Privacy Policy

Effective date: 1 August 2026 Last updated: 10 August 2026

This Privacy Policy explains how Vyxos s.r.o. ("Vyxos", "we", "us") collects and uses personal data when you use Taskwich (the "Service"), our project-management web application.

1. Who we are

Vyxos s.r.o. is the data controller for the personal data described in this policy.

• Company: Vyxos s.r.o., a company incorporated in the Slovak Republic
• Registered address: Vysokoškolákov 8556/33B, 010 08 Žilina, Slovenská republika
• Company ID (IČO): 56 908 318
• Tax ID (DIČ): 2122513888 · VAT ID (IČ DPH): SK2122513888 (registered under §7a of the Slovak VAT Act; not a VAT payer — nie je platiteľom DPH)
• Commercial register: Okresný súd Žilina, oddiel: Sro, vložka č. 87677/L
• Managing director (konateľ): Marek Fodor
• Contact for privacy matters: [email protected]

We have assessed that we are not required to appoint a Data Protection Officer; you can reach us about any privacy question at the contact above.

2. Two roles: controller and processor

• For your account, billing, and our communications with you, Vyxos is the controller — this policy governs that data.
• For the content you put inside Taskwich (projects, tasks, comments, documents, and any personal data about third parties you choose to include), where you use Taskwich on behalf of an organisation, your organisation is the controller and Vyxos acts as a processor on its instructions under a Data Processing Agreement. If your data was entered by an organisation using Taskwich, please direct privacy requests to that organisation.

3. What data we collect

We do not use third-party analytics or advertising trackers, and we do not sell personal data. We do count visits to our public website using analytics we host ourselves — only if you agree to it, never inside the signed-in app, and never shared with anyone. See Cookies.

When you create an account we also record how you found us — the campaign tags in the link you arrived through, or the site that linked to you. This is read from the web address itself; nothing is stored on or read from your device, so it does not depend on the analytics choice above.

4. Why we use it, and our legal basis

5. AI features (Mind Dump)

Taskwich includes an optional, plan-gated Mind Dump feature that uses AI to turn a free-text note into suggested tasks.

• What it does: when you invoke Mind Dump, the free-text note you write, together with the names of the projects in your workspace, is sent to OpenAI to generate task suggestions.
• Provider and transfer: processing is performed by OpenAI, L.L.C. (USA), using the gpt-5.4-nano model via the OpenAI API. This is a transfer of your note content to the United States (see Section 9).
• You stay in control: the AI only suggests — you review and edit every suggestion before any task is created. There is no solely automated decision that produces legal or similarly significant effects on you, so GDPR Art. 22 does not apply.
• Not used for training: under our data processing agreement with OpenAI, your content is not used to train OpenAI's models, and OpenAI retains the data for at most 30 days before deletion. That agreement incorporates the EU Standard Contractual Clauses and OpenAI's EU-US Data Privacy Framework certification.
• Please don't enter sensitive data: because the note is free text, avoid typing special-category data (for example, health information); we do not ask for or need it, and we show an in-product reminder.
• AI transparency: in line with Article 50 of the EU AI Act, we tell you in-product when you are interacting with an AI feature.

The lawful basis for this processing is our legitimate interest in providing a feature you choose to invoke (Art. 6(1)(f)), or performance of our contract with you where it forms part of your plan (Art. 6(1)(b)).

6. Cookies

Taskwich uses only strictly-necessary cookies — for sign-in, session management, and security (e.g. CSRF protection). These are exempt from consent because the Service cannot function without them. We use no marketing or advertising cookies.

On our public website we ask once whether we may count your visit in our own, self-hosted statistics. It is cookieless, it loads only if you say yes, it never runs inside the signed-in app, and you can change your mind from the footer at any time. We treat the Global Privacy Control and Do Not Track browser signals as a refusal and do not ask at all. See our Cookie Policy for the full detail.

7. Support access ("login as user")

To resolve support issues, authorised Vyxos staff may access your account. This access is read-only, every session is logged (who accessed, when, start and end), and we retain those records as part of our security logs. We do this only where necessary to provide support or maintain security; we do not use it to read your content for any other purpose.

8. Who we share data with

We share personal data only with the following providers:

When you pay for Taskwich, Stripe acts as the merchant of record — it is the seller of record for the transaction and an independent controller of your payment data; its own privacy terms apply to that processing. We do not receive or store your card details.

"Continue with Google" is optional. If you choose it, Google LLC authenticates you and returns your email and basic profile to us; in doing so Google acts as an independent controller / identity provider, not our sub-processor. Google's own privacy terms apply to its processing of that sign-in.

Each sub-processor is engaged under that provider's standard Article 28 data-processing terms, which incorporate the European Commission's Standard Contractual Clauses where the provider is established outside the EEA.

We may also disclose data where required by law. Our sub-processors are Hetzner, Scaleway, Brevo, Cloudflare, Sentry, OpenAI, and Google Workspace; Stripe and Google (for "Continue with Google") act as independent controllers rather than sub-processors. We will update this policy before adding or changing a sub-processor.

9. International transfers

Where a recipient is outside the EEA — our sub-processors Cloudflare (US-based provider), Sentry (EU data region, but provider US-based), OpenAI (USA, for the Mind Dump AI feature) and Google Workspace (USA, staff mailbox); Stripe as merchant of record / independent controller (USA/EU) — the transfer is protected by the European Commission's Standard Contractual Clauses together with supplementary measures as appropriate. For OpenAI we additionally rely on its EU-US Data Privacy Framework certification. Google sign-in works differently: if you choose "Continue with Google" you authenticate directly with Google LLC (USA) under Google's own terms and privacy policy, and Google returns your email and basic profile to us — Google decides its own purposes as an independent controller, so that relationship is governed by your agreement with Google rather than by our sub-processor safeguards. You can avoid it entirely by signing in with a password, a passkey or an emailed code. Our email sub-processors (Scaleway, Brevo) and hosting (Hetzner) process within the EU/EEA. You may request a copy of the safeguards via the contact in Section 1.

10. How long we keep data

When you ask us to erase your data, we will do so — but we may retain limited security/audit records for up to 365 days where necessary to comply with a legal obligation or to establish, exercise, or defend legal claims (GDPR Art. 17(3)(b)/(e)).

11. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. Where you have given consent — for example to our visitor statistics — you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

Two of these rights are built into the product, so you do not have to wait for us:

• Access and portability (Art. 15 / Art. 20) — request a data export from your account settings. We build the archive and give you a private download link.
• Erasure (Art. 17) — request account deletion from your account settings. Deletion runs after a 30-day grace period, and you can cancel the request at any point during it.

For anything else, contact us at [email protected]. We respond within one month (extendable by up to two further months for complex requests, with notice). We may ask you to verify your identity first. We log every request we receive in an internal data-subject-request register.

You also have the right to lodge a complaint with the Slovak supervisory authority:

Úrad na ochranu osobných údajov Slovenskej republiky (ÚOOÚ) — Námestie 1. mája 18, 811 06 Bratislava — dataprotection.gov.sk

12. Security

We protect personal data with appropriate technical and organisational measures, including access control and role-based permissions, two-factor authentication for staff, encryption in transit, audit logging of administrative actions, and regular backups.

13. Children

Taskwich is not directed to children. You must be at least 16 years old to use the Service (the age of digital consent in Slovakia).

14. Changes to this policy

We may update this policy from time to time. We will post the updated version here and update the "Last updated" date; significant changes will be communicated to account holders.

15. Contact

Questions about this policy or your data: [email protected].