Privacy Policy

This policy explains what information TaskIt — operated by JIN Solutions — collects, why, how long we keep it, who else sees it, and what you can ask us to do with it. It applies to this website and to every workspace on the platform.

If you are an employee whose details were added to a workspace by your employer, direct requests about that data to your employer first — they control it. We will help them action your request.

We collect only what the service needs to function. In summary:

We do not ask for and do not want sensitive personal data — health, biometric, financial account or government identity information. Please do not put it into task fields or attachments.

When a workspace is created we collect the company name, workspace alias, and the administrator’s name, work email, password and — optionally — a mobile number. Additional users are added by your administrators, who supply the same details.

• Passwords are never stored in readable form. They are hashed with bcrypt, a deliberately slow one-way function. We cannot recover your password, only reset it.
• Phone numbers are used to deliver WhatsApp notifications and one-time codes for password reset, email change and phone change. Supplying one is optional; without it, those channels are unavailable to that user.
• Email addresses identify the account at sign-in and receive service notices. Changing one requires a verification code.
• Sign-in security data — failed attempt counts and lock timers — is stored so repeated failures lock an account rather than allowing unlimited guessing.

Task data is whatever your organisation records in the product: titles, descriptions, custom form responses, progress notes, handover records, blocking reasons, due dates, collaborator contributions and the timestamps behind every reporting figure.

• It is visible only to authenticated users of the same workspace, and within that workspace only to the extent their role’s permissions allow.
• Recorded workspace actions are written to an immutable audit log showing the action, the acting user, the target record and the time. Workspace administrators with the audit permission can read it. This is intentional — accountability is the point of the product — and it means task activity is attributable to the individual who performed it.
• Performance analytics are computed from stored task timestamps. They describe how long work took, and can therefore be used by your employer to assess performance. Nothing is inferred, scored or predicted by us.
• We do not read your task data, and we do not use it to train machine-learning models. Our staff access it only when you ask us to investigate a problem, and such access is limited to what the investigation requires.

Files attached to tasks and handovers are stored on our server, outside the public web root, under generated filenames. The name you upload is discarded and the on-disk name is never exposed.

Uploads are validated three ways: the file extension must be on our allowlist, the declared type must agree with the extension, and the actual bytes must match what the filename claims. Executable and markup formats are refused. Attempts to reach another workspace’s file are logged and recorded as an audit denial.

A file is deleted when you delete it or when its workspace is deleted, subject to the retention period below. Copies may persist in encrypted backups until those backups age out.

What the application does store in your browser:

Everything above except the analytics cookies is strictly necessary or purely functional and is shared with nobody. Clearing your browser storage signs you out and resets these preferences; it does not affect any data held in your workspace.

Our public marketing pages use Microsoft Clarity, a usage analytics tool. It records how those pages are used — page views, clicks, scrolling and mouse movement, plus your browser, device type and a coarse location derived from your IP address — and turns it into heat-maps and session replays that show us which parts of the site confuse people. Text you type into form fields is masked before it leaves your browser.

The same pages also use Google Analytics 4, which counts page views and tells us which pages, devices, countries and referring sites the traffic comes from. It sees the addresses of the public pages you open, your browser and device type and a coarse location derived from your IP address.

We run no tag manager and no advertising analytics anywhere. Our Google Analytics property is linked to no advertising account and has no remarketing or advertising features switched on, no profile of you is built for advertising, and nothing about your usage is sold or shared for marketing.

What we keep ourselves is operational, and stays on our own infrastructure:

• Server logs — request paths, response codes, timestamps and IP addresses, used to diagnose faults and investigate abuse.
• Security events — failed sign-ins, account lockouts, rate-limit trips and rejected tokens, used to detect attacks. Email addresses are masked in these logs.
• Aggregate platform statistics — counts such as active workspaces or messages delivered, which identify no individual.

Note that our site sits behind a content delivery network, which may record standard request metadata of its own for security and traffic-routing purposes.

