Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how RAZHORD TECH S.R.L. (“TaskIt”, “we”, “us” or “our”) collects and uses personal data through the TaskIt mobile platform and related support services (together, the “Platform”).

TaskIt is a marketplace where users can publish tasks, submit and accept offers, communicate about tasks, mark tasks as completed, and review each other. TaskIt does not currently process payments. Users arrange and make payments directly between themselves.

TaskIt provides tools that help users find and communicate with each other. TaskIt is not a party to the service or payment arrangement between users. The in-app acceptance and completion controls are intended for Platform functionality and review eligibility; by themselves, they are not intended to create or enforce a service contract and are not a guarantee that a user will attend, perform a service, or pay the proposed amount. Users are responsible for agreeing their own terms, assessing whether a task or provider is suitable, complying with applicable professional or licensing requirements, and declaring and paying their own taxes and social contributions.

This Policy applies to registered users and people who browse TaskIt using guest access. It covers TaskIt’s own processing of information, including its storage, security, moderation and disclosure of content exchanged by users.

Users decide what they include in task descriptions, profiles, messages, photographs and reviews. Users should not submit personal data about another person unless they are entitled to do so, and should not include unnecessary sensitive information, identity numbers, financial details, access codes or precise addresses in public content. A person may report content concerning them by contacting us at privacy@taskit.ro.

2. Controller and contact details

The controller responsible for the processing described in this Policy is:

RAZHORD TECH S.R.L.
Calea Dorobanților 55, Ap. 20
400117 Cluj-Napoca, Cluj County, Romania
Trade Register number: J2021005494124
Fiscal code (CUI): 45203552

Privacy and data-rights requests: privacy@taskit.ro
General support: contact@taskit.ro

3. Personal data we process

3.1 Account and authentication data

To create an account using email, a user provides an email address, display name and password. The password is processed by our authentication provider and stored as a cryptographic password verifier; TaskIt personnel cannot view the plaintext password.

A user may optionally add a last name and telephone number. The telephone number is retained in the account for account administration and anticipated phone-verification functionality. Phone verification is not currently active. The number is not displayed to other users or used for marketing. A user may remove or change it through their account settings.

If a user signs in with Apple or Google, we receive the account information authorized by the user and supplied by that provider, normally the user’s name, email address and provider account identifier. Apple may supply a private relay email address. Google may make a profile-picture reference available, but we use it as the TaskIt profile photograph only if the user chooses to do so.

We also process account dates and authentication information such as account creation and confirmation times, last sign-in time, sessions, refresh tokens, authentication events, and related IP address or device/browser information where recorded by our authentication provider.

3.2 Profile and activity data

A user may add a profile photograph, biography and skills selected from a predefined list. Profiles can also show reviews received, posted tasks, the user's last-active status, and whether TaskIt has checked an identity document.

We process bookmarks, blocks, notification history and task/account activity needed to provide these features. Bookmarks, blocks and notification history are not displayed to other users. We do not collect search history.

3.3 Tasks, offers and completion records

We process information submitted in task listings, including title, description, category, budget, requested date, photographs and selected locality. We also process offers and proposed amounts, acceptance or withdrawal of an offer, assignment or unassignment, task status, completion confirmations, and the relevant dates and identifiers.

Task localities are selected from a predefined list. Tasks do not contain a structured precise-address field. Users may nevertheless choose to exchange an address or contact details privately in messages.

The accepted offer is a record of what was proposed through TaskIt. Because payment is completed outside TaskIt, it does not necessarily show the amount ultimately paid.

3.4 Messages and photographs

We process messages and photographs exchanged between conversation participants, together with conversation membership, sender, task title, and creation or editing times.

Messages are not end-to-end encrypted. They are transmitted using encrypted connections and stored using our hosting provider’s security controls. On the Platform, they are displayed to conversation participants. They may also be accessed by specifically authorized TaskIt personnel and service providers when reasonably necessary for support, safety, investigating a report, enforcing our rules, security, or compliance with law.

Users can edit a message for 15 minutes after sending it and can delete their own message or its photographs. Deleting a message removes its content from TaskIt, but cannot remove copies or screenshots already made by another user.

Uploaded images are re-encoded, which removes original EXIF metadata such as embedded GPS metadata. Task photographs may have a resized copy used within the Platform; it is deleted with the original.

3.5 Reviews

Following a completed task, the parties may review each other. We process the rating, review text, author, recipient, related task, and relevant dates. Reviews become visible on the Platform when submitted and can be edited by the author for 24 hours. A review can be reported to TaskIt for assessment.

