrieves the source thread from the connected provider in real time. If the source email has been deleted or access has been removed, the preview may no longer be available.

3.4.4

TasTrack does not download or analyze email attachments as part of automatic email processing. If you separately upload a file to TasTrack, it is treated as content you provide.

3.5 Browser extension data

3.5.1

If you use a TasTrack browser extension, it may read supported email content only on supported email websites and only for the account connected to the extension. Extracted content is transmitted securely to TasTrack for processing. TasTrack does not collect general browsing history and does not store connected email content locally in the browser.

3.5.2

Original content obtained through a browser extension is not stored by default. If you enable an option that retains source content for preview, the content may be stored for up to thirty days or until you delete it, whichever occurs first.

3.6 Messaging data

3.6.1

If you connect WhatsApp, Slack, Microsoft Teams, or another supported messaging service, TasTrack automatically processes all new chats and messages made available through that connection from the time it is connected. This may include direct messages, group chats, channels, participants, contact details, edits, message metadata, and voice-note transcripts. TasTrack must process a message before it can determine whether the message contains a task or other actionable information. TasTrack uses this information to identify and update tasks, events, commitments, follow-ups, priorities, contacts, and completion status.

3.6.2

Processing continues until you pause or disconnect the messaging integration. TasTrack does not import messages sent before connection unless historical processing is clearly presented and enabled as part of the integration. Provider limitations may affect which messages are made available. WhatsApp connectivity uses a linked-device method hosted for TasTrack. It is not presented as an official WhatsApp Business Platform integration unless expressly stated in the Service. TasTrack does not send WhatsApp messages, create reactions, change groups, publish presence information, or intentionally create read receipts. Message content and connection information may be held temporarily for secure processing and session operation.

3.6.3

Slack and Microsoft Teams integrations are read-only unless we clearly present a new capability and obtain any permissions required for it. TasTrack does not use those integrations to post messages or send communications on your behalf.

3.7 Meeting and calendar data

3.7.1

TasTrack may obtain meeting content through a meeting participant or bot, a platform transcript, an uploaded recording, local device processing, calendar or meeting notes, or a supported browser extension. TasTrack retains transcripts, summaries, action items, attendee information, meeting chat, and meeting metadata where needed to provide the Service. TasTrack is designed not to retain meeting audio or video recordings after the content required for transcription has been processed.

3.7.2

Meeting processing may be enabled by default for eligible calendar events, but you can exclude or stop processing for a meeting through available controls. The presence of a TasTrack meeting participant or bot may provide notice that processing is taking place. You are responsible for providing any additional notice and obtaining any consent required from meeting participants under applicable law or organizational policy.

3.7.3

If you connect a calendar, TasTrack may access event titles, descriptions, attendees, locations, video-conference links, availability, and private events. TasTrack does not automatically create, modify, cancel, or send calendar invitations. When TasTrack identifies a possible event from an email, you decide whether to add it to your calendar.

3.8 Contact data

3.8.1

You may choose to synchronize an address book. TasTrack may also identify contact information in message headers, email signatures, and connected conversations. Contact data may include name, email address, phone number, employer, job title, and profile photograph. TasTrack does not enrich these records from public websites, social networks, or commercial data providers, and does not create independent advertising profiles about people who do not use TasTrack.

3.9 Payment and subscription data

3.9.1

TasTrack uses Stripe to process subscription payments and recurring charges. TasTrack does not receive or store complete payment-card details. We may retain billing name, billing address, tax identification number, invoice history, subscription plan, payment status, and transaction identifiers for account administration, accounting, dispute resolution, and legal compliance.

3.10 Technical and usage data

3.10.1

We may collect device identifiers, browser and operating system, application version, language, time zone, approximate location derived from technical information, pages and features used, interaction events, performance data, and crash logs. We use Firebase Analytics and related technical services to understand use of the Service, maintain reliability, diagnose errors, and improve performance. We configure analytics data to be anonymous or de-identified where reasonably possible.

3.11 Communications with TasTrack

3.11.1

If you contact us for support, privacy assistance, a security report, or another request, we collect the information contained in your communication and any information reasonably necessary to respond and verify your identity.

