Privacy Policy
Effective date: 20 October 2026 Last updated: 20 October 2026
This Privacy Policy explains how Vyxos s.r.o. ("Vyxos", "we", "us") collects and uses personal data when you use Taskwich (the "Service"), our project-management application on the web and in the Taskwich app for Android.
In the Android app you can open this policy at any time from Account → Privacy policy; it is also linked from the sign-up screen and from the notice shown before you first use voice input.
1. Who we are
Vyxos s.r.o. is the data controller for the personal data described in this policy.
- Company: Vyxos s.r.o., a company incorporated in the Slovak Republic
- Registered address: Vysokoškolákov 8556/33B, 010 08 Žilina, Slovenská republika
- Company ID (IČO): 56 908 318
- Tax ID (DIČ): 2122513888 · VAT ID (IČ DPH): SK2122513888 (registered under §7a of the Slovak VAT Act; not a VAT payer — nie je platiteľom DPH)
- Commercial register: Okresný súd Žilina, oddiel: Sro, vložka č. 87677/L
- Managing director (konateľ): Marek Fodor
- Contact for privacy matters: [email protected]
We have assessed that we are not required to appoint a Data Protection Officer; you can reach us about any privacy question at the contact above.
2. Two roles: controller and processor
- For your account, billing, and our communications with you, Vyxos is the controller — this policy governs that data.
- For the content you put inside Taskwich (projects, tasks, comments, documents, and any personal data about third parties you choose to include), where you use Taskwich on behalf of an organisation, your organisation is the controller and Vyxos acts as a processor on its instructions under a Data Processing Agreement. If your data was entered by an organisation using Taskwich, please direct privacy requests to that organisation.
3. What data we collect
We do not use third-party analytics or advertising trackers, and we do not sell personal data. We do count visits to our public website using analytics we host ourselves (Umami) — only if you agree to it, never inside the signed-in app, and never shared with anyone. See Cookies.
The Android app contains no analytics, advertising or crash-reporting code. Besides our own servers, it connects to Google Firebase Cloud Messaging to receive push notifications, to OpenAI while you use Talk (Section 5), to Google when you choose "Continue with Google", and to other websites only when content in your workspace shows an image hosted there. It asks for microphone access only when you first use voice input, and asks once for permission to show notifications. It keeps your sign-in session on the phone in encrypted form and excludes it from Android backups. You can turn push notifications off in Account → Notifications or in your phone's settings.
When you create an account we also record how you found us — the campaign tags in the link you arrived through, or the site that linked to you. This is read from the web address itself; nothing is stored on or read from your device, so it does not depend on the analytics choice above.
4. Why we use it, and our legal basis
5. AI features (Mind Dump)
Taskwich includes an optional, plan-gated Mind Dump feature that uses AI to turn a free-text note — typed or dictated — into suggested tasks.
- What it does: when you invoke Mind Dump, your free-text note, together with the name and the start of the description (up to 500 characters) of each workspace project you can see, is sent to OpenAI to generate task suggestions.
- Provider and transfer: processing is performed by OpenAI, L.L.C. (USA): task suggestions use the
gpt-5.4-nanomodel via the OpenAI API, and Talk uses OpenAI's Realtime API for transcription. This is a transfer of your note content and, when you use Talk, your voice to the United States (see Section 9). - Voice input (Talk): on the web and in the Android app you can dictate instead of typing. When you choose Talk — or press and hold ＋ in the Android app — your microphone audio is streamed over an encrypted connection directly from your browser or phone to OpenAI, which transcribes it live into your note. Our servers open and close the session but never receive the audio, and we store neither the recording nor the transcript; the text stays in your note until you process or discard it. Along with the audio, OpenAI receives your device's IP address, up to three language hints and a one-way hash of your account ID, which OpenAI uses to detect abuse without learning who you are. A session ends when you stop it, and at the latest after 5 minutes or when your plan's voice minutes run out. We keep a record of each session (start, end and length) to count your voice minutes. When you dictate by holding ＋, the transcript is sent for task suggestions as soon as you finish; you still review every suggestion. Before you first use Talk in the Android app, we tell you that your voice is sent to a third party, and nothing starts unless you agree.
- Dictation on your device: the Local button on the web and the On device button in the Android app use the speech recognition built into your browser or phone instead. No audio is sent to us or to OpenAI. In the Android app, the speech-recognition service installed on your phone handles the audio under the terms of whoever provides it. That service may process the audio online, which the app notes under the On device button.
- You stay in control: the AI only suggests — you review and edit every suggestion before any task is created. There is no solely automated decision that produces legal or similarly significant effects on you, so GDPR Art. 22 does not apply.
- Not used for training: under our data processing agreement with OpenAI, your content is not used to train OpenAI's models, and OpenAI retains the data for at most 30 days before deletion. That agreement incorporates the EU Standard Contractual Clauses and OpenAI's EU-US Data Privacy Framework certification.
- Please don't enter sensitive data: because the note is free text, avoid typing or saying special-category data (for example, health information); we do not ask for or need it, and we show an in-product reminder.
