Privacy policy

1. Who is responsible

Pact Manager is the brand name for this service. Dataweb Business Solutions is responsible for the personal information used to operate and secure it. Pact Manager is planned to become a subsidiary of Dataweb Business Solutions; this notice does not represent that subsidiary as already established.

For privacy enquiries or to exercise your data-protection rights, email privacy@pactmanager.com.

If your organisation uses PactManager to manage work involving other people, it may be responsible for deciding why and how that work information is used. Contact your organisation about its instructions and internal access arrangements. The applicable service agreement determines the respective controller and processor responsibilities.

2. Information we handle and why

• Account and authentication information: email address, provider account identifiers, sign-in and session information, authenticator and recovery records. We use these to create and protect accounts, verify identity, recover access and prevent abuse. Password authentication is handled through Supabase Auth; Google or Microsoft sign-in does not give PactManager your Google or Microsoft password.
• Work information: task titles, descriptions, status, deadlines, priorities, projects, company and category details, saved document links, preferences and activity records you create or update. We use this information to provide the work-management features you request.
• Delegation and notifications: recipient addresses, task details, delivery state and relevant preferences when you use supported delegation or reminder features. Recipients receive the information included in the message. Only provide other people’s information where you are authorised to do so.
• Connected email information: the connected address, provider account identifier, granted permissions and protected authorization credentials. These enable the specific email functions you choose, as explained below.
• Technical and security information: network information such as IP address, browser and device information, request timing, security-check results and operational records processed by our hosting and security providers. These support service delivery, fault investigation and abuse prevention.
• Support communications: information you provide when asking for help or exercising your privacy rights. Do not send passwords, authenticator codes, recovery codes or API secrets in a support request.

Where data-protection law requires a lawful basis, we use information as necessary to provide the service under our contract, for legitimate interests in operating and securing the service and responding to support requests, and to meet legal obligations. Where processing relies on consent, you can withdraw it. Permission granted through Google or Microsoft is also a technical access permission; it is not blanket consent for unrelated processing.

3. Google and Microsoft connections

Signing in and connecting email are separate choices. Signing in with Google or Microsoft establishes your identity. It does not, on its own, authorise mailbox access. Email connections require separate provider authorization and the permissions shown on the consent screen.

When you enable sending, PactManager uses the connected account to send messages you authorise, including supported task delegations. The provider receives the recipient addresses and message content needed to deliver them. A separate inbox permission is required for supported inbox access. The current inbox integration is limited to permission management and bounded message-reference access; it is not an automatic reader or analyser of message bodies.

PactManager stores connection metadata and encrypted authorization credentials so it can perform the authorised functions without asking for your provider password. Disconnecting a connection or revoking a permission stops future use of that access through the application. You can also revoke access in your Google or Microsoft account settings. Revoking access does not recall sent messages or automatically delete tasks, activity records or copies already held by recipients.

Saved document links are references, not permission to copy or crawl a drive. Work records are stored in Supabase, not in a Google Drive task database. Opening a saved link takes you to the external provider, whose access controls and privacy notice also apply.

Google API Limited Use: PactManager’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features you request. It is not sold, used for advertising, used to determine creditworthiness, or used to train general-purpose AI or machine-learning models. Human access to Google user data is limited to your affirmative agreement for specific information, necessary security investigations, legal requirements, or permitted aggregated and anonymised internal operations under that policy. Transfers are limited to those permitted by that policy, including necessary service delivery, security and legal purposes.

The current hosted Task Assistant does not send your task or mailbox content to a generative-AI service. Any future AI integration would require a separate explanation of the data involved and appropriate controls before activation.

4. Cookies and bot protection

The application uses essential cookies to maintain sign-in, complete provider redirects and protect authentication and recovery flows. They contain opaque selectors rather than task content and are marked Secure and HttpOnly. The application session cookie lasts up to 12 hours; temporary authentication, consent and recovery cookies last up to 5 or 10 minutes. A cookie’s lifetime does not guarantee that the corresponding session remains valid.

Cloudflare Turnstile helps distinguish legitimate visitors from automated abuse. It processes technical browser, device and network signals to perform that check. See Cloudflare’s privacy policy for its handling of that information. Blocking essential cookies or the security check may prevent sign-in.

The application does not use advertising cookies or persist your task content in browser local storage. Information currently displayed remains in browser memory while you use the page. This privacy-policy page does not load Turnstile, analytics or application scripts.

5. Service providers and sharing

• Cloudflare: application hosting, delivery, bot protection and storage of identity/session metadata and encrypted connection credentials.
• Supabase: authentication and storage of task-related work information.
• Brevo: transactional account, recovery and supported notification emails.
• Google and Microsoft: sign-in and the optional email functions you connect. Their own privacy notices also govern their services.
• People you choose: recipients of messages and work information you authorise the application to send.

We do not sell personal information or use it for targeted advertising. Information may also be disclosed where required by law or necessary to protect users and the service, subject to applicable law and any stricter provider-data restrictions.

Providers may process information in countries other than your own. Applicable contracts and legally required international-transfer safeguards must govern those transfers. This notice does not promise UK-only or EU-only processing. Contact us for details about the providers and safeguards relevant to your use of the service.

6. Retention and security

We retain account and work information for as long as needed to provide the service and meet applicable security, legal and operational requirements. There is no single retention period for every type of record. Available archive, retention and deletion controls apply only to the records and actions they describe. Archiving is not permanent deletion; disconnecting email is not account deletion.

Temporary authorization and recovery records expire according to their purpose. Backups, security records and delivery receipts may remain after a change or deletion in the live application. We do not promise immediate erasure of every backup or third-party copy. If you request deletion, we will explain applicable retention requirements and limitations.

Controls include encrypted network connections, server-side access checks, account separation, multi-factor authentication for protected operations and encryption of stored connection credentials. No online service can guarantee absolute security. Keep your sign-in and recovery information private and report suspected unauthorised access promptly.

7. Your choices and rights

You can review supported settings, edit work records and disconnect optional integrations. Depending on applicable law, you may have rights to access, correct, delete or receive a portable copy of your personal information, restrict processing, object to processing based on legitimate interests, or withdraw consent. These rights are subject to legal conditions and are not an unconditional right to delete other people’s records.

Use the privacy contact identified in section 1 to make a request. We may need to verify your identity before acting. If an organisation controls the relevant work information, we may need to direct the request to it or assist it under the applicable agreement.

You can complain to your local data-protection authority. In the UK, this is the Information Commissioner’s Office (ICO).

8. Changes to this notice

We will update this page when relevant practices change and show the date of the revised notice. Material changes will be brought to your attention as required by law. A policy update does not itself grant new access to a connected account.