Privacy policy

This is an English translation. The binding version is the Polish original, Polityka prywatności, which prevails in the event of any discrepancy.

Version dated 14 October 2026. This policy covers the taskmanager.pl and taskmanager.works websites (language versions), the demo version of the software at demo.taskmanager.works and the Task Manager licence and update server. You will find a summary of the key information in the information notice - the “GDPR” link in the page footer.

Key points in brief

• Who: the controller of your data is Blue Creation Piotr Łącz, the owner of the Task Manager brand. For data protection matters, write to kontakt@taskmanager.pl.
• Demo form: we use the data from the form to start your demo and to contact you about your request. We only phone you if you ask us to or agree to receive phone calls with offers. We send marketing communications only with your separate, voluntary consent.
• Analytics only with consent: we turn on Google Analytics and our own visitor identifier only when you consent to this in the cookie banner. We link your visit history to your demo request only with a separate consent. Without consent, we only count page views from server logs - without cookies, without an identifier and without any script in your browser. We do not use advertising pixels.
• Chat with the AI assistant: on the Polish pages of taskmanager.pl you can talk to an AI assistant (the Claude model by Anthropic, USA). We read the conversations to improve the answers, and we delete a conversation 90 days after the last activity.
• Outside the EEA: some data is transferred to the USA: to Google (after analytics consent) and to Anthropic (AI features in the demo version, the chat with the AI assistant on our website and the Claude Code tool, which we use for programming). For Google, the AI features and the chat, the basis is standard contractual clauses, and for Google also the European Commission decision on the Data Privacy Framework. Claude Code is used under Anthropic’s terms for individual users, without a data processing agreement.
• Retention periods: each type of data has its own deletion deadline, e.g. the demo version - 60 days (30 days of use and 30 days read-only), a demo request - 12 months from your last contact with us, server logs - up to 15 days.
• Your rights: you can at any time withdraw your consent, object to processing, request access to your data, its rectification or erasure, and lodge a complaint with the President of the Personal Data Protection Office (UODO).

Controller and contact

The controller of your personal data is Blue Creation Piotr Łącz, ul. Skoroszewska 7 lok. 88, 02-495 Warszawa, NIP 5291645499 (“we”, “us”). Task Manager is our brand.

For any matter concerning your data, write to kontakt@taskmanager.pl, call +48 606 704 195 or send a letter to the address above. You can write to us in Polish or English.

We have not appointed a data protection officer, because the law (Article 37 GDPR) does not require us to do so. We handle data protection matters ourselves.

Why we process data and on what basis

We describe each purpose separately: what data, why, on what legal basis, for how long and who has access to it. “GDPR” means Regulation (EU) 2016/679 (the General Data Protection Regulation), and “ECL” means the Polish Electronic Communications Law (Prawo komunikacji elektronicznej), i.e. the Act of 12 July 2024. The companies that process data on our behalf are listed in the section “Who we share data with”.

Demo form and contact about your request

• Data: first and last name, email address and company name, and - if you provide them - job title, number of users, phone number and question. In addition: the consents and requests ticked in the form (their wording, version and time), the page language, the address of the page from which you send the form, with campaign parameters (utm), information on whether the address contained a Google or Facebook ad click identifier (without its value), the time of sending and the IP address. If you consent to linking your visits to your request, also the visitor identifier (see “Linking your visits to your demo request”).
• Purpose: to handle your request - send the confirmation link, set up the demo, answer your question and contact you by email and, if you ask us to, also by phone. The campaign parameters show us where requests come from.
• Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). If you send the form on behalf of a company, we process your data as its contact person on the basis of our legitimate interest, namely handling that company’s enquiry (Article 6(1)(f) GDPR). Campaign parameters and IP address - our legitimate interest: assessing the effectiveness of campaigns and protecting the form against abuse (Article 6(1)(f) GDPR). Your request for a phone call is also your consent to that call (Article 398 ECL).
• How long: without consent to marketing communications - 12 months from your last contact with us, e.g. confirming your address, replying to our email or asking for the demo to be extended. With consent to marketing communications - no longer than 3 years from your last contact with us, and after you withdraw it - as without consent. We keep requests whose address was not confirmed and that were not followed by any contact, and requests identified as abuse, for 90 days. We delete the IP address after 30 days. Once a month, we review the copies of requests that arrive in our email inbox and delete those whose retention period has ended. If we delete a request earlier at your request, for 90 days from its submission we keep only a hash of the email address, so that the automated system can recognise repeated requests (and proof of marketing consents - see “Marketing communications”). If you buy a licence, we then process the data as customer data (see “Customers: licences and updates”).
• Who has access: us and cyber_Folks as our server and email provider.
• Do you have to provide data? Your first and last name, email address and company name are needed to set up a demo - without them we cannot accept the request. You provide a phone number only if you ask for a phone call or agree to phone calls with offers. Job title, number of users and question are optional and help us prepare for the conversation. Marketing consents are also voluntary.

