Privacy Policy

Last Updated: November 9, 2025 Version: 1.0 Effective Date: November 9, 2025

Related Documents: This Privacy Policy should be read together with our Terms of Service, which govern your use of TaskForce services. This Privacy Policy is incorporated into the Terms of Service by reference.

Table of Contents

  1. Who We Are
    • 1.1 Contracting Entity
    • 1.2 Data Protection Officer
    • 1.3 EU Representative
  2. Information We Collect
    • 2.1 Account Information
    • 2.2 Business Information
    • 2.3 Payment Information
    • 2.4 Usage Data
    • 2.5 Technical Data
    • 2.6 Communications
    • 2.7 Customer Business Data
    • 2.8 Data We Do Not Collect
  3. How We Use Your Information
    • 3.1 Legal Basis for Processing (GDPR)
    • 3.2 Service Provision
    • 3.3 Business Operations
    • 3.4 Legal and Compliance
  4. Data Controller vs. Data Processor
    • 4.1 When We Are a Data Controller
    • 4.2 When We Are a Data Processor
    • 4.3 Your Responsibilities as Data Controller
  5. How We Share Your Information
    • 5.1 Third-Party Subprocessors
    • 5.2 Customer-Requested Integrations
    • 5.3 Legal Requirements
    • 5.4 Business Transfers
    • 5.5 With Your Consent
  6. International Data Transfers
    • 6.1 EU-Based Processing
    • 6.2 Standard Contractual Clauses
    • 6.3 Customer-Requested Transfers
    • 6.4 Transfer Mechanisms
  7. Data Security
    • 7.1 Security Measures
    • 7.2 Credential Security
    • 7.3 Security Incidents
    • 7.4 Your Security Responsibilities
  8. Data Retention
    • 8.1 Retention Periods
    • 8.2 Deletion Upon Termination
    • 8.3 Legal Retention Requirements
  9. Your Data Protection Rights
    • 9.1 Rights Under GDPR (EU/EEA/Swiss Clients)
    • 9.2 Rights Under Other Laws
    • 9.3 How to Exercise Your Rights
    • 9.4 Response Times
    • 9.5 Verification Requirements
  10. Cookies and Tracking Technologies
    • 10.1 Types of Cookies We Use
    • 10.2 Analytics and Performance
    • 10.3 Cookie Choices
  11. Third-Party Services and Links
  12. Children's Privacy
  13. Changes to This Privacy Policy
  14. Complaints and Supervisory Authorities
    • 14.1 For EU/EEA/Swiss Clients
    • 14.2 For US Clients
  15. Contact Information

1. Who We Are

1.1 Contracting Entity

Your privacy relationship depends on which TaskForce entity you contract with, as determined by your billing address:

(a) For Clients Located in the United States:

Zero to MVP, Inc.

(b) For Clients Located in the European Union, European Economic Area, or Switzerland:

Zero to MVP Private Company (Zero to MVP PC)

(c) For Clients Located in All Other Jurisdictions:

By default, you contract with Zero to MVP, Inc. (US entity), though all data processing occurs in the EU.

"TaskForce" Brand: When this Privacy Policy refers to "TaskForce," "we," "us," or "our," it refers to the specific legal entity with which you are contracting.

1.2 Data Protection Officer

For Zero to MVP PC (EU Entity): Zero to MVP PC has determined that it is not required to appoint a Data Protection Officer under GDPR Article 37, as:

We act primarily as a data processor for customer business data, not as a data controller conducting large-scale behavioral monitoring or profiling.

For data protection inquiries, contact: legal@taskforce.tech

For Zero to MVP, Inc. (US Entity): We have designated an internal data protection contact. For data protection inquiries, contact: legal@taskforce.tech

1.3 EU Representative

For Zero to MVP, Inc. (US Entity): As we process data in the EU but are headquartered in the United States, we have designated Zero to MVP PC as our EU representative under GDPR Article 27 for matters related to EU data subject rights and supervisory authority inquiries.

2. Information We Collect

2.1 Account Information

When you create a TaskForce account, we collect:

2.2 Business Information

As a B2B-only service, we collect business information including:

B2B Verification: We verify that you are a legitimate business entity and not a consumer. This verification protects both parties by ensuring the service is used for its intended purpose.

2.3 Payment Information

Payment processing is handled by Stripe, Inc. We do not store your complete payment card information. We collect:

Stripe Processing: Stripe collects and processes your full payment card details. See Stripe's Privacy Policy at https://stripe.com/privacy for details on how Stripe handles payment information.

