Our Commitment to GDPR Compliance
Fruitask is fully committed to compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This page explains how Fruitask safeguards your personal data and respects your privacy rights under GDPR.
The GDPR is a comprehensive data protection regulation that applies to the processing of personal data of EU residents, regardless of where Fruitask is located. We treat all users' data with the same level of protection.
What is GDPR?
The General Data Protection Regulation (GDPR) is an EU regulation that governs how organizations process and protect personal data. It gives individuals greater control over their personal information and imposes obligations on organizations that handle such data.
Key GDPR Principles
- ✓ Lawfulness, fairness & transparency
- ✓ Data minimization
- ✓ Purpose limitation
- ✓ Accuracy
- ✓ Storage limitation
- ✓ Integrity & confidentiality
Your Rights
- ✓ Right to access
- ✓ Right to rectification
- ✓ Right to erasure
- ✓ Right to restrict processing
- ✓ Right to data portability
- ✓ Right to object
How Fruitask Complies with GDPR
1. Lawful Basis for Processing
We only process personal data when we have a lawful basis to do so:
- Consent: You explicitly consent to our data processing (e.g., signing up, accepting privacy policy)
- Contract: Processing is necessary to provide our services to you
- Legal Obligation: We must process data to comply with laws (e.g., tax requirements)
- Legitimate Interests: We process data for our legitimate business purposes (e.g., security, fraud prevention) while respecting your rights
2. Data Minimization
We collect only the minimum personal data necessary to provide our services:
- Name and email address for account authentication
- Workspace data that you explicitly create and enter
- Technical information required for security and platform operation
- Workspace content is never used for purposes beyond what you authorize
We do not use your data for marketing, profiling, or AI training without explicit consent.
3. Purpose Limitation
We use your data only for the purposes for which it was collected:
- To provide and maintain Fruitask services
- To authenticate your identity and secure your account
- To enable collaboration features
- To send service-related notifications
- To improve our platform (anonymized analytics only)
- To provide customer support
- To comply with legal obligations
4. Transparency & Consent
We are transparent about how we process your data:
- Clear privacy policy available before you sign up
- Explicit consent for non-essential processing (analytics, cookies)
- Easy opt-out options for non-essential communications
- Regular policy updates with advance notice
5. Data Security & Integrity
We implement technical and organizational measures to protect your data:
- HTTPS/TLS encryption for all data in transit
- bcrypt password hashing with strong salt rounds
- Role-based access control (Owner, Admin, Editor, Viewer)
- Two-factor authentication (2FA) support
- API key encryption and secure rotation
- Session management with device fingerprinting
- Rate limiting and DDoS protection
- Regular security audits and penetration testing
- Incident response procedures
6. Accountability & Record Keeping
We maintain records of our data processing activities:
- Data processing inventory and impact assessments
- Audit logs tracking user actions and system events
- Data processing agreements with our service providers
- Retention schedules for different types of data
Your Rights Under GDPR
GDPR grants you specific rights regarding your personal data. You can exercise these rights at any time by contacting us:
Right of Access (Article 15)
You have the right to request a copy of your personal data that we hold. We will provide this within 30 days of your request in a commonly used, machine-readable format (CSV/JSON).
Right of Rectification (Article 16)
You can request correction of inaccurate or incomplete personal data. You can also update your account information directly through your account settings.
Right to Erasure (Article 17) "Right to be Forgotten"
You can request deletion of your personal data, including your account. We will delete your data within 30 days, except where legally required to retain it (e.g., tax records). Workspace data can be permanently deleted or soft-deleted with automatic purge after 30 days.
Right to Restrict Processing (Article 18)
You can request that we limit how we use your data while you dispute its accuracy or legality of processing.
Right to Data Portability (Article 20)
You can request your personal data and workspace content in a structured, commonly used format to transfer to another service. We support CSV and JSON export.
Right to Object (Article 21)
You can object to processing based on legitimate interests. You can also opt out of analytics and marketing communications at any time.
Rights Related to Automated Decision Making (Article 22)
You have the right not to be subject to a decision based solely on automated processing that significantly affects you. Fruitask does not use automated profiling or decision-making for individual-level decisions.
