Privacy Policy — Tasknex

1. Information we collect#

Personnel (using the App)

If you are Personnel using the App, we collect the following categories of personal data:

• Identity and profile: your name, mobile phone number, employment type, and the Organization or agency you are associated with.
• Authentication data: a personal identification number (PIN), stored in hashed form; one-time passcodes (OTP) sent by SMS; and session identifiers used to keep you signed in.
• Location data:your device's GPS location, collected when you clock in and periodically during an active shift, used to verify your presence at the assigned outlet and to monitor compliance with location ("geo-fence") requirements.
• Attendance and shift data: clock-in and clock-out times, shift dates, break periods, and time spent at an outlet.
• Field activity data: records you enter during a shift, such as customer or order logs, order values, and customer or transaction types, along with the outlet they relate to.
• Photos: images you capture with your camera or select from your photo library to attach to a shift or attendance record.
• Messages: messages you exchange with your Organization's dashboard users in the App, including their text, any photos attached (up to four per message, with location and camera details removed), replies and reactions, and when each message was sent, read, edited, or deleted.
• Time off and availability: requests for time off you make in the App or that your Organization records for you — the dates or hours, the type of leave, an optional note, and its status and decision (including any reason given) — and, where your Organization uses it, the weekly pattern of days and hours you say you are available to work.
• Sick notes: if you or your Organization attach a photo of a sick note or medical certificate to sick leave, that photo. A sick note is health information. Attaching one is optional, and it is the Organization that decides whether to ask for it.
• Device and technical data: information collected automatically to operate, secure, and improve the Service, including your IP address, device identifiers, app version, operating system and device type, push-notification tokens, and usage and diagnostic logs.

Dashboard and account holders

If you are an Organization administrator or other dashboard user, we collect:

• Account details: your name or display name, work email address, and your password, which is stored in hashed form by our authentication provider — we never see or store it in plain text.
• Role and Organization: the Organization your account belongs to and your role within it (for example owner, admin, or viewer), which determines what you can see and do in the Dashboard.
• Sign-in and session data: sign-in times, session identifiers, and the IP address and browser used, for security and to keep you signed in.
• Dashboard activity: a record of actions taken in the Dashboard — such as enrolling or removing Personnel, scheduling deployments, sending notifications, reviewing shifts, approving payroll, and changing settings — attributed to your account, so that the Organization has an audit trail of who did what.
• Messages: messages you send to Personnel through the Dashboard, with the same details as described for Personnel above.
• Help questions (Ask):the questions you type into Ask, the Dashboard's help assistant, the answers it gives and the Help sections they cite, and any rating or note you leave on an answer. Please do not include personal details in a question.

2. Website, signing up, and enquiries#

If you visit our website or contact us — for example by email or through an enquiry form — we collect the contact details and the content of the message you provide, so that we can respond to you and for our legitimate business interests in operating and improving the Service. You can reach us for general enquiries at support@tasknex.ai.

Signing up

When you create an Organization's workspace through self-serve signup on our website, we collect your company name, work email address, and password (stored in hashed form), the industry and country you select, and your language preferences, together with technical data including your IP address and browser user-agent. We use this information to create and configure the workspace, to send you the confirmation and sign-in emails needed to complete signup, to prevent abuse of the signup flow (for example rate-limiting and duplicate detection), and to keep a record of your acceptance of our Terms of Use and this policy, including which versions you accepted and when.

Signup records — including the details above, the acceptance record, and the associated technical data — are retained as an audit trail for as long as the Organization's account exists and thereafter for the period described in section 10.

Bot protection

The signup page uses Cloudflare Turnstile to distinguish human visitors from automated traffic. Turnstile processes technical data about your visit — including your IP address and browser characteristics — to make that determination. Cloudflare processes this data as our service provider; see section 5.

Cookies

If you choose a currency on tasknex.ai, we store that choice (usd or thb) in a cookie named tnx_cur for one year so our website and sign-up show prices in it; it is a functional cookie, set only when you pick a currency, and holds nothing else.

• Name: tnx_cur
• Purpose: remembers the currency you chose (usd or thb) so prices on our website and the sign-up page are shown in it
• Set by / when: tasknex.ai, only when you pick a currency (the USD | THB switch on the pricing section, or a link that sets the currency) — never from your location
• Domain: .tasknex.ai (shared with app.tasknex.ai, which reads it to pre-select the billing currency on sign-up)
• Lifetime: 1 year
• Type: functional — no tracking, no personal data

Your approximate country

Our website and sign-up page use your approximate country — derived from your internet connection by our hosting provider, Vercel — only to choose the currency prices are shown in by default. We do not store it.