After you send the form, you receive an email with a confirmation link that is valid for 24 hours. Normally, the demo starts only once you confirm your address with the button on the page that this link opens - this protects against bots and against setting up a demo with someone else’s address. Without that click, we start a demo only manually, once we have confirmed your address in another way, e.g. in a conversation. The second email contains the demo address, login and initial password - change the password after you first log in.

If you tick the request for a phone call, we will call you about your request and the demo on a working day between 9:00 and 17:00 (Polish time). We do not promise a specific day or time. Without that request, we contact you by email. We make other phone calls with offers only with a separate consent.

Automated assessment of demo requests

Every demo request is checked by an automated system, so that demo versions are not set up by bots or by people sending series of requests. The demo will not start automatically if:

• the email address comes from a disposable email service or the domain of the address does not exist in the DNS (it has no MX or A record),
• 2 requests have already come from the same email address within 90 days, 3 requests from the same domain within 30 days, or 3 requests from the same IP address within 24 hours,
• the request scores less than 20 points out of 100.

We add points for, among other things, an address in a company domain, a company name that matches the domain of the address and a longer question. We deduct points for a free email account, random characters in the first or last name and further requests from the same IP address. A phone number, a request for a phone call and marketing consents do not change the score.

We do not save or reply to requests in which a hidden bot-trap field (invisible to people) has been filled in.

This is not a final decision. A request that the automated system does not let through is checked by a person within 2 working days, and you receive an email saying that we will contact you about access. If you believe the assessment was wrong, write to kontakt@taskmanager.pl - we will check the request and, if necessary, start the demo manually.

Legal basis: our legitimate interest, namely protection against abuse and spam (Article 6(1)(f) GDPR). We keep the score and the reason for the assessment together with the request. You can object to the assessment (see “Right to object”).

Demo version of the software

• Data: the demo administrator account (first name, last name, email, password), everything you enter or upload to the demo, the names and email addresses of colleagues you invite, and technical data about your work in the software, e.g. sessions and failed login attempts.
• Purpose: to give you the trial version of the software that you have asked for.
• Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR), and when you test the software on behalf of a company - our legitimate interest, namely providing that company with a demo (Article 6(1)(f) GDPR). Data of invited colleagues - our legitimate interest: enabling you to test the software with your team (Article 6(1)(f) GDPR).
• How long: the demo runs for 30 days, then it is available read-only for 30 days, after which we delete it together with its database and files. The period is longer if we extend the demo at your request. Deleted data disappears from backups after 15 days at the latest - except for the archive copy from our previous server (see “Logs, security and backups”).
• Who has access: us, cyber_Folks (server and email) and Anthropic (AI features - described below).

To run the demo, we create a customer record (company, first and last name, email, phone) and a trial licence in the licence panel. We delete the customer record together with the demo, and we revoke the trial licence and unlink it from your data. Only technical data, e.g. the AI cost, remains in the demo register, without your data. Only the demo request is kept longer, for the period stated above.

The demo sends system emails (invitations, account activations, password resets, notifications) from our mailbox in the taskmanager.works domain, through the cyber_Folks mail server. The software does not keep copies of sent messages. We receive the data of invited colleagues from the person testing the demo. In the first email from the demo, we tell them who the controller is and give them a link to this policy.

If you buy a licence, we will transfer the data from the demo to your installation at your request. We delete the export file from our server no later than 30 days after it is prepared, and it disappears from backups after a further 8 days.

If you connect external services to the demo yourself, e.g. a mailbox, Google Calendar, n8n or another AI provider’s key, data will flow to those services on your instructions and under their rules. Push notifications are switched off by default in the demo. If you switch them on, the software sends notifications in encrypted form through your browser’s push server (e.g. Google, Mozilla, Apple) - its operator cannot see their content.

