Privacy Policy
This draft was prepared by the product team to make the remaining decisions visible. It has not been reviewed by a lawyer and it is not a binding agreement. Until it is approved, it describes intent, not obligations.
How to read this document
This document is a prepared draft. Every place that depends on a decision by the company (jurisdiction, data residency, retention periods, the legal basis for processing, the form of consent) is marked with a visible marker. A marked place is not a promise and not a legal statement — it is a question that has to be answered before this document can be approved and become effective.
Open questions — this document cannot be approved until they are answered
- Q-LG-1 — Who is the data controller: the service operator or the customer?
- Q-LG-2 — Which legal entity publishes this policy, and what is the contact address for data-subject requests?
- Q-LG-3 — What is the legal basis for processing each category of data?
- Q-LG-4 — Which data residency regions are offered, and where is inference performed?
- Q-LG-5 — What are the retention periods, and what happens to data when they expire?
- Q-LG-6 — What is the form of consent to recording, and which channels require consent?
- Q-LG-7 — What is the deadline for answering a data-subject request?
- Q-LG-8 — Which sub-processors are published, and under what terms?
- Q-LG-9 — Which security guarantees are published externally (technical measures only, or a certification programme)?
1. Who we are
TaskTreker is an assistant for product managers. It connects to the channels you connect — meetings, documents, calendar — reads what those channels contain, and proposes tasks, decisions, insights and facts. You decide what enters your product context.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Кто является контролёром персональных данных — варианты: A) оператор сервиса как контролёр, клиент — процессор; B) клиент как контролёр, сервис — процессор; C) совместные контролёры с распределением ответственности]
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Юридическое лицо, на чьё имя работает сервис, и адрес для обращений субъектов данных — варианты: A) указать реквизиты в этом документе; B) публиковать только после регистрации юридического лица]
2. What we collect
Content you connect. Meeting recordings and transcripts you upload, documents from the connected document source, calendar events and their participants. Reviews, chat and email channels exist in the product model but are not yet enabled for reading.
Output the assistant produces. For each connected channel we record what was read, and the proposed tasks, decisions, insights and facts together with a pointer to the exact fragment they came from. A proposal is not context: it does not enter your answers, your sizing calculations or your priorities until a person confirms it.
Technical data. Account data (email address), sessions, the company profile you set, and audit records of actions taken in the product, including who did what and when.
- There is no microphone capture in real time: a channel hands over a finished recording or transcript, and only then is it processed.
- Content you mark as sensitive is not sent to the model by default.
- Per channel you can switch off reading, sending to the model and local processing independently.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Кто отвечает за информирование работников и третьих лиц при подключении канала — варианты: A) ответственность на клиенте, в договоре; B) продукт показывает отдельный чек-лист до подключения канала]
3. Why we process it, and on what basis
The service exists to turn material you already have access to into a review queue you can work through. Processing is limited to that: reading what you connected, extracting candidate items, and showing them to you.
The assistant proposes; a person decides. Nothing extracted from a channel changes your context, your sizing model or your priorities without a human confirmation step.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Основание обработки по категориям данных — варианты: A) согласие на все категории; B) исполнение договора на обработку; C) законные интересы для каналов без записи; D) комбинация: согласие для записей встреч, договор для остального]
4. Who else receives the data
Model provider. When a channel is allowed to send to the model, the extracted text of that channel is sent to the model provider to produce candidates. You can switch that off per channel and use local processing instead. Every model call is recorded: what was sent (after redaction of email addresses, phone numbers, names and customer identifiers), and what came back.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Перечень субпроцессоров и условия работы с модельным провайдером (наименование, регион обработки, режим использования данных) — варианты: A) перечислить в этом документе; B) вынести в приложение и обновлять по реестру субпроцессоров]
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Категории получателей данных (хостинг, объектное хранилище, почтовый провайдер, платёжный провайдер) — варианты: A) перечислить в этом документе; B) вести отдельную страницу со списком получателей]
5. Where the data is stored
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Где физически хранятся данные клиента и где выполняется инференс — варианты: A) регион ЕС; B) регион США; C) регион РФ; D) регион выбирается клиентом; E) на старте не фиксируется — в документе указывается, что размещение зависит от региона развёртывания]
Technical note: the region is not fixed yet. We will state the concrete region in this section before this document is approved, rather than publish a guarantee we cannot keep.
6. How long we keep the data
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Сроки хранения и что происходит с данными по их истечении — варианты: A) транскрипты 90 дней, извлечения 180 дней, аудит-логи 365 дней, логи обращений к модели 30 дней; B) до отзыва согласия и отдельного запроса на удаление; C) иные сроки — указать явно]
Technical note, stated plainly: those default periods are configured in the application, but the background cleanup job that would enforce them is not implemented yet. Until it is, nothing is deleted automatically. We will not publish automatic deletion as a promise before it works.
7. Consent
Consent to record meetings is explicit, given per channel, and revocable. Without it, meeting material is not processed at all — not processed with caveats. Every grant and every revocation is written to a consent log with the channel, the scope and the time.
Revocation is forward-looking. Once you revoke consent, meeting material that has not been processed yet is no longer processed. Material that was already processed stays in place until it is deleted; see section 8 for how deletion is requested today.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Форма согласия — варианты: A) явная галочка на уровне канала встреч, фиксируется в журнале; B) согласие на каждую встречу отдельно, по ссылке в приглашении; C) оба варианта доступны одновременно]
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Нужно ли отдельное согласие для каналов документов, чата и почты — варианты: A) нет, покрывается договором; B) да, для любого канала с содержанием третьих лиц]
8. Your rights
- Access and export: you can export your context, your full data set and your sizing models from the product, in open formats.
- Correction: confirmed context nodes can be corrected through the API (PATCH /v1/context/nodes/:id). There is no self-service correction screen in the product interface yet.
- Withdrawal of consent: available at any time in the consent log in the product.
- Objection to processing and erasure: see the note below — the path is being built and is not yet self-service.
Technical note, stated plainly: export is implemented and works today. Self-service deletion of an account together with all of its data — including the search index and stored objects — is not implemented yet, and there is no deletion endpoint in the API. We will publish a request address and ship the deletion path before selling to companies.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Срок ответа на запрос субъекта данных — варианты: A) 30 дней; B) 30 дней с возможностью продления на 60 дней с уведомлением; C) иной срок — указать]
9. Security
The product is built so that one company cannot see another company's data: isolation is enforced both in the code and in the database itself, and a recorded audit trail shows who did what.
- Content you connect is treated as data, never as instructions for the model.
- Content marked as sensitive is not sent to the model by default.
- Identifiers are redacted before text leaves your infrastructure.
- Model calls are logged: what was sent, what came back.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Какой уровень гарантий безопасности публикуется наружу — варианты: A) только технические меры, описанные в этом разделе; B) заявлять участие в программе сертификации с указанием сроков; C) не публиковать утверждений о сертификации]
10. Changes to this document
When this document changes, its version and date change with it, and the consent log records which version was in effect when consent was given.
[ТРЕБУЕТ РЕШЕНИЯ ЗАКАЗЧИКА: Как заказчику узнать об изменении документа — варианты: A) уведомление по электронной почте за 30 дней до вступления в силу; B) уведомление в интерфейсе продукта; C) оба канала]