Data processing addendum

The parties

You are the controller of personal data in your product. TaskToProd is the processor when it handles that data to perform the service.

Legal business name

Amortoae Petru Persoană Fizică Autorizată

Registered address

B-dul Bucureștii Noi 136, Parter, ap. 5, Sector 1, Bucharest, Romania

Company registration

CUI 52361814, Trade Register F2025030447007

VAT number

RO54733868 (intra-community VAT code; not registered as a VAT payer)

Legal contact

info@tasktoprod.com

Privacy contact

info@tasktoprod.com

Governing law

Romanian law

Scope and instructions

We process personal data only to perform the service and only on your documented instructions, including the instructions implicit in a request you queue. If an instruction appears to conflict with applicable law, we tell you rather than proceeding silently.

Confidentiality and access

Access is limited to the operator delivering your work. Administrative access is granted from a server-controlled allowlist, is separate from any client role, and sensitive actions are recorded in an append-only audit trail.

Security measures

Tenant isolation is enforced by the database. Private storage objects are path-constrained per organization, project and request, and are reachable only through short-lived signed URLs issued after membership is verified. Secrets are held only by server-only modules and are never exposed to browser code, logs, error responses or engineering briefs.

Subprocessors

We use the subprocessors listed below. We will tell you before adding a new subprocessor that processes your personal data, so you have a fair opportunity to object.

• Supabase — Application database, authentication and private file storage
• Stripe — Subscription billing, hosted Checkout and the Customer Portal
• Hostinger — Application hosting and content delivery
• Brevo — Transactional email delivery

AI processing

Engineering is AI-accelerated. Where an AI tool is used in delivering your work, it is used as an engineering aid under human review, and no unreviewed output reaches your production environment. The AI policy page describes the current stance and its limits.

Assistance, deletion and return

We will help you respond to data subject requests and to security incidents affecting your data. On termination we return or delete personal data according to the configured retention policy and your instruction.

Retention period

12 months after the membership ends

Privacy contact

info@tasktoprod.com