AI features in the demo version

The demo includes Task Manager’s AI features - among others the AI Assistant, AI Agent, Company Knowledge and AI in Automations - running on the Claude model from Anthropic, on our account and with a cost limit. Anthropic, including in the USA (see “Transfers outside the EEA”), receives what you enter in these features and the demo data needed to answer or carry out an instruction, e.g. tasks, users and messages, and, when you ask for an attachment to be summarised, its text. Once a day, when someone is using the demo, Company Knowledge automatically summarises new and changed tasks and conversations (except private conversations with AI), so that the AI features know your company’s context.

The history of conversations with AI and their results, e.g. summaries, stay in your demo and disappear together with it. Only the cost of AI queries, without their content, reaches our licence panel. We keep error messages, without the content of conversations, in server logs for up to 15 days.

Legal basis: Article 6(1)(b) GDPR - the AI features are part of the demo you ask for (for a demo for a company - Article 6(1)(f) GDPR). Do not enter sensitive data or real data of your customers in the demo.

Marketing communications

• Data: first name and email address or phone number - depending on the consent - as well as the wording and version of the consent and the dates it was given and withdrawn.
• Purpose: sending information about Task Manager news and offers by email or by phone, depending on what you agree to.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 398 ECL). Consent is voluntary - the demo works the same without it. We collect separate consents for email and for phone.
• How long: until you withdraw consent, but no longer than 3 years from your last contact with us. A phone number given only for phone calls with offers (without a request for a phone call) is deleted from the request when you withdraw that consent. After that, we keep only proof that consent was given and withdrawn (the version of the wording, the dates, a hash of the address or number) for 5 years - in case of an inspection or a dispute. Legal basis for keeping this proof: our obligation to demonstrate consent (Article 7(1) and Article 5(2) GDPR) and our legitimate interest in defending against claims (Article 6(1)(f) GDPR).
• Who has access: us and cyber_Folks (server and email). We alone are the sender of these communications - we do not pass data to other companies for their marketing.

You can withdraw consent at any time: with the “Unsubscribe” link in every email, by email to kontakt@taskmanager.pl or during a phone call. Withdrawal does not affect the lawfulness of messages sent before it.

Visit statistics without consent

We count page views of our websites without cookies, without an identifier and without any script in your browser. We only use the page requests that reach our server logs anyway. From them, we take: the page address (without parameters), utm campaign parameters, information on whether the address contained a Google or Facebook ad click identifier (without its value), the domain of the website you came from, and the page language.

• Purpose: to know which content and campaigns work.
• Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
• How long: page view statistics - 13 months; the server logs from which we count them - up to 15 days (see “Logs, security and backups”).
• Who has access: us and cyber_Folks (server).

We use browser information only to filter out bots. We do not store the IP address or browser information in the statistics, so they do not allow us to identify you, and we cannot find your page views in them at your request (Article 11 GDPR). You can object to this measurement (see “Right to object”).

Our own traffic measurement with analytics consent

• Data: a random visitor identifier and the latest campaign that brought you to the website (utm_source, utm_medium, utm_campaign), stored in your browser’s storage (tm-ruch). With each page view, the script sends to our server (taskmanager.works) this identifier and the latest campaign from browser storage, the page address (without parameters), utm campaign parameters, information on whether the address contained an ad click identifier (without its value), the domain of the website you came from, the page language and the device type (phone or computer). In our database, we record each of your page views with this identifier, the latest campaign and the time, so we can see your visit history.
• Purpose: to know how visitors move around the website, whether they come back and which campaigns brought them.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 399 ECL). Without consent, the identifier is not created and the script does not send page views - at most an instruction to delete the identifier from an earlier consent that has expired or been withdrawn.
• How long: the identifier in your browser - 13 months, after which we assign a new one and delete the visit history recorded with the previous identifier; visit history in our database - no longer than 13 months. When you withdraw consent, we delete the identifier from your browser and your visit history from our database. We do the same on your first visit after your consent has expired (12 months after your choice in the cookie banner).
• Who has access: us and cyber_Folks (server).

The deletion instruction waits in browser storage (tm-ruch-wycofanie) until our server confirms that it has carried it out - usually straight away, and if the server is temporarily unavailable, on your next visit.

