Privacy
Policy.

We collect information you provide directly and information generated automatically as you use the service.

We do not collect sensitive personal data such as health information, financial account numbers, or government-issued identifiers.

Every piece of data we hold has a specific, documented purpose. We do not use data for purposes incompatible with those listed below.

• —Providing, maintaining, and improving the Real Task Manager service
• —Processing payments and managing your subscription
• —Sending transactional emails (receipts, password resets, workspace invitations)
• —Sending product updates and newsletters — only if you opt in
• —Analysing aggregate usage patterns to prioritise product development
• —Detecting and preventing fraud, abuse, and security incidents
• —Complying with legal obligations under applicable law

We share data only in the following circumstances:

• —With service providers who process data on our behalf (e.g. cloud hosting, payment processing) — bound by strict data processing agreements
• —With workspace members you collaborate with — only the data they need to see to work with you
• —With law enforcement or regulators when required by a valid legal process
• —With a successor entity in the event of a merger or acquisition — you will be notified in advance

We currently use the following sub-processors: AWS (cloud infrastructure), Stripe (payments), Postmark (transactional email), and Datadog (error monitoring). A complete, up-to-date list is available at privacy@oataristudios.com.

We keep your data for as long as your account is active. When you delete your account:

• —Your profile and workspace content are deleted within 30 days
• —Backups containing your data are purged within 90 days
• —Billing records are retained for 7 years as required by financial regulations
• —Aggregated, anonymised analytics data may be retained indefinitely

You can export all of your data at any time from Settings → Data Export before closing your account.

Depending on your location, you may have the following rights under GDPR, CCPA, or other applicable privacy law:

• —Access — request a copy of all personal data we hold about you
• —Rectification — correct inaccurate or incomplete data
• —Erasure — request deletion of your personal data ("right to be forgotten")
• —Portability — receive your data in a structured, machine-readable format
• —Restriction — ask us to limit how we process your data
• —Objection — object to processing based on legitimate interests
• —Withdraw consent — where processing is based on consent, withdraw it at any time

We take a defence-in-depth approach to protecting your data:

• —All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• —Access to production systems is limited to authorised engineers via multi-factor authentication
• —We conduct annual penetration tests and maintain a responsible disclosure programme
• —Security incidents are logged, investigated, and reported to affected users within 72 hours

No system is perfectly immune to attack. If you discover a security vulnerability, please report it to security@oataristudios.com. We take all reports seriously and respond within 48 hours.

We use a small number of cookies, all of which are necessary for the service to function or have been consented to by you.

You can manage cookie preferences at any time from the cookie banner or from Settings → Privacy.

Oatari Studios is the data controller for all personal data processed through the Real Task Manager service.

We are registered in the United Kingdom. Our registered address is available upon request. If you are located in the European Economic Area and believe we have not addressed your concern, you have the right to lodge a complaint with your local supervisory authority.