2.4 Usage Data

We collect information about how you use our Services:

2.5 Technical Data

We automatically collect certain technical information:

2.6 Communications

We collect information from your communications with us:

2.7 Customer Business Data

When providing automation services, we process data on your behalf:

Important: For this data, you are the data controller and we are your data processor. See Section 4 for details.

2.8 Data We Do Not Collect

We do not knowingly collect or process:

3. How We Use Your Information

3.1 Legal Basis for Processing (GDPR)

For EU/EEA/Swiss clients, we process personal data under the following legal bases:

(a) Contractual Necessity (GDPR Article 6(1)(b)): Processing necessary to perform our contract with you, including:

(b) Legitimate Interests (GDPR Article 6(1)(f)): Processing necessary for our legitimate business interests, including:

(c) Legal Obligation (GDPR Article 6(1)(c)): Processing necessary to comply with legal obligations, including:

(d) Consent (GDPR Article 6(1)(a)): Where required by law or where we have obtained your explicit consent, including:

3.2 Service Provision

We use your information to provide TaskForce services:

3.3 Business Operations

We use your information for business purposes:

3.4 Legal and Compliance

We may use your information to:

4. Data Controller vs. Data Processor

Understanding the distinction between data controller and data processor is critical for GDPR compliance.

4.1 When We Are a Data Controller

TaskForce acts as a data controller for:

As a data controller, we determine the purposes and means of processing this data. We are responsible for ensuring compliance with data protection laws for this data.

4.2 When We Are a Data Processor

TaskForce acts as a data processor (you are the data controller) for:

As a data processor, we process this data solely on your instructions as the data controller. You determine the purposes and means of processing; we simply execute your instructions through the automation workflows.

4.3 Your Responsibilities as Data Controller

When we act as your data processor, you are responsible for:

Detailed Data Processing Terms: For complete data processing terms that satisfy GDPR Article 28 requirements, see Section 8.6 (Data Processing Agreement) of our Terms of Service.

5. How We Share Your Information

We do not sell your personal data or business data to third parties. We share information only as described below:

5.1 Third-Party Subprocessors

We use carefully selected subprocessors to help provide our Services:

(a) Infrastructure and Hosting:

Hetzner Online GmbH (Germany)

(b) Error Monitoring and Performance:

Sentry (Functional Software, Inc.) - United States

PostHog Inc. - European Union

(c) Payment Processing:

Stripe, Inc. - Ireland/United States

(d) Advertising and Marketing:

Google LLC - United States/Ireland

(e) Communication and Support:

We may use email service providers and customer support platforms to communicate with you and manage support requests.

5.2 Customer-Requested Integrations

Critical Understanding: When you request us to integrate third-party services into your automation workflows, those services become subprocessors because they receive and process your data.

Examples of Customer-Requested Subprocessors:

Your Responsibilities for Customer-Requested Integrations:

Subprocessor Changes: We will notify you at least 30 days in advance of adding or replacing infrastructure subprocessors (Section 5.1), giving you the opportunity to object. If you object, we will work with you to find an acceptable alternative solution or allow you to terminate the Services without penalty. Customer-requested integrations (Section 5.2) are added at your request and with your acknowledgment.

5.3 Legal Requirements

We may disclose your information if required by law or in response to:

Notice: Where legally permitted, we will notify you before disclosing your information to authorities, unless prohibited by law or court order.

5.4 Business Transfers

If TaskForce is involved in a merger, acquisition, sale of assets, bankruptcy, or other business transaction, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website of any change in ownership or use of your information, and any choices you may have regarding your information.

5.5 With Your Consent

We may share your information for other purposes with your explicit consent, such as:

You may withdraw consent at any time by contacting us at hello@taskforce.tech.

6. International Data Transfers

6.1 EU-Based Processing

All TaskForce Services are delivered from the European Union, regardless of which entity you contract with:

6.2 Standard Contractual Clauses and Transfer Safeguards

For subprocessors located outside the EU/EEA, we use Standard Contractual Clauses (SCCs) or other appropriate safeguards approved by the European Commission, including:

We execute Data Processing Agreements with all infrastructure subprocessors to ensure GDPR compliance and appropriate data protection safeguards.

SCCs: Standard Contractual Clauses are contractual commitments between data exporters and importers that provide adequate safeguards for personal data transferred outside the EU/EEA, as approved by the European Commission.