In the process, the server receives your IP address and browser information. We use browser information only to filter out bots. We do not store the IP address in the statistics - to protect the server against floods of requests, we keep a hash of it, made with a random key that we change every day, for no longer than 2 hours. The full address is only in the server logs (up to 15 days, see “Logs, security and backups”).

Linking your visits to your demo request

• Data: the visitor identifier and the latest campaign from browser storage (tm-ruch), which we attach to the demo form. This lets us see your visit history and the campaign that brought you to us next to your company and email address.
• Purpose: to know which paths lead visitors to a request and which campaigns bring in contacts, and to prepare better for the conversation about the demo.
• Legal basis: your separate consent (Article 6(1)(a) GDPR and Article 399 ECL) - the “Linking to your request” toggle in the cookie settings. It works only together with analytics consent, because without it the identifier is not created.
• How long: until you withdraw consent, and no longer than the request is kept. When you withdraw consent - and also on your first visit after it has expired and when we assign a new identifier after 13 months - we remove the link from the request: the identifier and the campaign from earlier visits. Only the campaign parameters from the address of the page from which the form was sent then remain in the request. We do not link requests from the chat with the AI assistant to visit history.
• Who has access: us and cyber_Folks (server).

Google Analytics with analytics consent

• Data: identifiers in the _ga and _ga_5X7C45J918 cookies, page views and events (e.g. sending a form - without its content), the page address with parameters, the referring page, and browser and device data. Google also receives the IP address to determine your approximate location but, according to Google, does not store it.
• Purpose: statistics on visits and on the effectiveness of the website.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 399 ECL). Without consent, the Google script does not load at all. We always keep Google’s advertising signals switched off - we do not use Google Analytics for advertising.
• How long: cookies - up to 13 months from your last visit; data about individual visitors and events in Google Analytics - 2 months.
• Who has access: us, and Google Ireland Limited and Google LLC (USA) as our processor. We have switched off data sharing with Google for its own purposes.

You can withdraw analytics consent at any time: click “Cookies” in the page footer, switch off “Analytics” and select “Save choices”. This also switches off linking your visits to your request. After you withdraw consent, we delete our identifier and the Google Analytics cookies from your browser, and new data is no longer collected. Google Analytics deletes previously collected data after 2 months. Withdrawal does not affect the lawfulness of processing before it.

Customers: licences and updates

• Data: company name, tax identification number (NIP), the contact person’s first and last name, email, phone, licence number and parameters (installation domain, plan, number of users, validity), the licence key activation log (licence number, domain, software version - without the IP address) and the update download log (licence number, version, time and IP address of the server from which the package was downloaded).
• Purpose: performance of the licence agreement - issuing and replacing the licence key, checking the licence, providing updates, remotely revoking the licence if its terms are breached - as well as billing and protecting licences against abuse.
• Legal basis: the contract (Article 6(1)(b) GDPR), if you are a party to it; data of the contact person of a customer that is a company - our legitimate interest, namely performing the contract with that company (Article 6(1)(f) GDPR); tax and accounting obligations (Article 6(1)(c) GDPR); our legitimate interest - protecting licences and the security of our services (Article 6(1)(f) GDPR).
• How long: for the licence period stated on the invoice, and then until claims become time-barred (3 years, counted to the end of the calendar year). Accounting documents - 5 years from the end of the year in which the tax payment deadline passed. IP address in the download log - 90 days.
• Who has access: us and cyber_Folks (server).

The software installed on your server connects to our licence server at login and when it checks for updates. It then sends the licence key, the domain and the software version. We do not record these requests in a database - they are only visible in the server logs. The content you enter into the software on your own server does not reach us, unless you send us a message from the “Contact” form in the software (see “Email and telephone correspondence”). When the software runs for you on our server, we process the data in it on your behalf, under a data processing agreement.

Email and telephone correspondence

• Data: email address, first and last name, phone number, the content of the message and whatever you tell us during a call. Also messages sent from the “Contact” form in the software: first and last name, email, phone (if you provide it or have it in your profile in the software), licence number, licensee name and software version.
• Purpose: replying to you and handling your matter.
• Legal basis: our legitimate interest - replying to messages and phone calls (Article 6(1)(f) GDPR), and where the matter concerns a contract - concluding or performing it (Article 6(1)(b) GDPR).
• How long: up to 3 years from your last contact with us, and correspondence related to a contract - until claims become time-barred.
• Who has access: us and cyber_Folks (email).