How to Exercise Your Rights
To exercise any of these rights, contact us at privacy@fruitask.com with your request and sufficient information for us to identify you. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority if you believe your rights have been violated.
International Data Transfers
If you are located in the EU/EEA and your data is transferred outside these regions, Fruitask uses appropriate safeguards as required by GDPR:
- Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses with our service providers to ensure adequate protection
- Data Processing Agreements: Our service providers are bound by Data Processing Agreements (DPAs) that comply with GDPR
- Adequate Safeguards: We assess third-party service providers for adequate data protection measures
Our primary infrastructure is hosted within the EU, minimizing cross-border transfers.
Data Protection & Privacy Contacts
Privacy Inquiries & GDPR Requests
Email: privacy@fruitask.com
Response Time: Within 30 days (as required by GDPR)
Data Breach & Security Concerns
Email: security@fruitask.com
Response Time: Within 24 hours for urgent matters
Data Protection Authority
If you have concerns about our compliance, you have the right to lodge a complaint with your local data protection authority (e.g., CNIL in France, DPC in Ireland, etc.).
Special Categories of Data (Article 9)
Fruitask does not intentionally collect special categories of personal data (such as race, ethnicity, political opinions, religious beliefs, health data, or biometric data). If your workspace contains such sensitive information, you are responsible for implementing additional security measures and obtaining appropriate consent from affected individuals.
Recommendation: If you handle sensitive personal data, consider enabling additional encryption, restricting access to specific team members, and maintaining your own audit trail.
Data Retention Schedule
In compliance with GDPR's storage limitation principle, we retain data only as long as necessary:
| Data Type | Retention Period |
|---|---|
| Active Account Data | While account is active |
| Workspace Content | Until deletion by user; soft-deleted workspaces purged after 30 days |
| Account Deletion Request | Processed within 30 days; backups purged within 90 days |
| Audit Logs | 1 year (for security & compliance) |
| Analytics Data | Anonymized; aggregated data retained indefinitely |
| Tax/Legal Records | 7 years (as required by law) |
| Password Reset Tokens | 24 hours |
| Email Verification Tokens | Until email is verified (max 7 days) |
| 2FA Backup Codes | Until disabled by user |
Data Breach Notification
In compliance with GDPR Article 33, if we experience a data breach that poses a risk to your rights and freedoms, we will:
- Notify you without undue delay (typically within 72 hours)
- Describe the nature of the breach and data affected
- Explain the likely consequences
- Provide information on protective measures taken
- Provide our contact details for further inquiries
- Notify data protection authorities where required by law
Sub-Processors & Data Partners
Fruitask uses the following sub-processors to provide services (all with GDPR-compliant Data Processing Agreements):
Cloud Infrastructure
Hostinger with Docker orchestration panel (Europe) — for infrastructure and application deployment
Database
MongoDB — for data storage and management
Email Services
Hostinger / SMTP providers — for transactional emails
Analytics
Google Analytics (anonymized) — for usage statistics
Payment Processing
Paddle — for payment processing
Single Sign-On (SSO)
Google & GitHub OAuth — for optional social login
All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security measures. Contact us for a complete list of current sub-processors.
Fruitask's GDPR Compliance Commitment
Fruitask is fully committed to GDPR compliance. We understand that data privacy and protection are fundamental rights. Our compliance includes:
- Regular staff training on data protection and privacy
- Privacy-by-design principles built into our development process
- Data Protection Impact Assessments (DPIAs) for high-risk processing
- Regular security audits and vulnerability assessments
- Documented data processing procedures and retention schedules
- Transparent communication with users about data practices
- Prompt response to user requests and inquiries (within 30 days)
- Cooperation with data protection authorities when required
If you have any concerns about our GDPR compliance, please do not hesitate to contact us immediately.
Updates to This Policy
We may update this GDPR Compliance page to reflect changes in our practices or legal requirements. Significant changes will be communicated via email or a prominent notice on our platform. Your continued use of Fruitask constitutes acceptance of any changes.