6.3 Customer-Requested Transfers

When you request integration with services located outside the EU/EEA:

Examples:

6.4 Transfer Mechanisms

For international data transfers, we rely on:

7. Data Security

7.1 Security Measures

We implement industry-standard security measures to protect your information:

(a) Technical Security:

(b) Organizational Security:

(c) Infrastructure Security:

(d) Application Security:

7.2 Credential Security

For API keys and third-party credentials you provide:

Your Responsibilities:

7.3 Security Incidents

Incident Response Process:

(a) Detection and Assessment: We continuously monitor for security incidents and assess severity immediately upon detection.

(b) Containment: We take immediate steps to contain incidents and prevent further unauthorized access.

(c) Notification:

(d) Information Provided:

(e) Remediation: We take all reasonable steps to remediate the incident and prevent recurrence.

Your Obligations: Upon notification of a security incident affecting credentials, you agree to immediately rotate/revoke affected credentials.

7.4 Your Security Responsibilities

You are responsible for:

8. Data Retention

8.1 Retention Periods

We retain personal data only as long as necessary for the purposes described in this Privacy Policy:

(a) Account and Business Information:

(b) Payment and Billing Records:

(c) Customer Business Data (Where We Are Data Processor):

(d) Communications and Support Records:

(e) Usage and Technical Data:

8.2 Deletion Upon Termination

Upon subscription termination:

(a) 30-Day Retrieval Period:

(b) Permanent Deletion:

(c) Exceptions:

8.3 Legal Retention Requirements

We may retain certain data longer than stated above if required by:

Data Minimization: We apply data minimization principles, retaining only what is necessary for the specific legal purpose.

9. Your Data Protection Rights

9.1 Rights Under GDPR (EU/EEA/Swiss Clients)

If you are located in the EU, EEA, or Switzerland, you have the following rights under GDPR:

(a) Right of Access (Article 15):

(b) Right to Rectification (Article 16):

(c) Right to Erasure / "Right to be Forgotten" (Article 17):

Limitations: We may retain data where required by law or for legal claims.

(d) Right to Restriction of Processing (Article 18):

(e) Right to Data Portability (Article 20):

(f) Right to Object (Article 21):

(g) Right Not to Be Subject to Automated Decision-Making (Article 22):

Note: TaskForce does not make automated decisions with legal or similarly significant effects.

(h) Right to Withdraw Consent (Article 7(3)):

(i) Right to Lodge a Complaint:

9.2 Rights Under Other Laws

(a) California Residents (CCPA/CPRA):

If you are a California resident and a business customer, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), subject to B2B exemptions:

Sale vs. Sharing Under CPRA:

Categories of Personal Information Shared for Advertising:

B2B Exemption: Many CCPA/CPRA provisions do not apply to B2B transactions. As TaskForce is a B2B-only service, certain consumer rights may not apply. However, we honor opt-out requests for advertising regardless of B2B status.

(b) Other Jurisdictions:

Depending on your location, you may have rights under other data protection laws. Contact us at legal@taskforce.tech to inquire about your rights.

9.3 How to Exercise Your Rights

To exercise any of your data protection rights:

(a) Email Request: Send an email to legal@taskforce.tech with:

(b) Account Portal: For certain rights (access, rectification), you may be able to manage your data directly through your account dashboard.

(c) Written Request: Send a written request to our registered office address (see Section 15).

9.4 Response Times

We will respond to your request:

9.5 Verification Requirements

To protect your privacy and security, we must verify your identity before processing data protection requests:

Fraudulent Requests: We reserve the right to refuse requests that are manifestly unfounded, excessive, or repetitive.

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

Cookies are small text files stored on your device when you visit our website or use our Services.

(a) Strictly Necessary Cookies:

(b) Functional Cookies:

(c) Analytics and Performance Cookies:

(d) Marketing and Advertising Cookies:

Google Ads (Google LLC):

10.2 Analytics and Performance

PostHog Analytics:

Error Monitoring (Sentry):

10.3 Cookie Choices

(a) Browser Settings:

(b) Cookie Consent:

For US Visitors: We use analytics and advertising cookies by default to improve your experience and measure advertising effectiveness. You can opt out at any time by clicking "Your Privacy Choices" in the website footer. When you opt out, we stop using analytics and advertising cookies and only keep essential cookies needed for payment processing and account authentication.

For Non-US Visitors: When you first visit our website, you will see a cookie consent banner with two options:

Essential cookies for payment processing (Stripe) and account authentication are always used as they are required for the service to function.

You can change your preferences at any time by clearing your browser data and revisiting the site.