Logs, security and backups

• Data: IP address, time, address of the requested page (with parameters), response code, referring page, browser and operating system; for login attempts to the licence panel - the login and IP address; for blocks by the server firewall - the IP address. To protect the form, we count requests by hashes of the IP address and email address.
• Purpose: security of the server and services, detecting abuse and errors, restoring data after a failure. We also calculate page view statistics from the web server logs (see “Visit statistics without consent”).
• Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
• How long: web server logs and the PHP error log - up to 15 days; failed login attempts to the licence panel - 24 hours; hashes used for form limits - up to 2 days; other technical and security logs, including alerts about failed logins - up to 2 months; database backups - up to 15 days, file backups - up to 8 days. Separately, we keep an archive copy of data from our previous server (cyber_Folks hosting in Poland), made in September 2026 when we moved our services to the current server - including the licence panel with demo requests and the demo versions of that time. We do not use it in our day-to-day work, only we have access to it, and we have not yet set a date for deleting it. If you ask us to delete your data, we will also delete it from this copy.
• Who has access: us and cyber_Folks (server), and during development and administration work also Anthropic (see “Development and administration work”).

Development and administration work

For development and administration work, we use the Claude Code tool from Anthropic, under a plan for individual users. When we diagnose an error or check how our services are working, fragments of data from our systems, e.g. from logs or from database query results, may be sent to Anthropic. We limit them to what is necessary, and we mask email addresses and phone numbers.

This plan operates under Anthropic’s terms for individual users: Anthropic processes the data fragments sent to it under its own rules, described in its terms of use and privacy policy, including in the USA. We have not concluded a data processing agreement with Anthropic for this tool. In our account settings, we have switched off the use of chats and coding sessions for training Anthropic’s models.

• Purpose: maintaining, fixing and developing our websites, software and server.
• Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
• How long: session records on our computer - up to 30 days; at Anthropic - according to the retention rules in its privacy policy.
• Who has access: us and Anthropic.

Customer testimonials

On the home page, we publish testimonials from two people who recommend Task Manager: their first and last name, job title, company and photo. We do this with their consent (Article 6(1)(a) GDPR) and on the basis of their permission to disseminate their image (Article 81(1) of the Polish Act on Copyright and Related Rights). If consent is withdrawn, we remove the testimonial from the website.

Establishing and defending legal claims

If a dispute arises, we may use the data needed to establish, exercise or defend legal claims - until the claims become time-barred. Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

AI assistant in blog articles

The Polish pages of taskmanager.pl offer a chat called “Asystent AI” - Task Manager’s AI assistant: in blog articles, on the pages about the software (Funkcje, Asystent AI, Use cases, W praktyce, Materiały) and on the home page. The conversation continues as you move between these pages. The assistant answers questions about the software solely on the basis of the materials published on our website, and we add each new article to its knowledge after publication. It may suggest trying the software and, at your request, helps you start a demo, ask us to call you or send a copy of the conversation to your e-mail address.

You are talking to an artificial intelligence system (the Claude model by Anthropic), not to a human. The assistant may make mistakes. Before making a decision, check important information, such as prices and licence terms, in the price list and the licence terms, or ask us.

What data we process in the chat

• Conversation content: your questions, the assistant’s answers and the page you are chatting on - in a blog article we record which article the question was asked on, and we do not record the addresses of other pages in the conversation. Before we save a question and send it to the AI model, we mask e-mail addresses, phone numbers, PESEL and NIP numbers, account numbers (IBAN), payment card, ID card and passport numbers, IP addresses, keys, passwords and tokens, as well as a first name given after phrases such as “my name is”. The window does not send messages containing an e-mail address or phone number and asks you to remove them. If the window misses something, the server saves the message in masked form and does not send it to the AI model.
• Conversation memory: information about your company that helps us tailor the answer, if you provide it: team size, industry, current tool, implementation date and your main concern. The AI model picks it up from the conversation, and we store it encrypted.
• Answer ratings: a thumbs up or down and a comment, if you add one. We mask the comment as well.
• Data from forms in the chat window: demo form - the same fields, consents and requests as the demo form on our website; call request - phone number, e-mail address, preferred time, consent to the call and your first name, if you provide it; conversation copy - e-mail address and consent to marketing communications, if you tick it. We do not send this data to the AI model. We store the first name, phone number and e-mail address from a call request encrypted with a key used only by our admin panel. Data from the demo form in the chat goes into a demo request, just as with the form on the website - the section “Demo form and contact about your request” then applies - and the chat database does not store it.
• Technical data: the conversation identifier, time and counters of questions and costs. In the chat database we store your IP address only as a cryptographic hash (HMAC) - also when you merely open the window, for limits that protect against abuse. The full IP address goes to the server logs (up to 15 days) and, if you send the demo form in the chat, to the demo request for 30 days, as with the form on the website.