3.12 Referral and partner data

3.12.1

If you apply to or participate in a reseller, creator, affiliate, or referral program, we may collect your public name, user identifier, application information, referral link, referral attribution, and related payment or performance information. Referral links or cookies may identify which participant referred a customer.

4 How We Use Personal Data

We use personal data only for legitimate and disclosed purposes, including to:

• 4.1 create, authenticate, secure, and administer accounts;
• 4.2 connect and maintain the integrations you choose;
• 4.3 analyze connected communications to identify tasks, events, contacts, commitments, deadlines, follow-ups, priority changes, and completion signals;
• 4.4 link related information from different connected services to the same task or event;
• 4.5 generate summaries, suggested task titles, draft email content, meeting notes, and other requested outputs;
• 4.6 personalize features, including an optional writing-style profile that is private to your account;
• 4.7 synchronize work across mobile, web, and desktop applications;
• 4.8 create supported labels, folders, categories, or completion labels in connected email accounts;
• 4.9 provide customer support and respond to privacy or security requests;
• 4.10 process subscriptions, invoices, referrals, and partner arrangements;
• 4.11 send essential service, account, security, and policy communications;
• 4.12 send marketing communications where you have separately subscribed or where otherwise permitted by law;
• 4.13 monitor performance, prevent fraud and abuse, protect the Service, and investigate security incidents;
• 4.14 comply with law, enforce agreements, resolve disputes, and protect users, TasTrack, and others; and
• 4.15 produce aggregated or de-identified operational statistics that do not contain connected communication content and are not reasonably capable of identifying you.

5 Artificial Intelligence Processing

5.1

TasTrack uses artificial intelligence to understand connected communications and provide features such as task and event extraction, contact extraction, summaries, priority suggestions, follow-up detection, task completion detection, smart scheduling suggestions, and draft replies.

5.2

Relevant content may be transmitted through OpenRouter to selected model providers, including selected Google Gemma models. Depending on the feature, the submitted information may include complete messages, selected excerpts, transcripts, contact details, writing samples, calendar context, and instructions required to produce the requested output. TasTrack does not submit attachments for automatic email analysis.

5.3

TasTrack configures and selects artificial intelligence services so that customer content is not used to train general or shared models and is not retained by the provider beyond what is necessary to return the requested output, subject to the provider settings and agreements applicable to the selected route.

5.4

TasTrack does not use your emails, chats, meetings, attachments, tasks, or other customer content to train or fine-tune a model shared across customers. One customer’s content is not used to improve outputs for another customer.

5.5

If you enable draft generation, TasTrack may create a writing-style profile based on your own writing. This profile is isolated to your account, is used only to personalize drafts for you, and is retained until you disable or delete it or close your account. You can avoid this optional feature and may disconnect integrations and continue using manual task features.

5.6

Artificial intelligence output may be incorrect, incomplete, misleading, outdated, duplicated, inconsistent, or inappropriate. TasTrack may fail to identify an actual task, incorrectly identify non-actionable content as a task, create duplicate tasks, or extract task details inaccurately. This may include an incorrect task title, owner, deadline, priority, status, source, contact, event, follow-up, or completion signal. Some tasks may be missed entirely, and some extracted items may not be genuine tasks.

5.7

You should review generated tasks, summaries, priorities, dates, contacts, drafts, and completion decisions before relying on them. TasTrack should not be used as the sole record of important tasks, deadlines, commitments, or obligations. TasTrack does not use automated processing to make decisions about employment, recruitment, credit, insurance, legal rights, or other matters that produce similarly significant effects.

6 Actions in Connected Services

6.1

TasTrack may create supported labels, folders, or categories in a connected email account. It may place a completion label on an email when the related task is identified as completed. TasTrack may also create a draft email when you request one.

6.2

TasTrack does not send email, WhatsApp messages, Slack messages, Microsoft Teams messages, calendar invitations, or other communications on your behalf. To send an email, you must review and send it through the source email service. TasTrack does not archive messages or flag emails unless a future feature is clearly disclosed and authorized by you.

