Data Processing Agreement (DPA)

1. Roles

You (the customer) are the controller of personal data you submit to Task AI. Phthos acts as processor on your instructions, except where we act as controller for account billing, security logging, or product analytics described in our Privacy Policy.

2. Subject matter and duration

Processing covers personal data submitted to Task AI while your subscription or trial is active and for a reasonable wind-down period after termination to allow export and deletion.

3. Nature and purpose

• Hosting and storing task configuration, chat history, and workspace membership.
• Executing AI runs, schedules, and connector syncs you enable.
• Billing, metering, support, and security monitoring.

4. Categories of data subjects

Your employees, contractors, and end users whose data you choose to process through Task AI.

5. Categories of personal data

Identifiers (name, email), professional data, prompts and files you upload, connector content, usage metadata, and technical logs. Sensitive data should not be submitted unless you have a lawful basis and appropriate safeguards.

6. Subprocessors

We use the subprocessors listed below. We will provide notice of material changes (for example via this page or email to workspace owners). You may object on reasonable grounds by contacting us within 30 days of notice.

See also the dedicated Subprocessors page.

7. Security measures

We implement technical and organisational measures including encryption of secrets, role-based access, rate limiting, audit logging for selected actions, and isolated production networking. Details are available on request for security reviews.

8. International transfers

Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms where required by law.

9. Assistance with data subject requests

We will assist you in responding to data subject requests within reasonable scope, using tools we provide or manual support for Enterprise plans. Direct requests to Phthos as processor may be forwarded to you unless we are legally required to respond directly.

10. Deletion and return

Upon termination, you may export workspace data where product features allow. We will delete or anonymise customer personal data within 90 days of account closure unless retention is required by law or for dispute resolution.

11. Audits

Upon reasonable notice and subject to confidentiality, we will provide information necessary to demonstrate compliance, or allow audits for Enterprise customers under mutually agreed scope and frequency.