Data processing

Which of us is which

You are the controller of the personal data your team puts into the service. [[Company name]] is the processor, and acts on your documented instructions — of which using the product is one.

What is processed, and for how long

Subject matter: providing a shared task list. Duration: for as long as the workspace is open. Data subjects: the people in your workspace, and anybody your team names in the work itself. Categories: names, email addresses, optional photographs, and whatever your team chooses to write in tasks and comments.

Because the last of those is open-ended, the product is not intended for special category data — health, biometrics, and the rest of Article 9 — and using it for that is outside these terms.

Sub-processors

[[Hosting provider, region]] and [[email delivery provider, region]]. Workspace owners are told by email before a new sub-processor is added, with enough notice to object by closing the workspace.

Security

Traffic is encrypted in transit. Sign-in and invitation links are stored only as one-way digests, so a link cannot be reconstructed from the database. Every record in the system carries the workspace it belongs to and every query is scoped by it, which is asserted by the test suite rather than left to review. Sessions are individually revocable. [[Encryption at rest, backup regime and access control — to be documented.]]

If something goes wrong

You will be told about a personal data breach affecting your workspace without undue delay and within [[72 hours]] of it becoming known, with what is known at the time rather than after an investigation completes.

Getting it back, and getting rid of it

An owner can close a workspace at any time, which deletes everything in it immediately. Deleted tasks and comments are purged permanently thirty days after deletion. Backups age out on [[backup retention]]. A copy of the workspace's data will be produced on request until the self-serve export ships.

Audit and assistance

Reasonable information to demonstrate compliance will be provided on request, and reasonable assistance given with data subject requests and impact assessments. [[Audit rights — to be drafted.]]