The chat does not use our visitor identifier (tm-ruch) or Google Analytics. We do not link requests from the chat to your visit history.

Purposes, legal bases and retention periods

Who has access: us, cyber_Folks (server and e-mail) and Anthropic (see below).

Demo form in the chat

The assistant shows the demo form when you ask for it, when you accept its suggestion or when you click the demo shortcut above the message field. In a conversation it may suggest a demo once, in one sentence. After you decline, it does not suggest it again in that conversation and hides the shortcut. The form in the chat window has the same fields, consents and requests as the demo form on our website, and we handle a request sent from it in the same way as a request from the website. With the request we record that it came from the chat and the address of the last blog article you were chatting on - just as for the form on the website we record the page address.

Call and conversation copy

In the call request form you provide your phone number, e-mail address and preferred time (morning 9-12, afternoon 12-17 or any time) and, if you wish, your first name. We call back on working days between 9:00 and 17:00 (Polish time). We do not promise a specific day or time - we will call as soon as possible. The call request is your consent to that call about your matter (Article 398 ECL) - we record its text, version and time. We make further calls with offers only with separate consent. We receive an e-mail about a new request without your data - the contact details and the case summary are only in our panel.

We send the copy of the conversation only after you confirm your address: first you receive an e-mail with a link valid for 24 hours and, after you click “Potwierdzam” (I confirm) on the page opened from the link, the copy. The copy contains the text of the current conversation as we stored it (with masked data), without offers.

You can tick consent to marketing communications by e-mail in the conversation copy form. We record it as unconfirmed, and it applies only after you click “Potwierdzam” on the page opened from the link in the e-mail - we delete an unconfirmed consent after 24 hours. After confirmation, a request is created with your e-mail address, stored encrypted with our panel’s key. Proofs of consents given in the chat - to the call and to marketing communications (version of the text, time, hashes of the e-mail address and IP address) - are kept together with the request and, when we delete the request after its period expires, for a further 5 years in case of an inspection or a dispute (legal basis as for the proof of consent from the website form). When we delete your chat data at your request, we also delete these proofs.

Assessment of chat requests (profiling)

A demo or call request, and a request for a conversation copy with confirmed consent to marketing communications, receives an assessment: hot, warm or cold. Our server calculates it using fixed rules. It takes into account the type of request, the number of answers in the conversation, questions about the price or licence edition and the information in the conversation memory (team size, date, current tool, an unanswered concern), which the AI model picks up from the conversation. We store the assessment and its reasons with the request.

The AI model also prepares a case summary: a short summary of the need, team size, date and concerns - from the latest messages of the masked conversation, without your name, phone number or e-mail address. We store the summary encrypted together with the request, also after the conversation is deleted.

The assessment sets the order of requests on the list in our panel. A human decides whether and when we contact you. The assessment does not decide whether a demo is started, so it has no legal effects or similarly significant effects (Article 22 GDPR). You can object to the assessment - write to kontakt@taskmanager.pl.

Conversation review and report

We read conversations with the assistant in our panel to improve its answers, the articles on our website and the software itself. We see them as we stored them, that is with masked data. Once a week, and if needed also on our request, the AI model prepares a report on the conversations for us: what you ask about most often, what the software lacks, which answers need improvement and what is worth writing an article about. The model then receives masked questions and comments, excerpts of the assistant’s answers and figures, such as answer ratings and request types - without data from the forms in the chat, without the conversation identifier and without message times. We keep the report for 12 months. It is not used to assess or contact any particular person.

