Privacy Policy

1. Introduction

vtaskly (“vtaskly”, “we”, “us”) is operated by Logicly LLC, a Delaware limited liability company. This Privacy Policy explains what information we collect through vtaskly.com and the vtaskly platform, how we use it, and the choices you have. Questions? Email info@vtaskly.com.

Some customers subscribe through an authorized vtaskly provider that configures and supports workflows for them. That provider and Logicly LLC handle the customer’s data under the customer’s agreement, which prevails over this policy where they differ.

2. Who this applies to

This policy covers (a) visitors to our public website and (b) authorized users of a customer’s vtaskly tenant. For data inside a tenant, the customer (your organization) is the data controller — the organization responsible for it under privacy law — and vtaskly (with any authorized provider the customer contracts with) acts as a data processor / service provider on its behalf.

3. Information we collect

• Account & identity. When you sign in, your identity is verified through our authentication provider Kinde (via your organization’s SSO or email and password). We receive your name, email address, and organization identifier. We never store your password, and we never see your SSO password.
• Workflow data. The inputs and outputs of the workflows your team runs, which may include files, documents, spreadsheet rows, email content, and reference data your team provides.
• Data from connected accounts. When an authorized user connects a third-party account (Google Drive, Gmail, Microsoft SharePoint, OneDrive, Outlook, Teams, or Excel Online), we access only the specific resources required to run the workflows you configure, using OAuth tokens you can revoke at any time. We never request your third-party account password.
• Usage & diagnostic data. Logs of workflow runs and significant actions (actor, target, timestamp) for security, audit, and reliability.

vtaskly is not designed for health information, payment-card data, government identifiers, biometric data or information about minors; customers may not process them without our written agreement.

4. How we use information

We use information to operate and secure the service, run the workflows you configure, provide support, maintain audit and compliance records, and improve reliability. We use a customer’s data only to provide, secure and support the service for that customer and to improve that customer’s own workflows — never to build workflows for other customers or for marketing. We do not use your workflow data or connected-account data to train our own or any third party’s generative AI models (an AI provider may review content it flags and use it to improve its abuse-detection and safety systems — see section 5). We use usage statistics that identify no customer or individual to operate and improve the platform.

5. Sub-processors & service providers

We rely on a limited set of vetted providers to deliver the service:

• Kinde — authentication and single sign-on; sign-in data may be processed in the United States.
• Microsoft Azure — cloud hosting, database, and file storage, in the customer’s region (see section 11).
• OpenAI, Anthropic, and Google (Gemini API) — AI processing for AI-enabled workflow steps. Each receives only the inputs and outputs of the steps that use it, through our business API account (never a consumer account or unpaid tier), on terms under which it does not use the content to train its models. The providers may keep content for a limited period for abuse monitoring, as their terms describe (currently up to 30 days for OpenAI and Anthropic and up to 55 days for Google, during which flagged content may be reviewed by people and used to improve their abuse-detection and safety systems; content Anthropic flags for a usage-policy violation may be kept longer). If a customer connects its own AI provider account instead, that account’s terms apply to what it receives. We don’t use provider features that store content for later use, and AI steps have no web-search or browsing tools. A customer can ask for specific workflows or data not to be sent to AI providers.
• The Google and Microsoft APIs you connect, accessed only under your OAuth authorization.

Changes to this list for a customer’s data follow that customer’s agreement.

6. Google API Services — Limited Use

vtaskly’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Microsoft Graph data

Information accessed via Microsoft Graph (SharePoint, OneDrive, Outlook, Teams) is used solely to provide the features you configure. It is never sold, never used for advertising, and never used to train AI models.

8. How we share information

We do not sell personal information. We share it only with the sub-processors listed above to operate the service, and when required by law or to protect rights and safety. We never publish customer data or make it available through a public link or a search-indexed page. In a corporate transaction (such as a merger or acquisition), data may transfer subject to this policy.

9. Data retention

The data each workflow step reads and produces is retained for a period each customer sets (default 90 days, from 1 day to 10 years) and then automatically deleted; the deletion deadline is set when the data is written. Run records (who started a run and when, its starting inputs such as file names, its status and any error), files, tables, configuration and user details stay until the customer deletes them or asks us to. Account and audit records are retained as needed for security and legal obligations. When a customer leaves, we keep its environment for a short period so it can export its data or return (90 days unless its agreement says otherwise), then delete it within 30 days; deleted data can remain in encrypted backups for up to 35 days.

10. Security

Each customer tenant is isolated in its own database schema and its own file-storage container. Data is encrypted in transit (TLS 1.2 or higher) and at rest, with additional encryption of workflow inputs and outputs and stored credentials. Access is controlled by role- and field-level permissions, users join a tenant by invitation (joining by email domain only if the customer asks us to turn it on), single sign-on is supported, and significant actions are audit-logged. If a security incident affects a customer’s data, we notify that customer without undue delay.

11. Data residency & international transfers

Customer data at rest is stored on Microsoft Azure in the region of the customer’s production environment — for Canadian customers, in Canada (Canada Central, Toronto, with backup copies in Canada East). Before a customer’s production environment is set up, onboarding test runs may use our test environment in the United States (Azure Central US); that data is deleted within 30 days after production is ready unless the customer asks for it to be moved. Some processing happens outside the customer’s region: sign-in through Kinde (which may process sign-in data in the United States), AI-enabled steps at the AI providers (including in the United States), and engineering and support by Logicly LLC’s staff in the United States. Such information may be subject to the laws of those countries, including lawful access by public authorities; we rely on contractual safeguards for these transfers.

12. Your rights & choices

You may request access to, correction of, or deletion of your personal information, and you may revoke a connected account’s access at any time from within the product. Tenant users should also contact their own organization (the controller). To exercise rights with us, email info@vtaskly.com. Residents of Canada have rights under PIPEDA and provincial privacy laws such as British Columbia’s PIPA. Residents of the EU, EEA, and UK have rights under the GDPR — including access, rectification, erasure, restriction, portability, and objection. We honor these rights for data we control, and refer requests about data in a customer’s tenant to that customer.

13. Children’s privacy

vtaskly is a business tool and is not directed to children under 16. We do not knowingly collect their personal information.

14. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date at the top of this page.

15. Contact

Logicly LLC — info@vtaskly.com.

16. Governing law

This policy is governed by the laws of the State of Delaware, USA.