Privacy Policy

ShootTask is operated by [LEGAL ENTITY NAME], [COMPANY TYPE], registered at [REGISTERED ADDRESS], India ([CIN / REGISTRATION NUMBER]). In this policy, “we”, “us” and “ShootTask” refer to that entity, and “you” refers to the person using the service.

For the purposes of the Digital Personal Data Protection Act, 2023, we act as the Data Fiduciary for the account data described below. Where you upload your own team’s data into a workspace, you remain responsible for that content and we process it on your instructions.

• Account data — your first and last name, email address, organisation name, timezone, and an encrypted password credential. Provided by you at signup.
• Workspace content — the projects, epics, stories, subtasks, sprints, comments, attachments and time entries you and your team create.
• Usage and activity data — records of actions taken in a workspace (who changed what, and when), used to power the activity feed and audit history.
• Billing data — your plan, subscription status, invoice history and payment reference IDs. Card and UPI details are handled entirely by our payment gateway and are never stored on our servers.
• Technical data — IP address, browser and device type, and server logs, retained for security and diagnostics.

• To create and operate your workspace and user account.
• To send transactional email — verification, invitations, password resets, and billing notices. These are not marketing emails and cannot be opted out of while your account is active.
• To process subscription payments and issue receipts.
• To secure the service — detecting abuse, debugging failures, and maintaining audit trails.
• To meet our legal, tax and accounting obligations.

We share data with a small set of service providers who process it on our behalf, under contract:

• Amazon Web Services — hosting, database and file storage (Mumbai region, ap-south-1).
• Amazon Simple Email Service — delivery of transactional email.
• Razorpay — payment processing and subscription mandates.
• [ANY ANALYTICS / SUPPORT / AI VENDORS — LIST OR REMOVE]

We do not sell personal data, and we do not share it with advertisers.

Workspace data is stored in the AWS Mumbai (ap-south-1) region and is encrypted in transit (TLS) and at rest. Some sub-processors listed above may process limited data outside India; where that happens, it is done under the transfer safeguards those providers offer.

We keep workspace data for as long as the workspace is active. If you close your workspace, we delete or irreversibly anonymise its data within [RETENTION WINDOW, e.g. 30 days], except where we are required to retain records — invoices and tax documents, for instance — for the period the law prescribes.

Subject to the DPDP Act, 2023, you may request access to the personal data we hold about you, ask us to correct it, ask us to erase it, or withdraw a consent you previously gave. Write to us at the address in section 10 and we will respond within the statutory timeframe.

If your account was created by a workspace owner, some of these requests may need to be routed through them.

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. [ADD A LINE HERE IF YOU LATER INTRODUCE ANALYTICS OR MARKETING COOKIES — THOSE REQUIRE CONSENT.]

Authentication is handled by a dedicated identity provider with multi-factor authentication available. Passwords are never stored in plain text. Access to production systems is restricted and logged. No system is perfectly secure, but we will notify affected users and the Data Protection Board without undue delay if a breach occurs.

For any privacy question or to exercise a right above, contact our Grievance Officer:

[GRIEVANCE OFFICER NAME]
[EMAIL ADDRESS]
[POSTAL ADDRESS]

We will post any change on this page and update the date at the top. If a change materially affects how we handle your data, we will also email workspace owners before it takes effect.