Privacy Policy
Last updated:
This Privacy Policy explains how TBD ("Talk2task", "we", "us") collects and uses personal data when you visit our website talk2task.ai, request a demo or log in to a Talk2taskworkspace. It is written to meet the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD) and the Spanish Law 34/2002 on Information Society Services (LSSI).
1. Who we are
The controller of the personal data described in sections 3 to 5 is TBD. You can reach us about anything in this policy at hello@talk2task.ai.
2. Two roles: controller and processor
For our website, demo requests and workspace log-in, we decide why and how personal data is processed, so we are the controller.
A customer's workspace shows the records of its team's calls that the customer gives us under its agreement: summaries, decisions, action items, task proposals and profiles of the people in those calls. We store and show these records only on the customer's documented instructions, so for that data we are the processor and the customer is the controller. That processing is governed by the data processing agreement (DPA) we sign with each customer before we receive any of its records, and section 6 summarises it. If you appear in the records of one of our customers, please contact that customer first; we will help them answer your request.
3. What we collect and why
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Arranging a demo you request | Your work email address. The form does not ask for your name. | Steps taken at your request before entering into a contract (art. 6(1)(b) GDPR) | Up to 24 months after our last contact, unless you become a customer or ask us to delete it sooner |
| Occasional follow-up about Talk2task after a demo request | Work email address | Our legitimate interest in following up on a business enquiry (art. 6(1)(f) GDPR). You can object at any time. | As above |
| Logging in to a workspace | Work email address; your password, stored only as a salted hash; records of your sessions; links to set a password, stored only as hashes; a count of recent log-in attempts, stored under a hash of your email address; a session cookie | Performance of the contract with your organisation (art. 6(1)(b) GDPR) | Email address and password hash: while your account exists. Link to set a password: works once, for up to 7 days; its hashed record is kept while your account exists. Session: up to 14 days, or until you log out; the record of an expired session is deleted the next time anyone logs in, and at the latest with your account. Attempt count: at least an hour after the first counted attempt, then until the next time anyone logs in |
| Running and protecting the website, including rate limits on forms and log-in | Technical request data, such as IP address, browser type and time of request; event logs of the service, such as a failed log-in with the internal number of the account, without email or IP address | Our legitimate interest in a secure, working website (art. 6(1)(f) GDPR) | Request data: kept by our hosting provider for a short period under its own retention policy. Event logs: up to 7 days |
| Customer relationship, contracts and invoicing | Names, work contact details and role of customer contacts, billing details | Performance of a contract and compliance with legal obligations (art. 6(1)(b) and (c) GDPR) | For the duration of the contract, then as long as Spanish tax and commercial law require (generally up to 6 years) |
Records deleted from our database stay in its recovery history for up to 30 days, and are gone after that.
We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Cookies
The website uses no analytics, advertising or third-party tracking cookies. The only cookie is a strictly necessary session cookie (__Host-t2t_session), set when you log in to a workspace and needed to keep you logged in. It lasts up to 14 days and is deleted when you log out. The demo workspace keeps your clicks in the local storage of your browser (talk2task.demo); they are not sent to us. Strictly necessary cookies and storage do not require consent under article 22.2 of the LSSI.
5. Who we share data with
We share personal data only with service providers that process it on our behalf under written contracts, and only as far as they need to provide their service:
- Hosting and database: Cloudflare, which hosts the website, runs the service behind the demo form, log-in and workspace, and stores our database in the European Union.
- Professional advisers and authorities: where required by law, or to establish, exercise or defend legal claims.
6. Customer records in the workspace
- We store the records a customer gives us in its workspace and show them only to signed-in members of that workspace.
- We do not use customer records to train models, and we do not share them with other customers.
- Processing region, sub-processors, retention and deletion of customer records are set out in the DPA.
- The customer is responsible for having a lawful basis for the records it gives us, including the recording of its calls and informing the people in them as the law of their jurisdictions requires.
7. International transfers
Our database is stored in the European Union. Some of our providers may process personal data outside the European Economic Area. Where they do, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework where the provider is certified) or on the Standard Contractual Clauses approved by the European Commission, together with any additional safeguards required.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, salted password hashes, single-use links to set a password and session tokens stored only as hashes, HttpOnly and Secure session cookies, rate limits on log-in and forms, and access to production systems limited to the people who need it. No system is completely secure; if a personal data breach affects you, we will inform you and the authorities as the law requires.
9. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and, where processing is based on consent, to withdraw that consent at any time. To exercise any of these rights, email us at hello@talk2task.ai. We answer within one month. We may ask you to confirm your identity first.
You also have the right to lodge a complaint with a data protection authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es), C/ Jorge Juan 6, 28001 Madrid.
10. Children
Talk2task is a service for businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.
11. Changes to this policy
We may update this policy from time to time. We will change the date at the top of this page and, for material changes, notify customers by email before the change takes effect.
12. Contact
TBD. Email: hello@talk2task.ai.