Privacy Policy

1. Who we are

TaskPilot is operated by Michael Twagirayezu (sole proprietor), Toronto, Ontario, Canada, the data controller for the personal data described here. For any privacy question or to exercise your rights, contact byosekumbuga@gmail.com.

2. Data we collect

• Account data: Email address and authentication identifiers (required to log in and receive your purchase).
• Purchase data: Email, Stripe IDs, product purchased, amount paid, status, and purchase date. We never see or store card numbers.
• AI generator & assistant inputs: The task descriptions you enter in the script generator and the messages you send to the in-app assistant. These are processed by our AI provider (Anthropic) to produce a response.
• Feedback & usage data: When you rate a generated script we store the chosen OS, environment, language, rating, any comment, and a one-way hashed IP address (we do not store your raw IP).
• Newsletter: Email address, subscription date, confirmation status.
• Contact requests: Name, email, company (optional), message, budget range (optional).
• Analytics: Aggregate page views via Vercel Analytics (cookie-free, no personal identifiers).

We do not intentionally collect special-category data. Please do not enter sensitive personal data, secrets, or credentials into the generator, assistant, or free-text fields.

3. Legal basis (GDPR Article 6)

• Contract performance: Operating TaskPilot, processing your purchase, and delivering your download.
• Legitimate interests: Security monitoring, fraud and abuse prevention, and improving the product.
• Consent: Newsletter subscription (you can withdraw at any time).
• Legal obligation: Retaining transaction records for 7 years (Canadian tax law).

4. Sharing & subprocessors

We share data only with service providers that process it on our instructions. We do not sell personal data.

• Supabase (Supabase Inc.): database, authentication, and storage. Privacy policy
• Stripe (Stripe, Inc.): payment processing. Card data is handled solely by Stripe. Privacy policy
• Anthropic (Anthropic, PBC): AI inference for the script generator and assistant. Your prompts are sent to Anthropic to generate a response. Privacy policy
• Resend (Resend, Inc.): transactional email. Privacy policy
• Vercel (Vercel, Inc.): hosting and cookie-free analytics. Privacy policy

5. International transfers

Our providers process data in the United States (our database is hosted in AWS us-west-2, Oregon). Where required, these transfers rely on appropriate safeguards such as Standard Contractual Clauses offered by each provider.

6. Data retention

• Purchase records: 7 years (personal fields removed on account deletion; transaction amounts retained for tax compliance).
• Account / profile: Until you delete your account; then purged, with backups expiring within 30 days.
• Feedback & usage data: 24 months, then deleted.
• Operational logs: 90 days.
• Newsletter: Until you unsubscribe.
• Contact requests: 2 years.

7. Cookies

We use one functional cookie set by Supabase to maintain your login session. Vercel Analytics is cookie-free. We do not use advertising or third-party tracking cookies.

8. Your rights

Depending on your location (GDPR/UK GDPR, PIPEDA, and others) you may have the right to:

• Access & portability (GDPR Articles 15, 20): download a copy of your data from Dashboard > Account > Export your data.
• Erasure (Article 17): delete your account from Dashboard > Account > Delete account.
• Withdraw consent: unsubscribe from any email using the link in the footer.
• Rectification & objection: contact us at byosekumbuga@gmail.com.

We respond within the legally required time (GDPR: 1 month). You may also lodge a complaint with your supervisory authority — in Canada, the Office of the Privacy Commissioner of Canada.

9. Security

We protect your data with encryption in transit and at rest, row-level access controls, least privilege, and continuous monitoring. No method is 100% secure, but we work to enterprise-grade standards.

10. Children

TaskPilot is a tool for IT professionals and is not directed to children under 16. We do not knowingly collect their personal data.

11. Changes

We may update this policy; material changes will be reflected by the “last updated” date above and, where appropriate, notified by email.

12. Contact

For any privacy-related question or request: byosekumbuga@gmail.com