7 Legal Bases for Processing

Where laws such as those in the European Economic Area or the United Kingdom require a legal basis, TasTrack relies on one or more of the following:

• 7.1 Contract. Processing is necessary to create your account and provide the features you request.
• 7.2 Consent. We rely on consent for optional integrations, marketing, certain cookies, writing-style personalization, and other activities where the law requires consent. You may withdraw consent at any time, although this does not affect processing that occurred before withdrawal.
• 7.3 Legitimate interests. We process limited information to secure, operate, support, and improve the Service, prevent abuse, administer our business, and communicate with users, provided those interests are not overridden by your rights.
• 7.4 Legal obligations. We process information where necessary to meet legal, tax, accounting, regulatory, or lawful government requirements.
• 7.5 Protection of rights. We may process information where necessary to establish, exercise, or defend legal claims or protect the safety and rights of users and others.

8 How We Disclose Personal Data

TasTrack does not sell or rent personal data. TasTrack does not share personal data for cross-context behavioral advertising and does not use connected communication content for advertising.

We may disclose personal data in the following limited circumstances:

• 8.2 Service providers. We use providers for cloud hosting, databases, storage, authentication, artificial intelligence processing, analytics, crash reporting, payment processing, email delivery, meeting transcription, messaging connectivity, customer support, and security. Current providers may include Google Cloud, Amazon Web Services, Firebase, Supabase, OpenRouter, selected model providers, and Stripe. They may process data only to perform services for TasTrack and are subject to applicable contractual and security requirements.
• 8.3 Connected services. When you connect Gmail, Outlook, Zoho Mail, Yahoo Mail, WhatsApp, Slack, Microsoft Teams, Zoom, or another service, information is exchanged with that service as needed to operate the integration. Your use of the connected service remains subject to that provider’s terms and privacy practices.
• 8.4 Your organization. If an organization manages your account, authorized administrators may receive the account and workspace information described in the Enterprise and Team Accounts section.
• 8.5 Legal and safety reasons. We may disclose information when reasonably necessary to comply with law or valid legal process, investigate fraud or abuse, respond to a security incident, protect a person’s safety, enforce our agreements, or protect legal rights.
• 8.6 Business transaction. Information may be disclosed to professional advisers and a prospective or actual purchaser, investor, successor, or other participant in a merger, financing, reorganization, sale of assets, insolvency, or similar transaction. Any recipient must respect applicable privacy obligations.
• 8.7 At your direction. We may disclose information when you request or authorize us to do so.

9 Google and Other Connected Account Data

9.1

TasTrack requests only the permissions reasonably necessary to provide the connected features shown to you. You can revoke a connection through TasTrack where supported or through the account settings of the connected provider.

9.2

TasTrack’s use and transfer of information received from Google application programming interfaces will comply with the Google API Services User Data Policy, including its Limited Use requirements. In particular, Google-connected data is used only to provide or improve prominent user-facing TasTrack features, is not used for advertising, is not sold, and is not used to train general artificial intelligence models.

9.3

TasTrack does not provide end-to-end encryption in which only the user holds the keys needed to read connected content. Connected content is encrypted in transit and at rest, but it must be available in readable form to TasTrack’s automated systems and authorized service providers while they process it to provide the Service.

9.4

TasTrack personnel do not routinely read connected communication content. Technical access to production systems is restricted by role, limited to authorized personnel, and logged where supported. Human access may occur only where permitted by applicable platform rules and law, such as when you provide specific authorization for support, when necessary to investigate a security or abuse issue, when required by law, or when data has been aggregated and de-identified for legitimate internal operations.

10 Enterprise and Team Accounts

10.1

An employer or other organization may purchase TasTrack and create, manage, suspend, disconnect, or delete employee accounts. Organization administrators may be able to see user names, email addresses, integration status, usage statistics, work-tagged tasks, connected work content, meeting summaries, audit logs, and billing information, depending on the organization’s configuration and agreement.

10.2

Team members may see tasks or connected content only where they have been invited to the relevant team group or the content has otherwise been shared with them. Organization data is controlled by the organization. Information in a permitted personal workspace remains associated with the individual user and is not visible to the organization unless the user shares it or the organization’s settings and applicable notices state otherwise.

10.3

An organization may decide whether users can maintain both work and personal tags or only work tags. Where personal tags are permitted, organization administrators are intended to see work-tagged task information rather than personal-tagged task information.

