Privacy Policy

OpenWings Technologies ("OpenWings", "we", "us", "our") operates WhaTTask, a software-as-a-service project and task management platform available at whattask.app (the "Service"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Service, globally.

This policy applies to users worldwide and is designed to comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), India's Digital Personal Data Protection Act 2023 (DPDP), Brazil's LGPD, Canada's PIPEDA, and similar legislation.

By using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are

Data Controller: OpenWings Technologies, a partnership firm registered in India.

Service: WhaTTask (the "Service")

Contact: hello@openwingstech.com

Website: https://whattask.app

2. Information We Collect

2.1 Information You Provide

• Account information: Full name, email address, mobile number, password (encrypted with bcrypt).
• Profile information: Profile picture, role, time zone preferences.
• Workspace information: Workspace name, team member details, organization branding.
• Content: Tasks, projects, comments, attachments, time entries, and any other content you create within the Service.
• Communications: Messages you send to our support team, feedback, survey responses.

2.2 Information from Third-Party Sign-Ins

When you sign up using Google Sign-In, we receive your name, email, and unique Google identifier. We do not access your Google Drive, Contacts, or any other Google data unless explicitly authorized.

2.3 Information Collected Automatically

• Device information: Browser type, operating system, device identifiers, IP address.
• Usage data: Pages visited, features used, time spent, click patterns.
• Log data: Server logs of API requests, authentication events, error reports.
• Authentication tokens: JWT tokens stored in your browser's local storage to keep you logged in.

2.4 Information from Payment Providers

When you purchase a paid plan, payments are processed by Razorpay (for Indian customers) or other payment processors as we expand globally. We receive transaction confirmation, billing email, and payment status — but we do NOT store your full card number or CVV. That data is held by the payment processor.

3. How We Use Your Information

We use your information for the following purposes:

4. Multi-Tenant Workspaces and Shared Data

WhaTTask is built around the concept of workspaces. When you join a workspace (either by creating one or accepting an invite), you become part of that team. Other members of your workspace can see:

• Your name, email, role, and profile picture
• Tasks, projects, comments, and time entries you create within that workspace
• Your activity timeline (logins, edits, completions)

Workspace owners and admins have elevated permissions and can manage members, remove users, and access all data within their workspace. You are responsible for joining only workspaces you trust.

5. How We Share Your Information

We do not sell your personal data. We share information only in these limited cases:

5.1 Service Providers (Sub-processors)

We use the following carefully vetted third parties to operate WhaTTask:

5.2 Legal Disclosures

We may disclose information when required by law, such as in response to valid legal process, government requests, or to protect our rights, property, or the safety of users or the public.

5.3 Business Transfers

If OpenWings is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and continue to honor this policy.

5.4 With Your Consent

We share your data with other parties only when you explicitly authorize us to do so.

6. International Data Transfers

WhaTTask is operated from India, but data may be processed in other countries by our sub-processors. Specifically:

• Transactional emails are processed by Resend (Amazon SES infrastructure in Tokyo, Japan).
• Google Sign-In data passes through Google's global infrastructure.
• Future CDN providers may cache static assets globally.

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable to lawfully transfer data outside these regions.

7. Data Retention

We retain your personal data only as long as necessary to provide the Service and fulfill our legal obligations:

• Active accounts: Data retained as long as your workspace is active.
• Cancelled paid subscriptions: Workspace data preserved for 30 days grace period, then downgraded to Free plan (data preserved).
• Inactive accounts (Free plan, 365+ days inactive): Notice sent to account email. If no response within 30 days, account and data may be archived or deleted.
• Backups: Automated backups are retained for 30 days for disaster recovery.
• Audit logs: Administrative action logs retained for 12 months.
• Legal holds: Data may be retained longer if required by law or in case of disputes.

8. Your Rights

Depending on where you live, you have the following rights regarding your personal data:

8.1 Universal Rights (apply to all users)

• Access: Request a copy of your personal data.
• Correction: Update inaccurate or incomplete information.
• Deletion: Request deletion of your account and data.
• Portability: Receive your data in a structured, machine-readable format.
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time.

8.2 GDPR Rights (EU/EEA/UK Users)

• Right to object to processing
• Right to restrict processing
• Right to lodge a complaint with a supervisory authority
• Right not to be subject to automated decision-making

8.3 CCPA Rights (California Users)

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt out of the sale of personal information (we do not sell personal data)
• Right to non-discrimination for exercising your rights

8.4 DPDP Rights (Indian Users)

• Right to access your personal data and processing summary
• Right to correction and erasure
• Right to grievance redressal
• Right to nominate a representative in case of incapacity or death

8.5 How to Exercise Your Rights

Email us at hello@openwingstech.com with the subject "Privacy Request". We will respond within 30 days (or as required by applicable law).

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: All data transferred over HTTPS/TLS 1.2+.
• Encryption at rest: Passwords hashed with bcrypt (10 rounds). Sensitive credentials in environment variables, not in code.
• Authentication: JWT-based authentication with 30-day token expiry.
• Access controls: Role-based permissions (owner / admin / member).
• Server hardening: Firewalled VPS with restricted SSH access.
• Backups: Automated daily database backups.
• Audit logging: All administrative actions logged with actor, timestamp, and reason.

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for keeping your password confidential.

10. Cookies and Local Storage

WhaTTask uses minimal client-side storage:

• localStorage: Stores your JWT authentication token and a copy of your user profile, so you stay logged in across browser sessions.
• No tracking cookies: We do not use third-party analytics or advertising cookies.
• No cross-site tracking.

You can clear this data at any time via your browser settings or by logging out.

11. Children's Privacy

WhaTTask is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

12. Email Communications

We send the following emails:

• Transactional emails (password reset, invites, notifications): These are essential for the Service and cannot be unsubscribed without closing your account.
• Product updates and marketing (planned): Opt-in only. You can unsubscribe via the link in every marketing email.

13. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites. Review their privacy policies before sharing information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent version. Your continued use of the Service after changes constitutes acceptance.

15. Contact Us

For privacy questions, data requests, or complaints:

• Email: hello@openwingstech.com
• Subject line: "Privacy Request" (for faster routing)
• Mailing address: Available on request to verified data subjects

EU/UK Data Protection Representative: If you are based in the EU/UK and wish to contact us about GDPR matters, email the address above; we will appoint and disclose a representative as required when our EU user base grows.