- AI transparency: in line with Article 50 of the EU AI Act, we tell you in-product when you are interacting with an AI feature.
The lawful basis for this processing, including Talk, is our legitimate interest in providing a feature you choose to invoke (Art. 6(1)(f)), or performance of our contract with you where it forms part of your plan (Art. 6(1)(b)).
6. Cookies
Taskwich uses only strictly-necessary cookies — for sign-in, session management, and security (e.g. CSRF protection). These are exempt from consent because the Service cannot function without them. We use no marketing or advertising cookies.
On our public website we ask once, through a consent dialog, whether we may count your visit in our own statistics. They run on Umami, self-hosted on our own infrastructure, so no analytics vendor receives your data. Umami is cookieless, loads only if you say yes and never runs inside the signed-in app, and you can change your mind from the footer at any time. We treat the Global Privacy Control and Do Not Track browser signals as a refusal and do not ask at all. See our Cookie Policy for the full detail.
7. Support access ("login as user")
To resolve support issues, authorised Vyxos staff may access your account. This access is read-only, every session is logged (who accessed, when, start and end), and we retain those records as part of our security logs. We do this only where necessary to provide support or maintain security; we do not use it to read your content for any other purpose.
8. Who we share data with
We share personal data only with the following providers:
When you pay for Taskwich, Stripe acts as the merchant of record — it is the seller of record for the transaction and an independent controller of your payment data; its own privacy terms apply to that processing. We do not receive or store your card details.
"Continue with Google" is optional. If you choose it, Google LLC authenticates you and returns your email and basic profile to us; in doing so Google acts as an independent controller / identity provider, not our sub-processor. Google's own privacy terms apply to its processing of that sign-in.
Each sub-processor is engaged under that provider's standard Article 28 data-processing terms, which incorporate the European Commission's Standard Contractual Clauses where the provider is established outside the EEA.
We may also disclose data where required by law. Our sub-processors are Hetzner, Scaleway, Brevo, Cloudflare, Sentry, OpenAI, Google Workspace, and Google Firebase Cloud Messaging; Stripe and Google (for "Continue with Google") act as independent controllers rather than sub-processors. We will update this policy before adding or changing a sub-processor.
9. International transfers
Where a recipient is outside the EEA — our sub-processors Cloudflare (US-based provider), Sentry (EU data region, but provider US-based), OpenAI (USA, for the Mind Dump AI feature, including Talk), Google Workspace (USA, staff mailbox) and Google Firebase Cloud Messaging (Google LLC, USA, push notifications); Stripe as merchant of record / independent controller (USA/EU) — the transfer is protected by the European Commission's Standard Contractual Clauses together with supplementary measures as appropriate. For OpenAI and Google Firebase Cloud Messaging we additionally rely on the provider's EU-US Data Privacy Framework certification. Google sign-in works differently: if you choose "Continue with Google" you authenticate directly with Google LLC (USA) under Google's own terms and privacy policy, and Google returns your email and basic profile to us — Google decides its own purposes as an independent controller, so that relationship is governed by your agreement with Google rather than by our sub-processor safeguards. You can avoid it entirely by signing in with a password, a passkey or an emailed code. Our email sub-processors (Scaleway, Brevo), file storage (Scaleway) and hosting (Hetzner) process within the EU/EEA. You may request a copy of the safeguards via the contact in Section 1.
10. How long we keep data
When you ask us to erase your data, we will do so — but we may retain limited security/audit records for up to 365 days where necessary to comply with a legal obligation or to establish, exercise, or defend legal claims (GDPR Art. 17(3)(b)/(e)).
11. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. Where you have given consent — for example to our visitor statistics — you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
Two of these rights are built into the product, so you do not have to wait for us:
- Access and portability (Art. 15 / Art. 20) — request a data export from your account settings (in the Android app: Account → Your data). We build the archive and give you a private download link.
- Erasure (Art. 17) — request account deletion from your account settings on the web or from Account → Your data in the Android app. Deletion runs after a 30-day grace period, and you can cancel the request at any point during it. Our account deletion page explains the steps, what is deleted and what is kept, and how to ask us if you cannot sign in.
For anything else, contact us at [email protected]. We respond within one month (extendable by up to two further months for complex requests, with notice). We may ask you to verify your identity first. We log every request we receive in an internal data-subject-request register.
You also have the right to lodge a complaint with the Slovak supervisory authority:
Úrad na ochranu osobných údajov Slovenskej republiky (ÚOOÚ) — Námestie 1. mája 18, 811 06 Bratislava — dataprotection.gov.sk
12. Security
We protect personal data with appropriate technical and organisational measures, including access control and role-based permissions, two-factor authentication for staff, encryption in transit, audit logging of administrative actions, and regular backups.
13. Children
Taskwich is not directed to children. You must be at least 16 years old to use the Service (the age of digital consent in Slovakia).
14. Changes to this policy
We may update this policy from time to time. We will post the updated version here and update the "Last updated" date; significant changes will be communicated to account holders.
15. Contact
Questions about this policy or your data: [email protected].