90 days after the last activity we delete the conversation, and its content stays in our database as an anonymous sample for improving the assistant: masked questions, the assistant’s answers, ratings and comments, the article next to which the question was asked and the month of the conversation - without the conversation identifier, IP address, conversation memory, data from the forms in the chat or any link to a request. We do not link samples to you and do not contact anyone on their basis. We delete them manually in our panel when they are no longer needed. A conversation deleted with the “Usuń rozmowę” command does not become a sample. Masking does not catch everything - if your question contains, for example, your surname or company name, write to us with the approximate time and topic of the conversation and we will delete such a sample.

What goes to Anthropic

Anthropic receives the masked conversation content, the conversation memory, the title of the page you are chatting on and the fragments of our materials needed for the answer. Before you see each answer, a second query to the AI model checks whether it matches our materials. Anthropic also receives the data for the case summary and the report (see above). We do not send data from the forms in the chat (first name, phone number, e-mail address or demo form fields), your IP address or data from your browser. Search in our materials runs on our server. Anthropic Ireland, Limited and Anthropic, PBC process this data on our behalf under a data processing addendum that is part of Anthropic’s commercial terms. The data is transferred to the USA on the basis of standard contractual clauses (Commission Decision (EU) 2021/914). According to Anthropic’s commercial terms, the company does not train models on it, and according to its retention rules it deletes it after 30 days - longer, up to 2 years, only if its safety system flags a breach of the usage policy.

Masking reduces the amount of personal data in a conversation but does not rule it out - for example, we do not mask surnames, company names or addresses typed into a question. Do not enter sensitive data (for example about health) or other people’s data in the chat.

Browser storage in the chat

Merely displaying the chat window does not store anything in your browser. With the first question or the first form sent in the window, entries necessary for the conversation to work are created (Article 399(3) ECL): the conversation session cookie tma_sesja, the tm-asystent marker in browser storage and the tm-asystent-stan window state in tab storage. The cookie and the marker expire 2 hours after the last activity, and the window state disappears when you close the tab. They are described in the table in the section “Cookies and browser storage”.

Bot protection (the ALTCHA computational task) runs in your browser and on our server, without cookies and without other companies’ services.

The “Usuń rozmowę” (Delete conversation) command in the “…” menu of the chat window immediately deletes the conversation record in our database - including earlier conversations from the same session - as well as the cookie and the entries in your browser. The conversation disappears from backups after 15 days at the latest, and at Anthropic according to its retention rules. The command works while the conversation is active (2 hours from the last activity). After that, ask for deletion by e-mail and give the approximate time and topic of the conversation. A request you have sent - for a demo, a call or a conversation copy with consent to marketing communications - remains together with the case summary so that we can handle it. Abuse protection counters (with the IP address hash) remain until the end of their period.

Your rights in the chat

You have all the rights described in the section “Your rights”, including the right to object to the conversation, its review, the use of the conversation in the report and in anonymous samples, and the assessment of the request (section “Right to object”). You delete the conversation with the “Usuń rozmowę” command in the “…” menu of the chat window, and you can ask for access to your data or deletion of a chat request at kontakt@taskmanager.pl. At the same address you can withdraw consent to the call and consent to marketing communications given in the chat - we will then delete the chat request to which the consent relates.

Who we share data with

We do not sell data. The companies in the table process it on our behalf, under data processing agreements. The exception is the Claude Code tool: Anthropic processes the data fragments sent through it under its own rules (see “Development and administration work”). Public authorities, e.g. a court, the public prosecutor or the tax office, receive data only where the law requires it.

Transfers outside the EEA

Data is transferred outside the European Economic Area - to the USA - in three cases:

• Google LLC - after you give analytics consent (Google Analytics 4). Basis: European Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework - Google LLC holds an active certification - and, in addition, the standard contractual clauses in Google’s data processing terms, which cover Google Analytics.
• Anthropic, PBC - when you talk to the AI assistant on our website and when you use the AI features in the demo version. Anthropic does not participate in the Data Privacy Framework, so the basis is the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) contained in Anthropic’s data processing addendum, which covers our API account. Under Anthropic’s commercial terms, the company does not train models on this data, and according to its retention rules it deletes data sent through the API after 30 days - longer, up to 2 years, only if its safety system flags a violation of its usage policy.
• Anthropic - when fragments of data from our systems reach it during our work with the Claude Code tool. This plan operates under Anthropic’s terms for individual users: Anthropic processes this data under its own rules, including in the USA, and it is not covered by our data processing agreement (see “Development and administration work”).