(c) Do Not Track:

11. Third-Party Services and Links

Our Services may contain links to third-party websites, platforms, or services:

Integrated Platforms: When you request integration with third-party platforms (Slack, CRM systems, etc.):

12. Children's Privacy

TaskForce is a business-to-business service. We do not knowingly collect personal data from children:

If you believe we have inadvertently collected data from a child, contact us immediately at legal@taskforce.tech.

13. Changes to This Privacy Policy

(a) Updates: We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings.

(b) Notice: We will notify you of material changes:

(c) Continued Use: Your continued use of the Services after the effective date of changes constitutes acceptance of the updated Privacy Policy.

(d) Objection: If you do not agree with changes, you may terminate your subscription before the changes take effect.

(e) Version History: Previous versions of this Privacy Policy may be requested by contacting legal@taskforce.tech.

14. Complaints and Supervisory Authorities

14.1 For EU/EEA/Swiss Clients

If you are located in the EU, EEA, or Switzerland and have concerns about our data processing practices, you have the right to lodge a complaint with a supervisory authority.

(a) Supervisory Authority for Zero to MVP PC (Greek Entity):

Hellenic Data Protection Authority (HDPA)

(b) Your Local Supervisory Authority:

You also have the right to lodge a complaint with the supervisory authority in your EU Member State, particularly:

List of EU Supervisory Authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en

(c) We Encourage Direct Contact First:

Before lodging a complaint with a supervisory authority, we encourage you to contact us directly at legal@taskforce.tech. We are committed to working with you to resolve any concerns.

14.2 For US Clients

If you are located in the United States:

(a) Federal Trade Commission (FTC):

You may file a complaint with the FTC regarding our privacy practices:

(b) State Attorneys General:

You may also contact your state Attorney General's office regarding privacy concerns.

(c) California Residents:

California residents may contact the California Attorney General:

15. Contact Information

15.1 General Privacy Inquiries

For general questions about this Privacy Policy or our privacy practices:

Email: hello@taskforce.tech

Response Time: We aim to respond within 2 business days.

15.2 Data Protection Requests

To exercise your data protection rights (access, deletion, correction, etc.):

Email: legal@taskforce.tech

Subject Line: "Data Protection Request - [Right Name]"

Response Time: Within 30 days (or as required by applicable law)

15.3 Data Protection Officer

For Zero to MVP PC (EU Entity):

Zero to MVP PC is not required to appoint a Data Protection Officer under GDPR Article 37. For data protection inquiries, contact:

For Zero to MVP, Inc. (US Entity):

15.4 Registered Office Addresses

(a) Zero to MVP, Inc. (US Entity):

16192 Coastal Highway Lewes, DE 19958 United States

(b) Zero to MVP PC (Greek/EU Entity):

Agion Apostolon Petrou & Pavlou 46 Spata 19004 Greece

15.5 EU Representative

For matters related to GDPR compliance, EU data subject rights, or supervisory authority inquiries regarding Zero to MVP, Inc. (US entity):

EU Representative: Zero to MVP PC

Appendix A: Data Processing Details

A.1 Categories of Data Subjects

When we act as a data processor (for customer business data):

A.2 Categories of Personal Data Processed

A.3 Processing Activities

A.4 Data Retention Schedule Summary

Data TypeRetention PeriodLegal Basis
Account InformationDuration of subscription + 30 daysContract
Payment Records7-10 yearsTax/Legal
Customer Business DataDuration of subscription + 30 daysContract
Support Communications3 yearsLegitimate Interest
Log Data90 daysLegitimate Interest
Anonymized AnalyticsIndefiniteLegitimate Interest

Appendix B: GDPR Compliance Summary

B.1 Legal Bases for Processing

B.2 Data Subject Rights Provided

✅ Right of Access ✅ Right to Rectification ✅ Right to Erasure ✅ Right to Restriction ✅ Right to Data Portability ✅ Right to Object ✅ Right to Withdraw Consent ✅ Right to Lodge a Complaint

B.3 Security Measures

✅ Encryption in transit (TLS 1.2+) ✅ Encryption at rest (AES-256) ✅ Access controls and authentication ✅ Regular security assessments ✅ Employee training and confidentiality agreements ✅ Incident response procedures ✅ Data breach notification (within 72 hours)

B.4 International Transfers

✅ EU-based infrastructure (Hetzner, Germany) ✅ Standard Contractual Clauses for US subprocessors ✅ EU representative designated (Zero to MVP PC)

For questions or concerns about this Privacy Policy, contact us at legal@taskforce.tech.

Privacy Policy - TaskForce