3. How we use your data#

We use your personal data to:

• verify attendance and confirm you are at the correct outlet when clocking in;
• monitor location/geo-fence compliance during your shift;
• record shifts, breaks, and field activity, and make this information available to your Organization for attendance, payroll, and reporting purposes;
• authenticate you (PIN and SMS one-time passcodes for Personnel; email and password for account holders) and keep your account secure, including enforcing single-device sign-in for Personnel;
• create and administer Organization workspaces and Dashboard accounts, apply the correct role and permissions, and keep an audit trail of actions taken in the Dashboard;
• send transactional emails needed to operate the Service, such as signup confirmation, invitations, and password resets;
• deliver messages between Personnel and their Organization, and review messages that are reported to us;
• let Personnel request time off and set their availability, let the Organization record and decide leave, and apply approved leave to the schedule, attendance, and payroll records (a shift on approved leave is treated as excused);
• answer the questions Dashboard users ask in Ask from the Service's Help content, and review those questions, answers, and ratings to improve Help and the answers;
• operate, maintain, secure, and improve the Service; and
• comply with legal obligations and prevent fraud, abuse, or misuse.

4. Legal basis for processing#

Where data protection laws apply — including, where applicable, the Thailand Personal Data Protection Act (PDPA), the Hong Kong Personal Data (Privacy) Ordinance (PDPO), or other applicable data protection laws — we process your data on the basis of: for Personnel, performance of your engagement with the Organization and the legitimate interests of the Organization in managing its field workforce; for account holders and people who sign up, performance of our contract with the Organization and our legitimate interests in operating, securing, and preventing abuse of the Service; your consent (for example, location access, which you can manage through your device settings); and compliance with legal obligations.

A sick note is health information — sensitive personal data under the PDPA (section 26) and special category data under the GDPR (Article 9), where those laws apply. The Organization, as the controller of its Personnel's data, decides whether to collect sick notes and is responsible for having a lawful basis to do so, such as the explicit consent of the person concerned or the Organization's obligations in employment and labour law. Attaching a sick note is never required by the Service. We process sick notes only on the Organization's behalf and only to store and show them as described in this policy; our staff do not view them except where needed to provide support the Organization asks for.

5. How we share your data#

We do not sell your personal data, and we do not share it with third parties for their own advertising or marketing. We share data only as follows:

• With your Organization: for Personnel, the agency, brand, or employer that engages you can access the data relating to you — attendance, location/compliance, shift, and field-activity records — through the Dashboard. This is a core function of the Service. For account holders, the Organization's owners and administrators can see your account details, role, and Dashboard activity. Messages between Personnel and their Organization can be read by all of the Organization's dashboard users; only its owners and administrators can send them. Time-off requests can be seen by all of the Organization's dashboard users, but only its owners and administrators can see the note and any sick-note photo and can approve, decline, or cancel leave; other dashboard users (viewers) see only who is away, the type of leave, and the dates.
• With Tasknex support, when a message is reported: if a message is reported from the App, our support staff can view that message — including its earlier versions if it was edited or deleted — and the messages immediately before and after it, to review the report. The Organization's users cannot see earlier versions of a message.
• With service providers:we use trusted providers to run the Service, including Supabase (database, storage, and authentication hosting), Vercel (web hosting for the Dashboard and website), Vonage (SMS one-time passcode delivery), Resend (transactional email delivery), Anthropic (AI text processing for translation-assist, narrative features, and the Ask help assistant), Cloudflare (bot protection on the signup page), Expo / EAS (app build, delivery, and notifications), and Apple and Google (app distribution and push-notification delivery). These providers process data only to provide their services to us. For the Insights narration, Anthropic receives only aggregated numbers and placeholder tokens — never names, phone numbers or free text; every figure in the written text is filled in by Tasknex from your data afterwards, and an Organization owner can switch the narration off. For Ask, Anthropic receives the question a Dashboard user types, with their Dashboard language and role and passages of the Service's Help content — not the Organization's records.
• With our payment processor: when an Organization starts a paid plan, its payments and subscription are handled by Stripe. Stripe receives the name, email address, and billing address of the person and Organization starting the plan, a tax ID if one is provided, and the card or other payment details — which are entered directly with Stripe and never pass through or are stored by Tasknex. We store only Stripe's customer and subscription identifiers and the subscription's status. Stripe and its affiliates, based in the United States and other countries, process this data under contractual safeguards for international transfers.
• For legal and safety reasons: where required by law, regulation, or legal process, or to protect rights, safety, or property.