If a review author deletes their account, the review may remain on the recipient’s profile under the label “Former user”. The public author link and profile photograph are removed. The review may still constitute personal data because its text or context could identify a person. It remains subject to applicable data-protection rights and our retention rules.

Reviews received by a user are removed when that recipient’s account is deleted.

3.6 Location and map data

Users can choose a locality manually. If a user taps “my location”, the Platform asks the operating system for location permission and reads a last-known or balanced-accuracy device location at that time. The Platform compares that location locally with a bundled list of Romanian places and selects the nearest place.

The raw device coordinates are not sent to TaskIt, saved to the account or stored on the device by TaskIt. They are discarded after the nearest place is selected. The selected place is used during the current browsing session and can be changed manually. Task locality coordinates come from our predefined place list rather than a user’s raw GPS location.

On iOS, Apple Maps receives ordinary map-tile requests from the device when a live map is displayed and processes them under Apple’s own terms and privacy policy. On Android, TaskIt displays a cached map image. Google receives the predefined locality coordinates and our server’s technical request information when TaskIt generates that image; Google does not receive the Android user’s device IP address through this map-image request.

Location is used to filter tasks by distance. It is not used for user profiling, worker ranking, or location-based notifications.

3.7 Optional identity-document badge

TaskIt offers an optional badge based on a manual review of an identity document. Depending on the document, the user submits the front and back of an identity card or driving licence, or the identification page of a passport. The submitted image can contain the user’s name, photograph, date and place of birth, nationality, address, signature, document number, expiry date, CNP or another national identification number, and other information printed or encoded on the document.

The review is limited. A human reviewer checks whether the document appears genuine and whether the name appears consistent with the profile at the time of review. TaskIt does not perform a comprehensive identity verification, background check, criminal-record check, professional-qualification check, licence check, liveness test, or uniqueness check. It does not use facial recognition, automated extraction, biometric identification or automated fraud scoring. The badge does not guarantee a user’s identity, character, competence, reliability, legal status or suitability for a task.

The document images are stored temporarily in a non-public storage area so that the review can be performed. They are accessible only to personnel authorized to perform or administer the review and to the infrastructure provider acting on our instructions. They are deleted from active storage immediately after the reviewer records a decision. The images are not sent by email, displayed to users, or used for another purpose.

After the images are deleted, TaskIt retains the document category, submission and decision dates, decision status, rejection reason where applicable, and badge approval date for the duration of the account or until no longer needed to administer the badge or a related complaint. The badge is associated with the account, but the profile display name remains editable. It therefore indicates only that a document was reviewed at an earlier time; it is not continuing confirmation that the profile name matches the document. The badge does not affect ranking, eligibility, offer visibility or access to TaskIt.

3.8 Reports, moderation, feedback and support

When a user reports another user or content, we process the reporter and reported account, report reason, optional explanation, status, timestamps, the content necessary to locate and assess the report, our decision, and communications about that decision. Reports may concern spam or scams, harassment, inappropriate or illegal content, fake profiles, safety, or other violations.

We also process feedback, bug reports, optional feedback screenshots, support emails, moderation actions, reasons, appeals or resubmissions, account restrictions, and the records needed to handle these matters fairly and securely. When TaskIt suspends an account or restricts or removes content, it sends the affected user an email explaining the principal reason and available way to contact TaskIt about the decision, except where the law permits or requires us not to provide that information.

Content is currently moderated by humans after a report or other manual review. We do not use AI or automated content classification. Technical rate limits automatically restrict unusually frequent actions, but do not make decisions that produce legal or similarly significant effects.

3.9 Notifications and emails

We process in-app notification records. If a user enables push notifications, we process a device push token and notification preferences. Push payloads can include the notification type, another user’s display name and the relevant task title. They do not include message text or offer amounts. Delivery involves Expo’s notification service and Apple Push Notification service on iOS or Google Firebase Cloud Messaging on Android.

Users can control offer, message and task-update push notifications separately and can turn all push notifications off. We remove a token when the user disables all push notifications, signs out, or when the delivery provider tells us it is invalid.

Account confirmation, password-reset, email-change and moderation-decision messages are sent through our authentication or email providers. Authentication emails contain a short-lived six-digit code. We do not place marketing pixels in these messages or use click/open tracking.

