Privacy policy

Who is responsible

• For data about the people in a workspace (time, activity, pay), the organisation that owns the workspace is the controller and decides why the data is processed. TaskDash acts as their processor under Article 28 GDPR and processes that data only on their instructions.
• For your TaskDash account itself, for our website and for messages you send us, QudsLab, the maker of TaskDash, is the controller.
• You can reach us through the contact page by choosing "Help with my account". We answer data protection requests within one month, as Article 12 requires.

What we process and why

• Account data (name, e-mail, password hash, role, team). Legal basis: performance of a contract, Article 6(1)(b).
• Tracked time, breaks and idle gaps, and per minute activity: the number of keyboard and mouse events, the active app and its window title. Legal basis: the employer's legitimate interest in accurate working time records and pay, Article 6(1)(f), or a legal duty to record working time where it applies, Article 6(1)(c). We balanced this against your interests: no keystrokes, no browser history, no screen content by default.
• Screenshots, only when the workspace allows them and you gave consent in your Privacy page. Legal basis: your consent, Article 6(1)(a) and Article 7. You can withdraw it at any time with the same ease, and withdrawal never affects your pay or account.
• Pay rates and payouts, visible only to you and to people whose role includes pay. Legal basis: Article 6(1)(b) and the employer's legal obligations, Article 6(1)(c).
• Security data: IP address on sign-in, on screenshot views and on API use, device name and system of connected apps. Legal basis: legitimate interest in keeping accounts and data safe, Article 6(1)(f).

What we never collect

Keystrokes or typed text, clipboard contents, full browser history or URLs, microphone or camera input, location, or files on your computer. We do not use your data to train models and we do not sell or share it for advertising.

Local mode

When TrueDuty is not connected to a server, all data stays in a database on your own computer. Nothing is sent to us or anyone else.

Who can see your data

• You always see all of your own data.
• People in your workspace see only what their role allows. Roles and their permissions are listed in the panel, so you can check them.
• Every opening of a screenshot, including your own, is logged with name, time and IP address, and you are notified.
• Sub-processors: our hosting provider stores the data. The current list, with the location of each provider, is available on request through the contact page, and we tell workspace owners at least 30 days before adding one.

Transfers outside the EEA

Where personal data leaves the European Economic Area, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses with additional safeguards. Self-hosted workspaces keep data wherever their owner runs the server.

How long we keep data

• Screenshots: deleted automatically after the retention period the workspace sets (60 days by default).
• Time, activity and pay records: kept while the workspace exists, so timesheets and payroll stay correct, unless the owner deletes them earlier.
• Closed accounts: personal data is removed within 30 days, except records the employer must keep by law, such as payout records.
• Security logs: up to 12 months. Website contact messages: up to 24 months.

Your rights under the GDPR

• Access (Article 15) and portability (Article 20): see and export your time, activity and pay data from the panel at any time.
• Rectification (Article 16): ask your workspace owner, or us, to correct anything wrong.
• Erasure (Article 17) and restriction (Article 18), within the limits of what your employer must keep.
• Objection (Article 21) to processing based on legitimate interest, and withdrawal of consent for screenshots at any time (Article 7(3)).
• No automated decisions with legal effect (Article 22). Activity levels and categories are information for people, never an automatic verdict about you.
• You can complain to the data protection authority where you live or work. We would rather hear from you first, but you do not need to.

Security

Measures under Article 32 include TLS for the panel, a post-quantum hybrid channel (X25519 and ML-KEM-768) for the app, AES-256-GCM encryption of screenshots at rest, a signed log for offline data, role based access, rate limits and an audit log. If a breach puts your data at risk, the workspace owner is told without undue delay so they can meet the 72 hour notice in Article 33.

Cookies

We use one strictly necessary session cookie to keep you signed in, and your browser stores your light, dark and grayscale choice. Because nothing else is stored, no cookie banner is needed under the ePrivacy rules.

Children

TaskDash is a work tool and not meant for people under 16.

Data processing agreement

Workspaces can request our Article 28 data processing agreement, with the Standard Contractual Clauses attached where needed, through the contact page.

Changes

If we change this policy in a way that affects you, we announce it in the panel and the changelog at least 14 days before it applies.