Data processing summary

Last updated: October 15, 2026

Plain-language summary first; the full terms follow.

You (the customer) control the personal data in your workspace. We process it only to run Taskeni for you.
Everyone who works on Taskeni keeps it confidential.
We use a short, published list of subprocessors and tell you before we add a new one.
We protect data with the measures on our security page, and tell you without undue delay if a breach affects it.
We help you answer requests from people about their data.
When you leave, you can export your data, and we delete it.
Need a signed data processing agreement? Email support@taskeni.app.

What this page is

This is a plain-language summary of how Taskeni processes personal data on behalf of business customers. It's meant to help with the requirements of the GDPR, the UK GDPR, and similar laws. If you need a signed data processing agreement (DPA), see the last section of this page. When a signed DPA exists, it takes precedence over this summary.

Roles

You are the controller. The customer who owns a workspace decides what personal data goes into it and why.
Taskeni is the processor. We process that data only to provide Taskeni to you.
For account sign-in, website visits, and support, Taskeni is the controller. Our Privacy Policy covers that.

The data we process for you

Subject matter and duration: providing Taskeni, for as long as you use it, plus the deletion period described below.
Nature and purpose: storing, organizing, displaying, searching, and sending workspace content; delivering notifications; running integrations you connect; and, only if you turn them on, AI helpers.
People whose data is involved: your workspace members and guests, people mentioned in your content, people who submit your request forms, and people who email your board addresses.
Types of data: names, email addresses, profile photos, and whatever personal data you or your team put into tasks, comments, files, custom fields, and time logs.
Special categories: Taskeni isn't designed for sensitive data such as health records. Please don't put it in your workspace.

Your instructions

We process workspace data only on your documented instructions. These terms, your workspace settings, and the features you use are those instructions. For example, turning on AI helpers instructs us to send the data each AI request needs to our AI provider. If we believe an instruction breaks data protection law, we'll tell you. If the law requires us to process data in another way, we'll tell you first, unless the law forbids that.

Confidentiality

Everyone with access to customer data on our side is bound to keep it confidential. We access workspace content only when we need to: to provide support you ask for, to fix a problem, to investigate abuse or a security issue, or to comply with the law.

Subprocessors

You give us general permission to use the subprocessors on our subprocessors page.
Each subprocessor is bound by a written contract with data protection obligations no weaker than ours.
Before we add or replace a subprocessor, we update that page. Customers who have signed our DPA get at least 30 days' notice by email.
You can object on reasonable data protection grounds. If we can't resolve the concern, you can end your use of Taskeni for that workspace.
We remain responsible for our subprocessors' work.

Security measures

We use technical and organizational measures suited to the risk. They include:

encryption in transit (TLS) and at rest, by our hosting providers;
two-step verification with backup codes, and throttling of repeated failed sign-ins;
server-side checks of membership, role, and board access on every change;
private boards, and guest access limited to the boards shared with each guest;
API tokens stored as hashes, scoped to read or write, and revocable;
webhooks signed with HMAC-SHA256;
AI helpers off by default, sending only the data each request needs when they're on.

The full list is on our security page. We may update these measures over time, but never in a way that lowers overall protection.

Personal data breaches

If we become aware of a breach affecting your workspace data, we'll tell you without undue delay. We'll explain what happened, what data and people are likely affected, what we're doing about it, and who you can contact. We'll keep you updated as we learn more and help you meet your own obligations to notify authorities or people.

Assistance

Taking into account what Taskeni is and the information we have, we'll help you:

respond to requests from people exercising their rights, such as access, correction, export, or deletion. Many of these can be done in the app directly;
carry out data protection impact assessments, and consult regulators where needed;
meet your security and breach notification duties.

If a person contacts us directly about data in your workspace, we'll pass the request to you and won't answer it ourselves unless you ask us to.

International transfers

Taskeni is run from Bangladesh, and workspace data is stored in the United States. Where the GDPR or UK GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses (with the UK addendum where needed), or another lawful mechanism.

Deletion and return at the end

At any time, you can export a workspace as JSON from Settings → Data. Files can be downloaded from their tasks.
When you stop using Taskeni, you can delete the workspace yourself, or ask us to delete it.
We delete customer personal data from our active systems within 30 days of your request, unless the law requires us to keep it.
Copies in our providers' backups are deleted when those backups are overwritten on their normal schedule.

Audits

On reasonable request, we'll give you the information you need to show that we meet these obligations. This includes answering security questionnaires and describing our measures and subprocessors. If that isn't enough, or a regulator requires it, we'll agree to a reasonable audit. It must be at your cost, with at least 30 days' notice, no more than once a year (unless there's been a breach), and under confidentiality terms that protect other customers' data. We don't hold SOC 2, ISO 27001, or other certifications.

How to get a signed DPA

Email support@taskeni.app with "DPA" in the subject. Include your organization's legal name, its address, and the workspace it covers. We'll send you our DPA, which includes the Standard Contractual Clauses, to sign.