TaskIt does not currently send newsletters, promotions, referral messages, re-engagement emails, or marketing SMS. We will update this Policy and obtain any consent required by law before introducing direct marketing.

3.10 Technical and security data

Our infrastructure providers process technical information needed to operate and protect TaskIt. Depending on the service, this can include IP address, user agent, request path, date and time, response status, authentication event, user or database identifier, WebSocket connection information, and security/audit metadata.

TaskIt does not currently include a third-party analytics, advertising, crash-reporting, or performance-monitoring SDK on the mobile Platform.

3.11 Guest access

Guest access creates a pseudonymous session with a randomly generated identifier. Guests can browse the Platform but cannot post, make offers, send messages, bookmark tasks or perform other write actions. Our infrastructure can still process the session identifier, IP address, user agent, request path and timestamps for operation and security. Guest access should not be understood as complete anonymity.

3.12 Data obtained from other sources

Most data comes directly from the user. We can also receive data:

• from Apple or Google when the user chooses third-party sign-in;
• from other TaskIt users, for example in messages, reviews and reports;
• from the user’s device when the user requests location or push notifications; and
• from our service providers in the form of authentication, email-delivery, security and technical events.

4. What we do not currently collect

TaskIt does not currently:

• process payments, payment-card details or bank-account details;
• collect contacts or background location;
• retain raw GPS coordinates obtained through “my location”;
• use third-party advertising or in-app analytics SDKs;
• use facial recognition or biometric identification; or
• use AI for matching, profiling or content moderation.

Users should not submit special-category personal data, criminal-offence data, identity documents, national identification numbers, financial details, or information about third parties in ordinary task, profile, review or message fields unless it is strictly necessary and lawful to do so.

5. Why we process data and our legal bases

Where we rely on legitimate interests, we assess whether the processing is necessary and balance those interests against users’ rights and reasonable expectations. A user may object to this processing as explained in Section 10.

We do not use personal data for automated decision-making that produces legal or similarly significant effects within Article 22 GDPR. If this changes, we will provide the legally required information before implementing it.

6. Which data is visible and to whom

TaskIt profiles and task listings are not currently published as web pages or intentionally submitted for search-engine indexing. Avatars and task photographs are stored as public media and may be accessible to anyone who obtains their direct URL, including outside the TaskIt Platform. Users must not upload an avatar or task photograph they intend to keep confidential. Message photographs, feedback photographs and identity documents are stored in non-public areas.

7. Service providers and other recipients

We disclose personal data only where needed for the purposes described in this Policy. Recipients can include:

• other TaskIt users and guests, according to the visibility described above;
• Supabase, for database hosting, authentication, realtime features and file storage in an EEA project region;
• Expo, Apple and Google, for push-notification delivery;
• Apple Maps and Google Static Maps, for the limited mapping flows described in Section 3.6;
• Resend, for account-related email delivery;
• Google Workspace, for support and privacy email communications;
• hosting, DNS and security providers used for TaskIt’s website or domains, where relevant;
• professional advisers such as lawyers, accountants, auditors or insurers where necessary and subject to confidentiality; and
• courts, law-enforcement bodies, regulators or other public authorities where disclosure is legally required or otherwise lawful.

Providers that process personal data on our behalf are required to act under a contract and appropriate instructions. Certain providers also process information for their own purposes as independent controllers—for example, Apple or Google when a user uses their account, device, app store, maps or other independently controlled service. Their own privacy notices apply to that processing.

We do not sell personal data or disclose it for third-party advertising.

8. International data transfers

Our primary Platform database and file storage are hosted in the European Economic Area. Some providers or their subprocessors, including Expo, Resend, Apple, Google and the US corporate provider of Supabase, may process data in or permit access from countries outside the EEA, including the United States.

Where required, we rely on a European Commission adequacy decision, including the EU–US Data Privacy Framework for a participating certified US entity, or European Commission Standard Contractual Clauses together with any supplementary measures considered appropriate. The mechanism can differ by provider and processing activity.

Users may contact privacy@taskit.ro for more information about the safeguard applicable to a particular transfer and how to obtain a copy, subject to protection of confidential information.

9. How long we keep data

We keep personal data only for as long as reasonably necessary for the relevant purpose, subject to the periods and criteria below.

When an account is deleted, TaskIt promptly deletes account/profile data and content that is not subject to a stated retention rule or a lawful exception. Reports concerning that account are also deleted unless TaskIt has already identified and preserved limited information needed for an existing safety investigation, valid authority request, legal obligation or legal claim. Storage objects scheduled for deletion are removed from active storage promptly. Residual copies in protected disaster-recovery backups, if backups are enabled, are isolated from ordinary use and overwritten within the provider’s backup lifecycle, no later than 30 days.

