Data Processing Addendum
Last updated: October 18, 2026
This addendum describes how we handle the data your organization puts into KyroTask. It is written to be read, not to be survived — every claim in it matches what the product actually does, and the mechanisms behind those claims are described on our security page.
1. Roles
For the content you and your team put into KyroTask — tasks, comments, files, time logs, client records — you are the controller and KyroTask is the processor. For the small amount of data we need to run the service itself (your account, billing records, security logs) we are the controller. This addendum covers the first case.
2. Subject matter and duration
We process your content only to provide the service you signed up for, for as long as your organization exists. When it is deleted, the retention periods published on our security page apply: a deleted organization is held for 30 days so it can be restored, then permanently removed.
3. Our instructions
We act only on your documented instructions, which are the actions you take in the product and any written request you send us. We do not use your content to train models, we do not sell it, and we do not share it with anyone other than the sub-processors listed on our security page.
4. Categories of data and data subjects
Data subjects: your team members and the client contacts you invite to the portal. Categories: name, email address, profile image URL, work content (task titles and descriptions, comments, attachments), time entries, and for administrative actions the IP address the action came from. Portal visitors and QR scanners are handled more narrowly — a QR scan never stores an IP address or a raw browser identity.
5. Security measures
The technical measures are described in plain terms on our security page, and every claim there is a statement about code that ships today: encryption in transit, secrets and uploaded files encrypted at rest, hashed credentials, a single authorization service, optional two-factor authentication with an organization-wide policy, rate limiting, and outbound SSRF protection. We do not claim a certification we do not hold.
6. Sub-processors
The current list, with what each one is used for and where it is located, is published on our security page. We give notice before adding a new sub-processor that handles your content, so that you can object.
7. Data subject requests
Most requests you can answer yourself: any account can export its own data, an owner can export the whole organization as one file, and removing a member or an organization is a self-service action. Where you need us, we help within the time the law gives you, at no charge for reasonable volumes.
8. Personal data breach
If we become aware of a breach affecting your content we tell you without undue delay and, where feasible, within 72 hours — with what we know, what we are doing, and what we recommend. We do not wait for the picture to be complete before telling you it happened.
9. International transfers
The application, its database and your files are hosted in France, inside the EU. Some sub-processors operate globally; where they process personal data outside the EEA they do so under the European Commission standard contractual clauses or an equivalent mechanism.
10. Return and deletion
You can take your data with you at any time, without asking us: the organization export produces a single machine-readable file of everything the organization holds. On termination, content is deleted according to the retention table on the security page.
11. Audits
We answer a reasonable security questionnaire and share the information behind the claims on our security page. We are a small team and we do not host on-site audits; if your policy requires one, tell us before you sign so that neither of us is surprised.
12. Signing this
This addendum applies to your use of KyroTask as published. If your organization needs it signed as a separate document, or needs the standard contractual clauses attached, write to us and we will send a copy for signature.
Questions about this addendum, or a copy for signature: [email protected].