6. No sale of data; no marketing use#

We do not sell personal data. We do not use Personnel data for our own advertising or marketing, and we do not share it with third parties for their own advertising or marketing purposes.

7. Third-party integrations#

Where an Organization enables an integration with a third-party provider — for example an attribution or analytics provider — relevant data may be exchanged with that provider as configured by the Organization. Any processing carried out by that provider is governed by the Organization's own arrangement with it, and not by this policy. The Organization is responsible for enabling such integrations and for its arrangements with the relevant provider.

8. Change of control#

Tasknex Limited operates Tasknex. If Tasknex Limited, or its business or assets, is involved in a merger, acquisition, reorganization, transfer to a new operating entity, or sale of assets, personal data may be transferred to the successor entity as part of that transaction. Any successor entity will continue to be bound by this Privacy Policy, or by a policy that is materially equivalent in the protections it provides. We will take reasonable steps to notify affected users or Organizations of any such change where required.

9. International transfers#

Some of our service providers process data on servers located outside Thailand or Hong Kong. Where we transfer personal data internationally, we take steps to ensure it is protected in line with applicable data protection laws.

10. Data retention#

We retain your personal data for as long as needed to provide the service and as instructed by the relevant Organization, and thereafter for any period required to meet legal, accounting, or reporting obligations. Messages and their photos are deleted after the message retention period set by the Organization. When a message is edited or deleted, its earlier version is kept, hidden from the Organization's users, until that same retention period removes the message, so that reports of misuse can be reviewed. Sick-note photos, and their thumbnails, are deleted automatically 90 days after the leave they belong to ended, whatever the request's status; the time-off record itself is kept for the Organization's history and still shows that a sick note was attached. Questions asked in Ask, with their answers and any rating or note, are deleted automatically 90 days after they were asked. Signup records and records of terms acceptance are retained as an audit trail, and Dashboard activity records are retained for as long as the Organization's account exists so that it has a reliable history of administrative actions. When data is no longer needed, we delete or anonymize it.

11. Security#

We use reasonable technical and organizational measures to protect personal data, including encryption of data in transit, hashed storage of PINs and passwords, role-based access controls, and tenant isolation enforced in our database. Sick-note photos are kept in private storage that no App or Dashboard user can browse; an owner or administrator views one through a link that expires after one hour. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your rights#

Subject to applicable law, including the Thailand Personal Data Protection Act (PDPA) or the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you have the right to access, correct, update, or request deletion of your personal data; to object to or restrict certain processing; to withdraw consent where processing is based on consent; and to request a copy of your data. Some data is controlled by your Organization, and we may direct such requests to them. To exercise your rights, contact us at privacy@tasknex.ai. You also have the right to lodge a complaint with the relevant data protection authority (in Thailand, the Office of the Personal Data Protection Committee; in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD)).

13. Data deletion and account removal#

You can request deletion of your personal data — including your name, mobile phone number, location records, attendance and field-activity records, and photos — at any time.

To request deletion, email us at privacy@tasknex.ai from, or quoting, the mobile number associated with your account; or ask your Organization's administrator to remove your account. Because your account is created and managed by your Organization, we may coordinate deletion requests with them.

If you are a Dashboard account holder, email us from the work email address associated with your account, or ask an owner of your Organization to remove your account. Where you are the sole owner of an Organization, closing your account means closing the Organization's workspace, and we will confirm this with you first.

When we receive a verified deletion request, we delete your personal data from our active systems within 30 days. We may retain limited records where required to meet legal, accounting, tax, or employment obligations; such records are deleted once those obligations end.

14. Children#

The Service is intended for use by working field staff and by the businesses that engage them, and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18 (or the applicable age of majority).

15. Changes to this policy#

We may update this Privacy Policy from time to time. We will revise the "Effective date" above and, where changes are material, take reasonable steps to notify affected users or Organizations.

This Privacy Policy is drafted in English. Translations are provided for convenience only; in case of any inconsistency, the English version prevails.

16. Contact us#