1. Introduction and Scope
This Privacy Policy explains how Zenstack Private Limited ("Zenstack", "Airtask", "we", "us" or "our"), a company incorporated under the Companies Act, 2013 with its registered office at [Registered Office Address], collects, uses, shares and protects personal data when you use the Airtask suite (the "Service").
The Service includes the Dashboard, My Tasks, All Tasks, Projects, Sprint Management, Kanban, List and Calendar views, the Standup module, time and effort tracking, Billing & Cost Management, Workflow Automation, Reports, Project Configuration, Organization-Level Governance and integrations such as Jira Sync.
This Policy applies to:
- Customers — organizations that subscribe to the Service, and their administrators.
- Users — employees, contractors, guests and other individuals invited by a Customer to use the Service.
- Visitors — individuals who visit our websites, request demos or contact us.
We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it (the "DPDP Act"), the Information Technology Act, 2000 and the rules made under it, and, where applicable, the EU and UK General Data Protection Regulation ("GDPR") and other applicable data protection laws.
By using the Service, you acknowledge that you have read this Policy. Where we rely on consent, we will request it separately and clearly.
2. Definitions
| Term | Meaning |
|---|---|
| Personal Data | Any data about an individual who is identifiable by or in relation to such data. |
| Customer Data | All data, including Personal Data, that a Customer or its Users submit to the Service — for example projects, tasks, epics, bugs, comments, attachments, time logs, standup notes, billing rates and custom fields. |
| Data Principal | The individual to whom Personal Data relates (a "data subject" under GDPR). |
| Data Fiduciary | The person who determines the purpose and means of processing Personal Data (a "controller" under GDPR). |
| Data Processor | A person who processes Personal Data on behalf of a Data Fiduciary (a "processor" under GDPR). |
| Sub-processor | A third party engaged by Zenstack to process Customer Data on its behalf. |
| Account Data | Information needed to create and manage a Customer or User account, such as name, work email, role and login credentials. |
| Usage Data | Technical and interaction data generated when the Service is accessed, such as IP address, device and browser details, logs and feature usage. |
3. Information We Collect
We collect only the Personal Data needed to provide, secure and improve the Service.
| Category | Examples | Source |
|---|---|---|
| Account and profile data | Name, work email, phone number, designation, team, profile photo, password (stored hashed), organization name | You or your Customer administrator |
| Project and task content | Project names, keys, descriptions, epics, tasks, bugs, summaries, descriptions, comments, attachments, tags, story points, estimates, custom fields, priorities, statuses, start and due dates | Users, as they create and edit work |
| Role and access data | Project role (Owner, Member, Guest, custom roles), assignee, reviewer and reporter assignments, private or public project membership, permission settings | Customer administrators and Project Owners |
| Time and effort data | Time logs per task, duration, start time, comments on logs, timesheet entries and compliance status, logged and billable hours | Users, and other Airtask modules where the Customer enables them |
| Standup data | Daily progress notes, work logs, task updates, status changes, saved, downloaded or shared standup summaries | Users during standups |
| Billing and costing data | Billing models (Fixed, Hourly, Mixed, Non-Billable), per-person or per-designation rates, currency, cost incurred, resource and sprint cost, invoices | Customer administrators; calculated by the Service |
| Activity history | Audit and activity trails of who changed what and when, such as status transitions and reassignments | Generated by the Service |
| Integration data | Jira projects, issues, statuses, users and properties synchronized through Jira Sync; integration credentials or tokens | Third-party tools the Customer connects |
| Notification data | Email notification preferences and delivery records for events such as task assigned, status changed, commented, due date approaching or exceeded, and task closed | Project configuration; generated by the Service |
| Usage and device data | IP address, browser and device type, operating system, time zone, pages and features used, session and error logs | Automatically, through cookies and similar technologies |
| Commercial and payment data | Subscription plan, billing contact, GST number, invoices, transaction references | Customer; payment processors (we do not store full card details) |
| Communications | Support requests, feedback, survey responses, demo and sales enquiries | You |
| Monitoring Module data | Automatic and manual screenshots; time spent on applications, files, folders and websites visible on screen; screen-on and screen-off time; device identifiers; IP address | Collected by an agent installed on the User’s device, in visible mode or, where the Customer chooses and applicable law permits, stealth mode, as configured by the Customer |
We do not intentionally collect sensitive personal data such as health, biometric, financial account or religious information through the Service. Please do not include such data in tasks, comments or attachments unless your organization has a lawful basis to do so.