10.4

If you leave an organization, the organization may keep, suspend, or delete the managed account according to its instructions and agreement with TasTrack. If the organization deletes the managed user, related active data is scheduled for deletion from TasTrack, subject to backups and any retention required by law. Enterprise agreements may establish different retention or deletion settings. Please contact your organization about requests concerning data it controls.

11 Data Retention

TasTrack retains personal data only for as long as reasonably necessary to provide the Service, meet the purposes described in this Privacy Policy, comply with law, resolve disputes, maintain security, and enforce agreements. The following describes our general retention approach. A shorter period may apply when you delete particular content, and a different period may apply under an enterprise agreement or legal requirement.

11.17

If you disconnect an integration, TasTrack stops collecting new data from that connection. Where the product offers the choice, you may either keep previously generated tasks and related data or delete data associated with the integration.

11.18

If you cancel a paid subscription without deleting your account, the account may continue on the then-current Base Plan with limited features. TasTrack may suspend or delete a Base Plan account after at least twelve months of inactivity. Where reasonably possible, TasTrack will provide advance notice to the account email and allow a reasonable opportunity to sign in or prevent deletion. You may delete your account at any time.

12 Account Deletion and Backups

12.1

You may delete your TasTrack account through the mobile application or available account settings. Deletion from active systems begins promptly. You may also delete individual tasks, contacts, transcripts, integrations, and other supported records without deleting the entire account.

12.2

Account deletion includes active account data, stored content, cached copies, and account-specific derived information, including the writing-style profile, unless limited information must be retained for a legal, accounting, fraud-prevention, security, or dispute-resolution purpose.

12.3

TasTrack creates encrypted daily backups for service continuity and disaster recovery. Backups are retained for up to thirty days, access is restricted and logged, and expired copies are automatically overwritten or deleted. Information deleted from active systems may remain in a protected backup until that backup expires. Backup data is not used for ordinary product operations. If a backup is restored, TasTrack will take reasonable steps to reapply completed deletion requests.

13 Security

13.1

TasTrack uses technical and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. These measures include encryption in transit and at rest, multi-factor authentication, role-based access, least-privilege controls, row-level security, production-access logging, security monitoring, vulnerability scanning, penetration testing, secure backups, vendor security reviews, incident-response procedures, and security training for personnel.

13.2

Personnel and contractors are subject to confidentiality and data-protection obligations. Access to production systems is limited according to job responsibilities. Support personnel cannot impersonate users or freely enter user accounts.

13.3

No security measure can guarantee complete security. You are responsible for protecting your credentials, using available security features, maintaining control over connected accounts, and notifying us promptly if you suspect unauthorized access.

13.4

Security vulnerabilities may be reported to vulnerability@tastrack.ai. If a personal-data breach occurs, TasTrack will investigate and notify affected individuals and regulators where required by applicable law.

14 International Data Transfers

14.1

TasTrack is based in Singapore and is available internationally. Personal data may be processed in Singapore and in other countries where TasTrack or its service providers operate infrastructure. Those countries may have privacy laws different from those in your country.

14.2

Where required, TasTrack uses appropriate safeguards for international transfers, such as contractual protections, the European Commission’s Standard Contractual Clauses, equivalent United Kingdom safeguards, vendor security reviews, and other legally recognized transfer mechanisms.

15 Cookies and Similar Technologies

15.1

TasTrack uses cookies and similar technologies on its website and web applications to keep users signed in, remember settings, secure the Service, understand product use, attribute referrals, and analyze performance. These may include necessary, preference, and analytics cookies. TasTrack does not use personal data for cross-context behavioral advertising.

15.2

Where required by law, TasTrack provides a cookie notice or consent control. You can also manage cookies through your browser. Blocking necessary cookies may prevent parts of the Service from working correctly.

15.3

Because TasTrack does not sell personal data or use it for cross-context behavioral advertising, browser signals such as Do Not Track or Global Privacy Control generally do not change those practices. TasTrack will honor legally valid browser-based opt-out signals where they apply to a processing activity covered by law.

16 Marketing Communications

16.1

TasTrack may send newsletters, product announcements, partner information, or promotional communications if you separately subscribe or where otherwise permitted by law. Marketing consent is separate from acceptance of this Privacy Policy. You can unsubscribe using the link in a marketing email or by contacting us. You may continue to receive essential account, transaction, support, security, and legal notices.

