Privacy & Cookie Policy

1. Data Controller Identification

The Data Controller responsible for personal data processed through the Taskinger platform is:

• Legal Entity: Vivan Health Projects Ltd. („ВИВАН ХЕЛТ ПРОДЖЕКТС" ООД)
• UIC / Registration No.: 204317046
• Registered Office: 1309 Sofia, Sveta Troitsa Complex, Bl. 376, Entr. G, Fl. 2, Apt. 76, Republic of Bulgaria
• Managing Director: Valentin Kirilov
• Privacy Contact: valentin.k.kirilov@gmail.com

2. Categories of Personal Data Processed

We adhere to strict data minimization principles, processing only information essential to provide our services:

• Account & Profile: Email address, display name, profile avatar (when using Google Sign-In), internal unique user identifier (Firebase UID), legal consent records (`legalVersion`).
• Workbook & Task Data: Names of workbooks, projects, teams, task titles, descriptions, due dates, completion notes, comments, file attachments, and immutable activity logs.
• Technical & Security Telemetry: IP addresses, request timestamps, user-agent details, error logs, and infrastructure security events.
• Push Notifications: Firebase Cloud Messaging (FCM) registration tokens used to deliver assignment and due-date alerts.
• Billing & Entitlements: Subscription tier status (Base, Pro, Team), RevenueCat customer identifiers, Stripe customer IDs. Note: Raw card credentials are processed directly by Stripe and never stored on our servers.
• Local Device Security: PBKDF2-SHA256 hashed PIN strings for App Lock and WebAuthn credential public IDs stored in your local browser storage.
• Google Calendar Sync (optional): Only if you connect your Google account in Preferences. We store the Google account email you connected, an OAuth refresh token encrypted with Google Cloud KMS, and the identifiers of the calendar events Taskinger creates. Taskinger writes your own dated tasks into your primary Google calendar as events and reads back changes to those events only, identified by a private marker; no other calendar data is stored or shared (see §5.1). Disconnecting revokes the token and removes those events. Taskinger's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Purposes & Legal Grounds for Processing (Art. 6 GDPR)

4. B2B Workspaces: Taskinger as Data Processor (Art. 28 GDPR)

When an enterprise or healthcare organization (such as a dental studio or accounting firm) uses Taskinger:

• The Client Enterprise serves as the Data Controller for records of employees and patients uploaded to its private workbooks.
• Vivan Health Projects Ltd. acts as the Data Processor under Art. 28 GDPR, maintaining technical and organizational security controls and acting exclusively upon the controller's instructions.

5. Data Recipients & Certified Sub-processors

• Google Ireland Limited / Google LLC (Firebase & Google Cloud): Primary cloud host, database provider (Cloud Firestore in EU multi-region `eur3`), cloud functions, storage, and authentication.
• RevenueCat, Inc.: Subscription lifecycle orchestration and customer billing portal.
• Stripe Payments Europe, Ltd.: PCI-DSS Level 1 certified payment processing.
• AI Inference Providers (Anthropic PBC, OpenAI LLC, Google LLC): Receive note snippets only when you supply your own API key and explicitly trigger analysis (see AI Statement).
• Google LLC (Google Calendar API): Receives the titles, dates and links of your dated tasks as calendar events only when you connect Google Calendar in Preferences, and only for your own Google account.

5.1 Google user data: who we share, transfer and disclose it to

This section covers data Taskinger receives from Google APIs when you connect Google Calendar in Preferences — scopes `openid`, `email` and `https://www.googleapis.com/auth/calendar.events`. Concretely: the email address of the Google account you connected, the OAuth refresh token, the identifiers of the events Taskinger creates in your primary calendar, and the content of changes you make to those events.