4. How We Use Information and Legal Bases
We use Personal Data only for the purposes below. We do not sell Personal Data, and we do not use Customer Data for advertising.
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the Service | Create accounts, host projects and tasks, render Dashboard, Kanban, List and Calendar views, run sprints and standups, calculate billing and costs | Performance of contract; Customer instructions; legitimate use under Section 7 of the DPDP Act |
| Automate workflows | Recurring sprint creation, auto-completion of expired sprints, carry-forward of incomplete tasks, status transitions, auto-assignee and auto-reviewer rules | Performance of contract; Customer instructions |
| Notifications | Email alerts on assignment, status change, comments, due dates and closure, as configured per project | Performance of contract; Customer instructions |
| Reporting and analytics for Customers | Project, sprint, task, resource, billing, time log, and activity and cost reports | Customer instructions |
| Integrations | Synchronizing data with Jira in the direction the Customer configures | Customer instructions |
| Support and communication | Respond to tickets, send service and security notices, onboarding guidance | Performance of contract; legitimate interests |
| Security and fraud prevention | Authentication, access control, abuse detection, logging, incident response | Legal obligation; legitimate interests |
| Improve the Service | Aggregated and de-identified analysis of feature usage, performance and errors | Legitimate interests; consent where required |
| Marketing | Product updates, newsletters and event invitations to business contacts | Consent, which you can withdraw at any time |
| Legal compliance | Tax and accounting records, responding to lawful requests, enforcing our Terms | Legal obligation |
AI-assisted features. Where we offer AI-assisted features, we process Customer Data only to deliver the requested output to that Customer. We do not use Customer Data to train generalized AI models without the Customer's prior written consent.
5. Customer Data and Our Role
The Customer decides whether to enable the Monitoring Modules, which mode to use, what is captured and for how long, and must tell its Users before enabling them.
For Customer Data, the Customer is the Data Fiduciary (controller) and Zenstack is the Data Processor. We process Customer Data only on the Customer's documented instructions, as set out in our Terms and any Data Processing Agreement ("DPA").
This means:
- The Customer decides which Users are invited, which projects are public or private, who is a Project Owner, Member or Guest, and what data is entered.
- The Customer is responsible for giving notice to, and obtaining any consent from, its employees and contractors whose data is processed in the Service, including time logs, timesheet compliance and effort reports.
- Customer administrators can view, edit, export, archive and delete Customer Data, and may have access to Users' tasks, time logs, standup records and activity history according to the permissions they configure.
- If you are a User and want to exercise your rights over Customer Data, please contact your organization first. If you contact us, we will forward your request to the relevant Customer.
Zenstack acts as an independent Data Fiduciary (controller) for Account Data needed to run our business relationship, Usage Data, commercial and payment data, website and marketing data, and support communications.
6. How We Share Information
We share Personal Data only in the situations below, and only to the extent necessary.
- Within your organization. Information you enter is visible to other Users according to project visibility and roles. In public projects, workspace members can view tasks; in private projects, only the owner, explicit members, workspace admins and the task's reporter can view or edit. Guests have view-only access. Standup summaries you download or share are visible to the recipients you choose.
- Sub-processors. We use trusted service providers for cloud hosting, data storage, email delivery, customer support, analytics, error monitoring and payment processing. They are bound by written contracts requiring confidentiality, security and processing only on our instructions. A current list is available at [Sub-processor List URL], and we will give Customers prior notice of new Sub-processors.
- Integrations you enable. When a Customer enables Jira Sync or another integration, data flows to and from that third-party service in the direction configured (unidirectional or bidirectional). The third party's own terms and privacy policy govern its handling of that data. Jira Sync is currently an Alpha feature.
- Other Airtask modules. If your organization uses other Airtask modules (for example timesheets, attendance or activity tracking), data may be shared between modules within the Customer's account to deliver combined features such as activity and cost reports.
- Legal requirements. We may disclose data when required by law, court order or a lawful request from a government authority, or to protect the rights, property or safety of Zenstack, our Customers or others.