Security is enforced in the application, not merely promised in this document. The measures in place today:

• Encrypted transport. All traffic is served over HTTPS with HSTS.
• Password hashing. bcrypt, one-way. Plaintext passwords are never written to disk or logs.
• Workspace isolation. Every record is scoped to a company, and every request is authorised against the signed-in user’s company before data is read or written.
• Role-based access control. Permissions come from the role assigned to a user, checked on the server on every request — never assumed from what the interface shows.
• Short-lived sessions. Access tokens expire quickly and are renewed against the server, so a permission or role change takes effect promptly. Deactivating a user revokes their refresh tokens.
• Brute-force protection. Rate limiting per address and per route, progressive delays on failed sign-ins, and a temporary account lock after repeated failures.
• Upload validation. Extension, declared type and magic-byte checks, with authenticated, tenant-checked downloads.
• Hardened responses. Content-type, framing, referrer and content-security headers on every API response.
• Audit trail. Recorded workspace actions and security denials are written to an immutable log.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected workspace administrators and the relevant authority without undue delay, describing what happened, what data was involved and what we are doing about it. If you believe you have found a vulnerability, please report it to [email protected] rather than disclosing it publicly.

We keep information only as long as there is a reason to:

Deletion means removal from live systems. Copies inside encrypted backups are not individually purged, but expire with the backup on its normal rotation.

We keep the number of third parties that touch your data deliberately small. The complete list:

We do not sell personal data, and we do not share it for anyone else’s marketing. We disclose it only to these processors, to professional advisers under a duty of confidence, where compelled by law or a valid legal request, or to a successor entity in a merger or acquisition — in which case you would be told before your data became subject to a different policy.

Data is hosted in India. Where a processor operates infrastructure elsewhere, appropriate safeguards apply to that transfer.

All payments for TaskIt are processed by Razorpay Software Private Limited, an RBI-authorised payment aggregator.

• We share with Razorpay only what a payment requires: the invoice amount, currency, invoice reference and your billing contact details.
• Razorpay processes that information as an independent controller under its own privacy policy and RBI obligations.
• We hold no payment mandate — no saved card, no e-mandate, no standing instruction. Every payment is one you initiate, so nothing can be auto-charged.
• Refunds, when due under the Refund Policy, are returned through Razorpay to the original payment method.

WhatsApp notifications are optional and off until a workspace administrator pairs a WhatsApp number. Messages are sent through a gateway we host ourselves — your message content is not handed to a third-party bulk-messaging vendor.

• Your own number sends the messages. Each workspace pairs its own device, so recipients see your organisation as the sender, and your organisation is responsible for what is sent.
• What is sent. Task notifications, scheduled reports, and one-time codes for password reset and email or phone change. Content comes from the templates your administrators configure, so keep sensitive detail out of them.
• Who receives them. Users with a phone number on file, and any WhatsApp groups an administrator has linked. Group delivery means everyone in that group sees the message — including anyone your administrator added.
• Delivery logs. We record each send attempt — recipient number, status, gateway reference and a short preview of the text — so failures can be diagnosed. These logs are visible to us as the platform operator.
• WhatsApp itself. Once a message leaves our gateway, WhatsApp (Meta) transmits it under its own terms and privacy policy, which we do not control.
• Opting out. Removing a phone number from a user’s profile stops direct messages to them. Administrators can disable notification types, change delivery targets, or unpair the device entirely.

Subject to applicable law — including the Digital Personal Data Protection Act, 2023 — you may:

• Access the personal data we hold about you and be told how it is processed.
• Correct anything inaccurate or incomplete. Most profile details can be corrected in the product immediately.
• Erase your data, subject to records we must keep by law — invoices and tax records in particular.
• Export your workspace data in a portable format. Reports export to CSV, Excel and PDF from inside the product at any time.
• Withdraw consent for optional processing, such as WhatsApp notifications, without affecting the service itself.
• Complain to us, and to the Data Protection Board of India if you are not satisfied with our response.

How to exercise them

Write to [email protected] from your registered address, stating what you want. We will verify your identity and respond within 30 days. There is no charge unless a request is manifestly unfounded or repetitive.

TaskIt is a workplace product intended for people aged 18 and over. We do not knowingly collect data about children. If you believe a child’s data has been entered into a workspace, tell us and we will work with the workspace administrator to remove it.

We update this policy when the product or the law changes. The “last updated” date at the top always reflects the current version. Material changes are notified to workspace administrators by email or in-product at least 30 days before they take effect; clarifications take effect on publication.

JIN Solutions, 1st Floor, Semsons Plaza, Near Dahanukarwadi Metro Station, Kandivali West, Mumbai - 400067, India, is responsible for the processing described here. Privacy questions, data requests and complaints can go to the address below or through the contact form.