• Google Ireland Limited / Google LLC — the only third party we disclose this data to, and only in its role as our hosting sub-processor: the refresh token is encrypted with Google Cloud KMS and held, together with the connected account email and the event identifiers, in Cloud Firestore (EU multi-region `eur3`), where our Cloud Functions read it to call the Google Calendar API back on your behalf.
• No one else, for any purpose. Google user data is never shared, transferred or disclosed to RevenueCat, to Stripe, to the AI inference providers listed above, or to any advertiser, data broker, analytics vendor or other third party. We do not sell or rent it, we do not use it for advertising or profiling, and we do not use it to train, retrain or improve any artificial-intelligence or machine-learning model — ours or anyone else's.
• No human reads it at Vivan Health Projects Ltd., except with your prior explicit consent (for example when you ask us to investigate a sync problem), where it is strictly necessary for security purposes such as investigating abuse, or where a binding legal obligation requires it. Where we are compelled to disclose data to a competent authority, we notify you unless the order forbids it.
• Inside Taskinger, the connection is yours alone. No other member of a shared workbook can see your connected Google account, your token, or anything in your calendar. If you rename or re-date one of these events in Google Calendar, that edit is written back into the underlying task — from that point it is ordinary task data governed by the rest of this Policy, including workbook visibility and the optional, key-gated AI analysis described above.

What we receive and discard. Incremental synchronisation asks Google for events changed in your primary calendar since the last sync; Google's API does not allow that request to be filtered, so unrelated events can appear in the response. Taskinger keeps only events carrying its own private marker (`taskinger=1`) and discards the rest in memory — they are never written to our database, never logged, and never disclosed to anyone.

Withdrawal. Disconnecting in Preferences revokes the refresh token with Google, deletes the events Taskinger created, and erases the stored token, connected email and event identifiers. You can also revoke access at any time from your Google Account permissions page.

Taskinger's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. International Data Transfers

Primary data resides in EU data centers (Frankfurt/Europe). Any cross-border telemetry or authentication requests outside the EEA comply with Chapter V of GDPR via the EU-U.S. Data Privacy Framework or European Commission Standard Contractual Clauses (SCCs).

7. Data Retention Policy

• Active Content: Retained for the duration of the account lifecycle. Upon deletion, personal identifiers are permanently purged or anonymized.
• Accounting Records: Financial invoices and transaction proofs are archived for 5–10 years pursuant to Bulgarian fiscal legislation.
• Security Logs: Transient server access logs are retained for up to 90 days.

8. Technical & Organizational Security Measures (Art. 32 GDPR)

• Server-Enforced Isolation: Cloud Firestore security rules execute server-side on every query, mathematically blocking unauthorized cross-workbook data access.
• Encryption: TLS 1.3 encryption in transit; AES-256 encryption at rest in Google Cloud storage buckets and database nodes.
• PBKDF2-SHA256 PIN Hashing: Local PIN codes are salted and hashed on the client; plain-text PINs are never transmitted.
• Automated Regressions: Automated security rules unit tests validate isolation before every production deployment.

9. Your GDPR Rights

You hold the right to: (1) access your data (Art. 15); (2) rectify inaccuracies (Art. 16); (3) erasure (Art. 17); (4) restriction of processing (Art. 18); (5) data portability (Art. 20, via CSV/JSON export); (6) object to processing (Art. 21); and (7) withdraw consent (Art. 7(3)).

To exercise your rights, contact us at: valentin.k.kirilov@gmail.com. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) at cpdp.bg or your local EU supervisory authority.

10. Cookie & Local Storage Policy

Taskinger does not use advertising cookies, tracking pixels, or third-party marketing analytics. We employ only strictly necessary technical storage keys:

Under Art. 5(3) of the EU ePrivacy Directive (Directive 2002/58/EC), strictly necessary technical storage required to deliver requested services is exempt from cookie consent banner mandates.

11. Children's Privacy

Taskinger is not directed to individuals under 14. We do not knowingly harvest personal information from children without verified parental consent.

12. Amendments to this Privacy Policy

This Privacy Policy may be periodically revised to reflect regulatory or technical updates. For material modifications, registered users will receive advance notification within the application or via email.

13. Contact Information

For questions, data subject requests, or privacy inquiries:
Email: valentin.k.kirilov@gmail.com
Postal: Vivan Health Projects Ltd., Sveta Troitsa Bl. 376, Entr. G, Apt. 76, 1309 Sofia, Bulgaria.