Data processing agreement

This data processing agreement (“DPA”) forms part of the Terms of service between BB Dev Ltd (“we”, the processor) and a business customer using the hosted Taskr service (“you”, the controller). It applies when we process personal data in your workspace content on your behalf.

You accept it by using Taskr for a business. If you would like a copy signed by both of us, email contact@bbdev.app and we will send one with the details in Annex 1 filled in.

It does not apply to account data we control ourselves (for example the email address a person signs in with); the Privacy policy covers that. It does not apply to individuals using Taskr for themselves, where we are the controller.

1. Definitions

Words such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the UK GDPR. Data protection law means the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations, as amended or replaced. Customer personal data means personal data in your workspace content that we process for you. Subprocessor means another processor we engage.

2. Roles and instructions

2.1 You are the controller and we are the processor of customer personal data.

2.2 We process customer personal data only on your documented instructions. Your instructions are these terms, this DPA, and what you and your users do in Taskr: the settings you choose, the integrations, AI features and remote agents you turn on, and the requests you or your agents make. If the law requires us to process it otherwise, we will tell you first unless the law forbids it.

2.3 We will tell you if we think an instruction breaks data protection law.

2.4 You are responsible for having a lawful basis for the personal data you put into Taskr, for the instructions you give, and for telling the people concerned what they need to know.

2.5 Annex 1 describes the processing.

3. Confidentiality

Everyone at BB Dev who can access customer personal data is bound by a duty of confidentiality and accesses it only as needed to run, secure and support the service, or when you ask us to.

4. Security

4.1 We keep appropriate technical and organisational measures to protect customer personal data, as required by Article 32. Annex 2 describes them.

4.2 We may change the measures, as long as the overall level of protection does not go down.

5. Subprocessors

5.1 You give us general authorisation to use subprocessors. The current list is on the Subprocessors page and in Annex 3.

5.2 We will tell you at least [[TO CONFIRM: 30 days]] before adding or replacing a subprocessor, by updating that page and emailing workspace owners who have asked to be told [[TO CONFIRM: a way to subscribe to subprocessor changes]].

5.3 You may object on reasonable data protection grounds within that period. We will discuss it in good faith. If we cannot resolve it, you may end the affected paid plan and we will refund any fees paid for the time after it ends.

5.4 We impose data protection terms on each subprocessor that are no less protective than this DPA, as far as relevant to its service, and we remain responsible to you for its performance.

5.5 Services you connect yourself (for example a webhook endpoint, your own OpenRouter key, or remote agents that run under your own Anthropic key and agreement) are not our subprocessors. We send data to them on your instruction.

6. International transfers

Customer personal data is stored in the United Kingdom. Some subprocessors process it outside the UK (Annex 3). We transfer it only with a safeguard allowed by UK data protection law: an adequacy regulation (including the UK Extension to the EU–US Data Privacy Framework for certified companies), the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses [[TO CONFIRM: the mechanism for each subprocessor]].

7. Helping you with people’s rights

7.1 Taskr has tools you can use to answer requests from the people whose data is in your workspace: editing and deleting content, and exporting the whole workspace (Settings → Workspace → Export data). [[TO CONFIRM: personal data export and account deletion, once they land]]

7.2 If a person contacts us directly about customer personal data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to.

7.3 Where the tools are not enough, we will help you as far as reasonably possible. [[TO CONFIRM: whether we charge for help beyond the tools]]

8. Personal data breaches

8.1 We will tell you without undue delay, and in any case within [[TO CONFIRM: 48 hours]], after becoming aware of a personal data breach affecting customer personal data.

8.2 We will give you the information you need to meet your own duties (Article 33(3)) as it becomes available: what happened, the categories and approximate numbers of people and records, the likely consequences, and what we have done or will do.

8.3 We will take reasonable steps to contain and fix the breach, and help you notify the ICO and the people affected where you need to. Telling you of a breach is not an admission of fault.

9. Impact assessments

We will give you reasonable help with data protection impact assessments and prior consultation with the ICO that relate to Taskr, taking into account the information available to us.

10. Deletion and return

10.1 You can export your workspace at any time while your account is active.

10.2 When our agreement ends, or when you delete a workspace, we delete customer personal data in that workspace [[TO CONFIRM: after the 30-day grace period for workspace deletion, once it lands]], unless the law requires us to keep it. Copies in backups are deleted when the backups expire [[TO CONFIRM: backup retention]], and are protected until then.

11. Audits and information

11.1 We will make available the information reasonably needed to show that we comply with Article 28, including answering reasonable security questionnaires.

11.2 If that is not enough, you (or an independent auditor bound by confidentiality) may audit us once a year, on at least 30 days’ written notice, during business hours, at your cost, in a way that does not disrupt the service or breach our duties to other customers. Remote audits are preferred.

12. Liability

Each party’s liability under this DPA is subject to the limits in the Terms of service [[TO CONFIRM: whether a separate cap applies to data protection claims]].

13. Order of precedence

If this DPA conflicts with the Terms of service about customer personal data, this DPA wins.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

[[TO CONFIRM: reconcile with docs/legal/security-measures.md when it lands]]

Access control

• Sign-in with one-time email codes (hashed, 10 minutes, limited attempts) or GitHub. No passwords. [[TO CONFIRM: no two-factor authentication or single sign-on yet]]
• Every action is checked against the person’s role, the OAuth scopes granted to an agent, and workspace and team visibility. Agents act with no more access than the person behind them.
• API keys and OAuth tokens we issue are stored hashed; sessions expire after 30 days of inactivity; any session or key can be revoked.
• Production access is limited to the people at BB Dev who run the service.

Encryption

• HTTPS for all traffic; HSTS on our hosts.
• Credentials you give us for other services are encrypted at rest with AES-256-GCM using per-secret keys wrapped by a master key held outside the database.
• [[TO CONFIRM: whether the server's disks and backups are encrypted at rest]]

Separation

• Every workspace record carries its workspace id, and every query is scoped to it.
• Remote agents and sandboxes run in isolated environments with an egress allowlist; your keys never enter the sandbox.

Input and AI controls

• Text from issues, comments and pull requests is treated as untrusted when it reaches an agent or model, and is kept apart from instructions.
• Secrets and email addresses are scrubbed before text is sent to AI models; only zero data retention endpoints are used for Taskr’s own AI features; an “EU only” option is available.

Logging and monitoring

• Every change records the person, agent and credential; security-relevant actions are written to an audit log.
• Rate limits on sign-in, the API and real-time connections.

Network

• Traffic reaches the server through a Cloudflare Tunnel; no ports are open to the internet for the app [[TO CONFIRM]].

Availability and recovery

• [[TO CONFIRM: database backups (documented as nightly pg_dump copied off the server; not yet automated in code), how long they are kept, and restore testing]]

Organisation

• A written breach procedure and data subject request procedure.
• Subprocessors are bound by written data protection terms.

Annex 3: Subprocessors

The list on the Subprocessors page, as updated under section 5.