If you switch on push notifications or connect external services in the demo yourself, data will flow to the services you choose, including outside the EEA, under their rules.

We will send you a copy of the standard contractual clauses on request - write to kontakt@taskmanager.pl.

Cookies and browser storage

Our information websites, taskmanager.pl and taskmanager.works, do not set cookies themselves - the exceptions are the licence panel, which only we use, and the session cookie of the chat with the AI assistant (tma_sesja). They use browser storage (localStorage and sessionStorage), which is subject to the same rules as cookies. Cookies are set by Google Analytics - only with your consent - and, after you log in, by the demo version of the software.

Without consent, we store only what is necessary for the website to do what you ask (Article 399(3) ECL): your choice in the cookie banner, an instruction to delete data after you withdraw consent (until our server carries it out), the data for the thank-you page after you send the form and, in the chat with the AI assistant, the conversation session. For any other storage, we ask in the cookie banner: you give consent with the “Accept all” button or in “Settings” with the “Analytics” and “Linking to your request” toggles. We remember your choice for 12 months, after which we ask again. You can change your consent at any time using the “Cookies” link in the footer. We store your choice separately on taskmanager.pl and on taskmanager.works (language versions), so you change or withdraw consent given on one of these sites using the “Cookies” link on that same site. You can also block and delete cookies and site data in your browser settings - in that case some functions, e.g. remembering your choice in the banner, will not work.

We do not use advertising pixels (e.g. Meta), maps, embedded videos or fonts from external servers. Our server downloads the exchange rates for the calculator (European Central Bank reference rates) once a day - for this, your browser connects only to our server.

Your rights

You have the right:

• of access to your data and to receive a copy of it (Article 15 GDPR),
• to rectification of inaccurate or incomplete data (Article 16 GDPR),
• to erasure of data (Article 17 GDPR), e.g. when it is no longer needed, after you withdraw consent or after a successful objection - the only data we will not erase is data we must keep by law (e.g. invoices) or need in order to defend against claims,
• to restriction of processing (Article 18 GDPR), e.g. while the accuracy of the data is being checked or your objection is being considered,
• to data portability for data you provide to us, when we process it by automated means on the basis of consent or a contract (Article 20 GDPR),
• to object (Article 21 GDPR) - described in the section “Right to object”,
• to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3) GDPR),
• to lodge a complaint with a supervisory authority (Article 77 GDPR) - described in the section “Complaint to the supervisory authority”.

Send your request to kontakt@taskmanager.pl or by post. We will reply within one month. If the matter is complex, this period may be extended by a further 2 months - in that case we will tell you why within one month. Exercising your rights is free of charge; for further copies of your data we may charge a fee covering our costs. To avoid disclosing data to someone else, we may ask you to confirm your identity, e.g. with a message from the address given in the form.

Right to object

You may object at any time to the processing of your data that we base on our legitimate interest (Article 21(1) GDPR). This applies, among other things, to the data of a company’s contact person, the automated assessment of demo requests, the data of colleagues invited to the demo, visit statistics counted without consent, the conversation with the AI assistant, its review, the conversation report and the assessment of chat requests, licence protection, correspondence, development and administration work, and logs and protection against abuse. State the grounds relating to your particular situation. We will stop processing this data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

An objection to direct marketing is always effective and needs no justification (Article 21(2) and (3) GDPR). After such an objection, we stop sending you marketing communications.

You can object by email to kontakt@taskmanager.pl, preferably with the subject “Objection”, by phone on +48 606 704 195, and in the case of marketing communications also with the “Unsubscribe” link in every message.

Complaint to the supervisory authority

If you believe that we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also lodge a complaint with the supervisory authority of the EU country in which you live or work.

Security

Connections to the websites, the demo version and the licence server are encrypted (HTTPS). Only we have administrative access to the server, via SSH keys; for administration work we use the Claude Code tool (see “Development and administration work”). The licence panel is protected by an additional server-level password and a limit on login attempts, and backups are accessible only to the server administrator. If a personal data breach occurs that is likely to result in a high risk to your rights or freedoms, we will inform you without undue delay (Article 34 GDPR).

Changes to the policy

When we change the policy, we change the version date at the top of the page and add the change to the “Change history”. We will announce significant changes - a new purpose, a new recipient or a longer retention period - on this page before they take effect, and if a change requires consent, we will ask for it again, e.g. in the cookie banner.

Change history