Privacy Policy

We are the controller (we decide how it's used) for information we use for our own purposes:

• the accounts of people who sign in (business owners and managers);
• our records of each business's plan and billing;
• help requests and feedback you send us;
• usage numbers (for example how many staff and jobs a business has);
• security and technical records, such as IP addresses, sign-in details and error reports, used to keep BusyTasks secure and working.

The business is the controller, and we are its processor, for what's on its board: staff names or nicknames, jobs and who they're for, who ticked what and when, notices, readings, questions and answers, and anything else the business or its staff enter. We only use that to run BusyTasks for the business (see "Data processing" in our Terms). The business is responsible for telling its staff about this.

• Accounts: name, email address, password (securely hashed, never stored in plain text), and when you agreed to our terms.
• Businesses: business name, type, opening hours, settings, logo and brand colour.
• Staff on the board: the name or nickname you give them, a colour, and a 4-digit PIN (stored hashed, so nobody, including us, can read it).
• What happens on the board: jobs, who ticked what and when, notices and who read them, questions and answers, and anything else people type in.
• Our records about your account: your plan (trial or paid), trial and billing dates, price and payments, when the business signed up and was last used, and usage numbers such as how many staff, screens and jobs it has. These are numbers, not what the jobs say.
• Technical: basic logs needed to keep the service running and secure, such as times, errors and IP addresses. For each sign-in we keep the IP address and the type of device and browser used. When something fails, we record what went wrong, on which page and for which account, so we can fix it.
• Feedback: anything you send us through Help → Send feedback, with your account and business so we can reply and improve BusyTasks.

Staff names or nicknames, and who did which job and when, are what BusyTasks is for. Businesses should only enter the personal information reasonably needed to use it. Please don't put confidential or sensitive information into BusyTasks, such as health details, passwords, payment or bank details, ID documents, or customers' personal information. It isn't designed for it. If any does end up here, it's still protected by data protection law.

• To provide BusyTasks to the people who use it. Where you've signed up personally (for example as a sole trader), this is to perform our contract with you. Where you use it for a company or for someone else's business, it's our legitimate interest in running that business's account and the people it has allowed to use it.
• To keep it secure, prevent misuse and fix problems, using sign-in records, logs and error reports. Our legitimate interest is a safe, working service for everyone who uses it.
• To improve it and understand how it's used (for example how many businesses sign up and go on to pay), using usage numbers and feedback. Our legitimate interest is building a reliable product people want.
• To run our business: billing and support, using our records about your account. This is our contract with you, or our legitimate interest in managing our customers' accounts.
• To send emails you need, such as sign-in codes, invites and alerts. This is our contract with you, or our legitimate interest in letting the people a business invites sign in and use BusyTasks.
• To meet legal obligations, such as keeping tax and billing records and answering lawful requests from authorities.

Where we rely on legitimate interests, we've checked that they aren't outweighed by your rights, and you can object (see section 9). We don't sell information, and we don't use it for advertising.

Only the service providers we need to run BusyTasks:

• Hosting and storage: Railway (servers, database, file storage and backups). Railway is a US company. BusyTasks's servers and database run in the United States. Uploaded files, such as logos, and our backups are stored in the European Union (the Netherlands).
• Email: Resend, which sends our emails, such as sign-in codes, invites and alerts. Resend is based in the United States.

This means information is transferred outside the UK, to the United States and the European Union. UK law recognises the EU as giving adequate protection. For the United States, we rely on the UK Extension to the EU-US Data Privacy Framework, which UK law also recognises, where the provider is certified under it (Railway is). Otherwise we rely on the contract clauses approved for UK transfers (the International Data Transfer Addendum to the EU Standard Contractual Clauses). If we add or change a provider (for example for payments), we'll update this list first.

We may also share information if the law requires it.

We only use cookies and similar browser storage that are needed for BusyTasks to work or to remember a choice you've made:

• cookies that keep you signed in;
• a cookie that remembers which business you're working in;
• settings saved in your browser: light or dark mode, the board or tab you last used, and, on a board screen, ticks made while the internet was down, so they can be sent when it's back.

We don't use advertising, analytics or tracking cookies, so there's nothing to accept or decline.

We keep information while the business's account is open. Active service data is deleted within 30 days after the account is closed. Backup copies may remain for up to a further 14 days before being automatically deleted. Billing and tax records (once paid plans start) are kept for as long as the law requires, usually six years.

Connections are encrypted, passwords and PINs are stored hashed, every business's information is kept separate, and access to our systems is restricted. No system is perfectly secure, which is one more reason not to store anything confidential in BusyTasks.

BusyTasks is in beta, so please keep your own records of anything important. Report problems to hello@busytasks.com.

• Only a small number of authorised people who run BusyTasks.
• Day to day, they can see account details (business name, owner and manager names and email addresses) and our records about your account (plan, dates and usage numbers). They do not routinely see your jobs, staff names, notices, questions or anything else entered on your board.
• We only look at what's on your board when you ask us to help (and agree to us looking), to fix a problem that can't be fixed any other way, to investigate a security problem or misuse, or when the law requires it. We look at no more than we need to.
• Everyone with access must keep what they see confidential.

You can ask to see, correct, delete or get a copy of your information, ask us to limit how we use it, or object to how we use it. Email hello@busytasks.com. If you're a staff member on a business's board, please ask that business first, as it controls that information; we'll help it answer you.

Complaints. If you're unhappy with how we've handled your information, you can complain to us by emailing hello@busytasks.com. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You can also complain to the UK's data protection regulator, the Information Commission (ico.org.uk), at any time.

We may update this policy. The date at the top shows the latest version, and we'll tell you in the app or by email about important changes, including if the company responsible for your information changes. See also our Terms of Service.