We may preserve narrowly limited data beyond an ordinary period where necessary to comply with law, respond to a valid authority request, protect a person’s safety, or establish, exercise or defend a legal claim. Access is restricted and the need is reviewed. When the reason ends, the data is deleted or anonymized.

Anonymous statistical information that no longer relates to an identifiable person may be kept without a fixed period. Removing a displayed name alone is not treated as anonymization where TaskIt or another person could still reasonably identify the individual.

10. Your data-protection rights

Subject to the conditions and exceptions in applicable law, users have the right to:

• obtain confirmation whether we process their personal data and receive access to it;
• correct inaccurate data and complete incomplete data;
• request deletion;
• restrict processing;
• receive qualifying data they provided in a structured, commonly used and machine-readable format, and request transmission where technically feasible;
• object to processing based on legitimate interests, including an objection based on their particular situation;
• withdraw consent at any time, without affecting processing already carried out lawfully; and
• lodge a complaint with a data-protection supervisory authority.

Consent for an optional telephone number can be withdrawn by removing the number from the account. Consent for push notifications can be withdrawn in TaskIt settings. Consent for a pending identity-document review can be withdrawn by contacting TaskIt before the decision; after the decision, the document images have already been deleted. Device-level notification or location permissions can also be changed in operating-system settings.

Rights requests can be sent to privacy@taskit.ro from the account’s registered email address. We may request limited additional information only where reasonably necessary to verify the requester. We do not ordinarily require an identity-document copy for a privacy request.

We respond without undue delay and normally within one month. For a complex request or numerous requests, we may extend this by up to two further months and explain the extension within the first month. Requests are normally free. GDPR permits a reasonable fee or refusal where a request is manifestly unfounded or excessive. We will explain any refusal and available complaint routes.

When responding, we also protect other people’s rights and freedoms. For example, an access or portability response involving a conversation may require us to limit or redact another participant’s data.

Account deletion is available in Profile → Account → Delete account. Users do not have to give a reason. The continuing treatment of messages, reviews and reports is described in Section 9.

11. Complaints

Users may complain to the supervisory authority in the EEA country of their habitual residence, workplace, or the alleged infringement. TaskIt’s lead supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral Gheorghe Magheru 28–30
Sector 1, 010336 Bucharest, Romania
www.dataprotection.ro

Users may contact TaskIt first at privacy@taskit.ro, but are not required to do so before contacting a supervisory authority.

12. Age requirement

TaskIt is intended only for people aged 18 or older. The ordinary TaskIt account is not age-verified merely because the Platform has an optional document-check badge. If we reasonably determine that an account belongs to a minor, we will restrict it and delete the account and related data, subject to narrowly limited retention required for safety, legal duties or claims.

Concerns about a possible minor’s account can be reported to privacy@taskit.ro.

13. Security

We use technical and organizational measures intended to protect personal data in a manner appropriate to the risk. These include encrypted network connections, provider encryption at rest, database and storage authorization policies, restricted administrative credentials, multi-factor authentication for privileged access, access review, security logging, data minimization, and incident-response procedures.

No service can guarantee absolute security. Users should use a unique password, protect their device and account codes, and avoid sharing sensitive or unnecessary information in tasks and messages.

If a personal-data breach occurs, we will assess it and make notifications required by Articles 33 and 34 GDPR. This includes notifying the competent supervisory authority without undue delay and, where required, within 72 hours after becoming aware, and notifying affected people without undue delay where the breach is likely to create a high risk to their rights and freedoms.

14. Changes to this Policy

We may update this Policy when our services, providers or legal obligations change. We will display the current version and effective date on the Platform and on our website.

For material changes, we will provide reasonable advance notice through the Platform or by email where appropriate. Urgent security or legal changes may take effect sooner. If a new activity requires consent, we will request that consent before beginning it.

Future features such as in-app payments, marketing communications, public web profiles, website analytics, AI-assisted moderation, background checks or expansion to new countries will be assessed and reflected in this Policy before they are introduced.

15. Contact

Privacy and data-rights requests: privacy@taskit.ro
General support: contact@taskit.ro

RAZHORD TECH S.R.L.
Calea Dorobanților 55, Ap. 20
400117 Cluj-Napoca, Cluj County, Romania