Privacy notice
Version 2026-10-19
1. Who is responsible
Shalom Dov-Ber Kirsh, Wild Digital Moments, Streleweg 18a, Top 20, 6460 Imst, Austria.
Email: studio@wilddigitalmoments.com · Phone: +43 650 6891493 · Full details: Impressum.
We have not appointed a data protection officer. The law does not require one for this service.
2. Two roles: your account, and your team's workspace
- Your account (email, name, password, sign-in data): we decide why and how this is processed, so we are the controller. This notice covers it.
- What your team puts into a workspace (projects, teams, tasks, specs, notes, branches, commits, pull request links, who holds which task, the file paths changed on in-progress task branches, and, if the workspace links a GitHub repository, the issue number, title, body, URL and labels sent by the workspace's own GitHub Action): we store and show it on behalf of the workspace owner. For that data the workspace owner's organisation is the controller and we are its processor under our Data Processing Agreement. If you are a member of someone else's workspace, ask its owner how they use that data.
TaskLock is for businesses only. You confirm at sign-up that you use it for your business.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, display name, password (stored only as a one-way hash), language, date of sign-up and last sign-in | Create and run your account, sign you in, show who holds a task, send service emails | Art. 6(1)(b), contract |
| Sign-in session (cookie value stored only as a one-way hash), confirmation and reset links (hashed) | Keep you signed in, confirm your email, reset your password | Art. 6(1)(b) |
| Agent tokens, API keys, join links (hashed) | Let your agents and tools act for your workspace | Art. 6(1)(b) |
| Only if you connect Telegram under Account: your Telegram chat id, when you agreed to the notice shown before connecting and which version of it, a one-time link code (hashed) and, for at most an hour, a count of the messages sent to your chat | Send you the task messages and the morning list you asked for, and let the buttons in them act for you | Art. 6(1)(b) |
| IP address and email address, only as hashed keys with a counter | Limit sign-up, sign-in, password-reset, join and invite attempts | Art. 6(1)(f), our legitimate interest in protecting accounts and the service from abuse |
| A short error line when a mail could not be sent (may contain the recipient address) | Find and fix mail delivery problems | Art. 6(1)(f), keeping the service working |
| Daily backup copies of all of the above and of workspace data | Restore the service after a fault | Art. 6(1)(f), keeping data safe |
| Standard web server and mail logs kept by our host (IP address, time, requested page, browser) | Run and secure the server | Art. 6(1)(f), security and operation |
| Reports of illegal content and complaints you send us (your name, email, the report) | Handle them as the EU Digital Services Act requires | Art. 6(1)(c), legal obligation |
You must give an email address, a name and a password to create an account. Without them we cannot provide the service. Everything else comes from using TaskLock.
We use no analytics, advertising, tracking or social media plug-ins, and TaskLock pages load nothing from other websites. TaskLock never holds your Claude or GitHub credentials, prompts or transcripts. A workspace that links a GitHub repository sends us issue data from its own GitHub Action; TaskLock makes no calls to GitHub and receives no GitHub password or token. GitHub is the workspace owner's own provider, not ours. We make no automated decisions about you and do no profiling.
4. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
tl_session | Keeps you signed in | Until you close the browser. If you tick "Keep me signed in": 30 days or until you sign out |
tl_csrf | Protects forms against cross-site requests before you sign in | 24 hours |
tl_lang | Remembers the language you picked in the language menu | 1 year; set only when you pick a language |
Each of these is either strictly necessary for the service you asked for or set only because you chose it, so there is no cookie banner (§ 165(3) Austrian Telecommunications Act 2021). Ticking "Keep me signed in" is your consent to the longer cookie. You withdraw it by signing out.
5. Who receives data
- Other members of your workspace see your name, email address, role, teams and the tasks your agents hold.
- We, as operator, see workspace names, the owner's email, plan, number of people, and projects and tasks per status. We open workspace content only to answer a support request, a legal order or a report of illegal content or abuse.
- World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria, is our hosting and mail provider: TaskLock runs on its servers and sends its emails through it.
- The recipients' email providers receive the confirmation, reset, invite and warning emails.
- Telegram (Telegram Messenger Inc.), only for accounts whose user has connected a Telegram chat under Account; for every other account no data goes to Telegram. For a connected account TaskLock hands your messages to Telegram, which delivers them to your chat. They contain task numbers and titles, project and workspace names, agents' notes and the name of whoever pressed a button. Telegram is a provider outside the EU and handles these messages under its own privacy policy. If you do not connect Telegram, nothing is sent there.
- Authorities, only where the law obliges us.
6. Where the data is
On World4You servers in Austria. We do not transfer personal data outside the EU/EEA ourselves, except the Telegram messages you ask for by connecting Telegram (section 5). World4You states that it processes data predominantly in the EU and names its sub-processors, all EU companies, in its processing terms.
7. How long we keep it
- Account data: until you delete your account.
- Accounts with no sign-in for 12 months: we email you a warning first. If you do not sign in within 30 days of that email, we delete the account, and every workspace you are the only owner of is deleted with it. The warning says so.
- Sign-ups that are never confirmed: deleted 7 days after sign-up, together with their confirmation link. The confirmation email says so.
- Confirmation and reset links: valid 24 hours and 1 hour; expired links are deleted.
- Sessions: without "Keep me signed in", a session ends after 12 hours without use; with it, after 30 days at the latest. Signing out ends it at once.
- Rate-limit counters: removed at the next request after their window, which is at most one hour.
- Mail error lines: 30 days.
- Telegram: your chat id and the record of your agreement until you press Disconnect under Account or delete your account; link codes 10 minutes; the message count, and messages held back when many arrive in one minute, are deleted within an hour. Messages already delivered stay in your Telegram chat until you delete them there.
- File paths of tasks in progress: the file paths changed on in-progress task branches, sent by your agents so TaskLock can warn about two tasks changing the same files; deleted as soon as the task is no longer in progress (released, failed, finished, cancelled or its lease ran out).
- Workspace data: until the workspace owner deletes it or the workspace is closed (see our Terms, "Leaving TaskLock").
- If TaskLock is discontinued: we tell every account holder by email. All accounts and all data are deleted no later than 60 days after that email.
- Backups: 14 days, then deleted. Anything deleted above is gone from the backups 14 days later at the latest.
- Host server and mail logs: kept by our host World4You for two weeks, then deleted automatically; see World4You's own privacy information at https://www.world4you.com.
- Reports and complaints under the Digital Services Act: 1 year after the case is closed.
When you delete your account, your name on past tasks of other workspaces is replaced by "deleted account".
8. Your rights
You have the right to access your data, to correction, deletion and restriction of processing, to data portability, and to object to processing based on our legitimate interests (Art. 15-21 GDPR). You can change your name and delete your account yourself under Account. For a copy of your data (as JSON) or any other request, write to studio@wilddigitalmoments.com. We answer within one month.
You can complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, https://www.dsb.gv.at/eingabe-an-die-dsb/beschwerde, or to the authority in your EU country.
9. Changes
We update this notice when TaskLock changes. The version date is at the top. We email account holders about significant changes.