Privacy Policy

1) Who we are

22tasks (the "Service") is provided by 202201662 – СИНКИТ ООД / "SINKIT" Ltd ("we", "us", "our").

Registered address: БЪЛГАРИЯ, гр. София (1000), р-н Средец, Г.С.Раковски, 132, вх. А, ап. 2

Email: support@22tasks.com

2) Scope

This Privacy Policy explains how we collect and process personal data when you visit the website at https://22-tasks.vercel.app/ or create an account or use the Service. The Service is intended for business/team use and is not directed to children.

3) GDPR roles (Controller / Processor)

• When you use 22tasks on behalf of a company/workspace, the workspace owner/admin or your organization is typically the Controller for personal data included in tasks and workspace content ("Customer Data").

• We act as a Processor for Customer Data and process it only to provide, secure, and improve the Service and as described here.

• For certain limited data (e.g., operational security logs and service communications), we may act as an independent Controller.

4) Personal data we process

A. Account and workspace data

• Email address (account login and service communications)

• Workspace/team name (if you set one)

• Invited members' email addresses

• Optional profile information you provide (e.g., display name)

B. Customer Data (content you input)

• Tasks (titles, descriptions, steps), due dates, assignees/owners, statuses

• Comments, activity entries, and updates

• Any other content you submit into the Service

C. Notifications and emails

• Operational emails (e.g., invites, daily digests, reminders, security/availability updates)

D. Usage and technical data

• IP address, device/browser information

• Logs related to access, feature usage, and errors

E. Cookies / local storage

We use strictly necessary cookies/local storage to keep you signed in, maintain session security, and remember essential preferences.

Analytics: We use Vercel Analytics. Vercel Analytics may collect information about your use of the Website/Service (for example page views and performance metrics). Where required by law, we will request consent for non-essential cookies/technologies.

5) How we use personal data

• Provide the Service (accounts, workspaces, tasks, collaboration)

• Deliver digests/reminders and other essential service communications

• Maintain security, prevent abuse, and troubleshoot problems

• Monitor performance and improve the Service

• Comply with legal obligations and enforce our terms

6) Legal bases (GDPR)

• Contract (Art. 6(1)(b)) – to provide the Service

• Legitimate interests (Art. 6(1)(f)) – to secure, maintain, and improve the Service; prevent abuse/fraud

• Consent (Art. 6(1)(a)) – for non-essential cookies/optional communications where required

• Legal obligation (Art. 6(1)(c)) – where we must retain/disclose information

7) Sharing and disclosures

We do not sell personal data.

• Within your workspace with authorized members, based on your permissions/settings

• With service providers (sub-processors) that help run the Service (hosting, database/auth, analytics, email delivery, monitoring)

• For legal reasons (lawful requests, compliance, protection of rights/safety)

• In a business transfer (merger/acquisition/asset sale), subject to appropriate protections

7A) Sub-processors (service providers)

We use the sub-processors below to deliver and secure the Service. They may process personal data only to provide their services to us. We may update this list over time; if changes are material, we will update this Privacy Policy.

Note: Depending on configuration and provider operations, processing may occur in multiple regions. Where required, we rely on appropriate transfer safeguards (e.g., Standard Contractual Clauses).

8) International transfers

Your data may be processed outside the EEA/UK depending on where our providers operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses and other lawful transfer mechanisms.

9) Data retention

• Account/workspace data: for the duration of your account/workspace, unless deleted.

• Customer Data: until deleted by you/admin or the workspace is closed.

• Backups: up to 90 days.

• Logs: up to 90 days (unless needed longer for security investigations or legal compliance).

10) Security

We use technical and organizational measures designed to protect data, including access controls and encryption in transit. No method of transmission or storage is 100% secure, but we work to protect the Service against unauthorized access, alteration, and loss.

11) Your rights

Depending on your location (including EEA/UK), you may have rights to access, correct, delete, restrict, object, and request portability of your personal data, and to withdraw consent (where applicable).

To exercise rights, contact support@22tasks.com. If your organization is the Controller for certain Customer Data, we may ask you to route the request through your workspace admin.

You may also lodge a complaint with your local data protection authority.

12) Planned file uploads

We plan to introduce file uploads/attachments. When we do, this Privacy Policy may be updated to describe what data is collected, how it is stored, and retention controls.

13) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice (e.g., in-app or email). The "Last updated" date will reflect the current version.