- Business transfers. In a merger, acquisition, restructuring or sale of assets, data may be transferred to the successor entity, which will remain bound by this Policy or provide equivalent protection.
- With your consent. In any other case, only with your consent or the Customer's instruction.
7. International Transfers, Retention and Deletion
Where data is stored. Customer Data is hosted on servers located in [India / Region], unless a Customer selects or agrees to another hosting region. Some Sub-processors may process data outside India.
Cross-border transfers. We transfer Personal Data outside India only to countries not restricted by the Government of India under the DPDP Act. For data subject to GDPR, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Retention. We keep Personal Data only as long as needed for the purposes in this Policy:
| Data | Retention period |
|---|---|
| Customer Data | For the subscription term, then deleted or returned within [30/60/90] days of termination, unless the Customer requests earlier deletion |
| Archived projects and tasks | Retained historically and hidden from operational views until the Customer deletes them or the subscription ends |
| Projects marked "To Be Deleted" | Permanently removed once a Customer administrator completes manual deletion; removed from backups within [30] days |
| Account Data | For the life of the account, then up to [12] months for support and dispute purposes |
| Usage and security logs | Up to [12] months, unless needed longer to investigate an incident |
| Invoices and tax records | As required by Indian tax and company law, generally 8 years |
| Marketing data | Until you unsubscribe or withdraw consent |
When the purpose ends and the law no longer requires us to keep data, we delete it or irreversibly de-identify it.
8. Security and Breach Notification
We apply reasonable security practices and procedures, including those described under the Information Technology Act, 2000 and the DPDP Act, to protect Personal Data.
Our safeguards include:
- Encryption of data in transit (TLS) and at rest.
- Role-based access control at organization and project levels, including private projects and view-only Guest roles.
- Hashed passwords and support for strong authentication.
- Activity history and audit logs of changes to tasks and projects.
- Restricted, need-to-know access for Zenstack staff, bound by confidentiality obligations.
- Regular backups, vulnerability assessments and monitoring.
No system is completely secure. Customers are responsible for managing User access, keeping credentials confidential and configuring project permissions appropriately.
Personal data breach. If we become aware of a breach affecting Personal Data, we will notify affected Customers without undue delay, and the Data Protection Board of India, CERT-In and affected Data Principals where required by law, with the information needed to respond.
9. Your Rights, Children and Cookies
Your rights. Subject to applicable law, you have the right to:
- Access a summary of the Personal Data we process about you and the processing activities.
- Correct, complete or update inaccurate or incomplete Personal Data.
- Erase Personal Data that is no longer necessary, unless retention is required by law.
- Withdraw consent at any time, without affecting processing done before withdrawal.
- Nominate another individual to exercise your rights in the event of death or incapacity.
- Seek grievance redressal from us, and then escalate to the Data Protection Board of India.
- Where GDPR applies, also object to or restrict processing, request data portability, and complain to your local supervisory authority.
To exercise these rights, email [[email protected]]. We will verify your identity and respond within the time required by law. Requests about Customer Data will be handled together with, or forwarded to, the relevant Customer.
Children. The Service is designed for businesses and is not directed at individuals under 18. We do not knowingly collect Personal Data from children. If you believe a child's data has been provided to us, contact us and we will delete it.
Cookies. We use essential cookies to keep you signed in and secure the Service, and, with your consent where required, analytics cookies to understand usage. You can manage cookies through your browser settings or our cookie banner. Disabling essential cookies may stop parts of the Service from working.
10. Grievance Officer, Changes and Contact
Grievance Officer. In accordance with the Information Technology Act, 2000 and the DPDP Act, our Grievance Officer is:
| Field | Details |
|---|---|
| Name | [Name] |
| Designation | [Designation] |
| [[email protected]] | |
| Address | Zenstack Private Limited, [Registered Office Address] |
We will acknowledge grievances within 24 hours and resolve them within 15 days, or sooner if required by law.
Changes to this Policy. We may update this Policy to reflect changes in the Service or the law. We will post the updated version with a new "Last updated" date and, for material changes, notify Customer administrators by email or in-product notice at least [30] days before they take effect.
Contact. For any questions about this Policy, write to [[email protected]] or Zenstack Private Limited, [Registered Office Address].