Data subject rights

1. User rights

Pursuant to EU Regulation 2016/679 (GDPR) the user has the following rights over their personal data:

• Right of access (art. 15) — to know which data we hold and obtain a copy.
• Right of rectification (art. 16) — to correct inaccurate or incomplete data.
• Right to erasure "right to be forgotten" (art. 17) — to delete the account and all associated data.
• Right of restriction (art. 18) — to restrict processing in specific cases.
• Right to portability (art. 20) — to receive personal data in a structured, readable format.
• Right to object (art. 21) — to object to processing for legitimate purposes.
• Right not to be subject to automated decisions (art. 22) — including the right to request human intervention on suspension/ban decisions.
• Right to lodge a complaint with the supervisory authority (art. 77) — the data protection authority in the relevant EU country (e.g. the Italian Garante per la protezione dei dati personali, or the corresponding national authority in the relevant member state).

2. How to exercise rights — directly in the app

2.1 Access and portability

It is possible to download personal data using the built-in backup function:

• iOS: Settings → Backup → Export backup (AES-256 encrypted format with a password chosen by the user).
• Chat export: from the single chat, menu → Export chat (TXT file with history).

The backup contains messages, contacts, E2EE keys and optionally media. The format is documented to allow portability.

Live location routes are stored only on the devices: the server holds only an end-to-end encrypted copy, which it cannot read and which it deletes within 36 hours of the end of the sharing. For this reason they cannot be exported from the server. On request by email, we provide the data we hold in cleartext (for example profile, linked devices, transfer log, Taski Plus subscription status).

For Trusted contact, the list of trusted contacts and recent requests can be viewed in the app under Settings → Privacy → Who can see where you are, and requests appear in the chat (see the Privacy policy). The point sent in reply is end-to-end encrypted: the server cannot read it, so it cannot export it, and deletes it within 48 hours at the latest. On request by email, we provide the list of trusted contacts and the data of the requests from the last 30 days (who asked whom, when and with what outcome).

2.2 Rectification

• Profile: Settings → Profile (name, photo, status).
• Phone number: Settings → Change number.
• Privacy: Settings → Privacy (who can see last seen, photo, status; read receipts, etc.).

2.3 Erasure

• iPhone and Android: Settings → Account → Delete account, from the primary phone. Irreversible operation. For security reasons, deletion cannot be initiated from Web or Desktop.
• Phone lost or no longer available: it is possible to regain access to the account with a passkey, the anti-SIM-swap PIN or assisted recovery and then delete it, or to write to [email protected] (see sections 3 and 4).
• Deletion entails the removal of the associated data: profile, messages queued on the server, active public keys, contacts and synchronized contact list, sessions, live location stored on the server, trusted contacts and Trusted contact requests (in both directions), push tokens, Taski AI dedicated chat history.
• What remains, and why: (a) the entries in the public Key Transparency log (past public keys and related identifiers), which, to guarantee the security of all users, is append-only and cannot be modified (legitimate interest, Art. 17(3) GDPR); (b) Taski Plus transaction records, dissociated from the account, for fraud prevention, handling of refunds and legal obligations; (c) in the event of a ban, the blocked phone number, to prevent re-registration.
• Deleting the account does not cancel the Taski Plus subscription: it must be cancelled from the Apple ID settings.
• Live location routes received by other users remain on their devices until they delete them.
• Trusted contact requests and locations already received remain in the chats on other users' devices until they delete the chat.
• Messages already delivered to recipients remain on their devices (we cannot delete them from there, they are out of our control after delivery).

2.4 Objection and restriction

• TaskiAI: Settings → Privacy → TaskiAI → Disable.
• Contact list sync: Settings → Privacy → Permissions → Revoke contacts (iOS system Settings).
• Music status: Settings → Privacy → Music listening → Disable.
• Read receipts: Settings → Privacy → Read receipts → Disable.
• Notifications when Web is active: from the toggle at the top of the chat list.
• Live location: stop sharing from the chat at any time; delete routes from the chat profile → Routes; revoke location and motion permissions from the system settings.
• Trusted contact: revoke from the contact's profile ("Trusted contact" toggle) or from Settings → Privacy → Who can see where you are → Revoke; blocking the contact revokes trust in both directions; without the "Always" location permission the phone does not send its location. Request data on the server cannot be deleted individually from the app: it is deleted automatically after 30 days by the daily cleanup (within 31 days at the latest), or immediately when the account is deleted.
• TaskiAI memory: chat profile (or dedicated chat) → TaskiAI Memory → delete individual facts or everything.

3. Rights request form via email

For users who prefer to proceed via email or when the in-app function is not sufficient, requests can be sent to [email protected] including:

4. Identity verification

To protect users from fraudulent requests by third parties, before processing a request we must verify the identity:

• We will send a verification code via SMS to the registered number.
• For sensitive requests (deletion, full export) we may request a second element (e.g. screenshot of an active session).
• If no response is received within 30 days, the request will be closed for inactivity.

5. Response times

• Initial response: within 48 business hours of receipt.
• Request execution: within 30 days of identity verification (extendable to 60 days for complex requests, pursuant to art. 12.3 GDPR; in such case the user will be informed of the extension).
• Account deletion: immediate (in-app request) or within 7 days if via email (to allow possible cancellation).

6. Costs

The exercise of rights is free of charge. Pursuant to art. 12.5 GDPR, we may charge a reasonable fee or refuse the request only if it is manifestly unfounded or excessive (e.g. repeated).

7. Complaint to the supervisory authority

The user has the right to lodge a complaint with the competent supervisory authority in their country of residence. The relevant authority depends on the country of residence within the EU. Below are some examples; for a complete list see the European Data Protection Board.

For residents in other EU countries, see the list of national authorities maintained by the European Data Protection Board: edpb.europa.eu/about-edpb/members.

For general informational purposes, residents in the United Kingdom may refer to the Information Commissioner's Office (ICO), and residents in the United States may refer to the Federal Trade Commission (FTC) for consumer-protection matters. Note that Taski is established in the EU and is primarily subject to the GDPR.

8. Automated decisions (suspensions and bans)

Suspension decisions (7-day soft ban) and permanent ban are made by an automated system (Llama Guard 3 + Claude Haiku 4.5) with potentially significant legal consequences. The user has the right to:

• Human intervention: request manual review of an automatic decision.
• Express their point of view and obtain explanations on the logic of the decision (category of violation, applied thresholds).
• Challenge the decision by writing to [email protected] with the account ID.

These automated decisions are based on the need to ensure the security of the service and its users (legitimate interest, Art. 6(1)(f) GDPR) and are accompanied by the safeguards under Art. 22(3) GDPR: multiple category-specific activation thresholds, human review upon request, and the right to appeal. The permanent ban reserved for the most serious cases is confirmed by human intervention before becoming final.

For details on the moderation system see the Acceptable use policy.

9. Language of communication

Requests can be submitted in Italian, English, Spanish or German. We will reply in the same language whenever possible.

10. Contact