16.2

TasTrack may provide in-application product notices. You can manage available notification settings through the Service or your device.

17 Your Rights and Choices

Depending on where you live and subject to legal exceptions, you may have rights to:

• 17.1 ask whether TasTrack processes your personal data and request access to it;
• 17.2 request correction of inaccurate or incomplete personal data;
• 17.3 request deletion of personal data;
• 17.4 restrict or object to certain processing;
• 17.5 withdraw consent where processing relies on consent;
• 17.6 request a portable copy of eligible personal data;
• 17.7 opt out of marketing communications;
• 17.8 revoke or pause an integration and restrict supported conversations, senders, folders, chats, channels, or meetings;
• 17.9 appeal a refusal where applicable law provides that right; and
• 17.10 complain to the relevant data-protection or privacy regulator.

17.11

Some information can be corrected or deleted directly in TasTrack. TasTrack does not currently provide a general in-application data export, but you may submit an eligible access or portability request to privacy@tastrack.ai.

17.12

We aim to acknowledge privacy requests within five business days and respond within the period required by applicable law. We may request additional information reasonably necessary to verify your identity and protect your account. A unique account identifier may form part of this verification. Authorized representatives may submit requests where applicable law requires us to accept them, subject to proof of authority and identity verification.

17.13

We will not unlawfully discriminate against you for exercising a privacy right. If your account is controlled by an employer or another organization, we may direct your request to that organization or assist it in responding.

18 California Privacy Information

18.1

If California privacy law applies to you, the categories of personal information TasTrack may have collected during the preceding twelve months are described in Personal Data We Collect. They may include identifiers, contact information, commercial or subscription information, Internet or electronic network activity, approximate location, professional information, audio or visual content you submit, communications, and inferences or derived information used to provide TasTrack features.

18.2

TasTrack collects and uses these categories for the business and commercial purposes described in How We Use Personal Data and may disclose them to the categories of recipients described in How We Disclose Personal Data. TasTrack does not sell personal information and does not share personal information for cross-context behavioral advertising. TasTrack does not use or disclose sensitive personal information to infer characteristics about individuals for unrelated purposes.

18.3

California residents may exercise applicable rights to know, access, correct, delete, and obtain information about collection and disclosure, and may use an authorized agent where required by law. Requests may be sent to privacy@tastrack.ai.

19 Children and Students

19.1

TasTrack is designed primarily for people managing work, study, and personal responsibilities and is not specifically directed to young children. Students may use TasTrack where permitted by their school, organization, parent or guardian, and applicable law.

19.2

If the law in a user’s country requires parental or guardian consent for the processing of a child’s personal data, the child may use TasTrack only with valid authorization. If we learn that personal data was collected from a child without required authorization, we will take reasonable steps to delete it. A parent or guardian may contact privacy@tastrack.ai.

20 Information About Other People

20.1

Connected communications may contain information about recipients, senders, colleagues, customers, meeting participants, and other people who do not use TasTrack. TasTrack processes that information only to provide features to the user or organization that connected or supplied the content.

20.2

You are responsible for connecting only accounts and content you are authorized to use and for providing notices or obtaining consent where required. A non-user who has a privacy concern may contact privacy@tastrack.ai. We will assess the request under applicable law and may need to coordinate with the TasTrack user or organization that controls the relevant content.

21 Third Party Services and Links

21.1

TasTrack integrates with and may contain links to services operated by other companies. TasTrack does not control those services and is not responsible for their independent privacy practices. You should review the privacy notice and account controls of each service you connect.

21.2

Disconnecting a service stops TasTrack from collecting new data through that connection, but it does not delete information held independently by the connected provider. Labels, folders, drafts, or other items previously created in the source account may remain there until you remove them through that provider.

22 Changes to This Privacy Policy

22.1

We may update this Privacy Policy to reflect changes to the Service, our processing practices, providers, or legal requirements. The Last updated date identifies the current version. If a change materially affects your rights or how we use personal data, we will provide additional notice through email, the Service, or another appropriate method and request consent where required by law.

23 Contact Us

23.1

For questions, concerns, complaints, or requests about this Privacy Policy or personal data, contact:

23.2

You may also contact the privacy or data-protection regulator in your jurisdiction. In Singapore, the relevant regulator is the Personal Data Protection Commission.