Privacy Policy

Effective date: 1-Sep-2026
Last updated: 1-Sep-2026

This Privacy Policy explains how DeccanLogic Private Limited ("DeccanLogic", "we", "us"), a company incorporated in India with its registered office at B-405, City Vista, Fountain Road, Kharadi, Pune-411014, Maharashtra, India, handles personal data in connection with TaskStudio — our desktop application, connectors, hosted services and website at https://taskstudio.in.

It should be read together with our Terms of Service.

1. The short version

TaskStudio is unusual among SaaS products in one important respect, and it shapes this entire policy:

TaskStudio runs on your own computer. Your credentials and your business data stay there.

There are three distinct things involved, and it is worth separating them:

Alongside the structure, we receive run statistics — how often a task ran, how long it took, whether it succeeded, and error diagnostics.

Put plainly: we can see that you built a task with five steps that posts a job to a job board, that one step takes a job title and a salary range, and that it ran 40 times last week with two failures. We cannot see the job titles or salaries you entered, the candidates who applied, or the account you posted them from.

Beyond that, in plain terms:

• We collect account and billing information so we can provide and bill for the Service.
• We collect operational and diagnostic telemetry so the product works and we can fix it when it doesn't.
• We use third-party AI providers for features that interpret your instructions — and they are contractually barred from training on your content.
• We do not sell personal data, and we do not use your business content for advertising.

2. Where the Service is offered

TaskStudio is offered to businesses in India and in international markets outside the European Economic Area, the United Kingdom and Switzerland.

We do not currently offer or market the Service to businesses or individuals located in the European Economic Area, the United Kingdom or Switzerland. Our pricing, marketing, sign-up flows and support are not directed at those regions, and we do not currently maintain the representative arrangements or transfer mechanisms that serving those markets would require.

If you are located in one of those regions and want to use TaskStudio, please write to us at info@deccanlogic.com. We will tell you when the Service becomes available in your region, and in the meantime we may be able to discuss arrangements for specific business customers on an individual basis.

If you access the Service from one of those regions despite the above, you do so on your own initiative, and you remain responsible for your own compliance with the law applicable to you.

3. Who is responsible for what

Because of the local-execution architecture, roles matter:

Where personal data of your candidates, employees or customers is processed by your tasks, you are the Data Fiduciary in relation to that data. You are responsible for having a lawful basis, for giving those individuals notice, and for honouring their rights. We do not hold that data and therefore cannot respond to requests about it — those must go to you.

4. What we collect

4.1 Account and identity data

Name, business email address, company name, job role, country, password hash (or federated-login identifier), and your communication preferences.

Source: you. Purpose: creating and securing your account, authentication, licensing, support, service communications.

4.2 Billing data

Plan, subscription status, billing name and address, tax identifiers (GST/VAT), invoices, transaction history, and the last four digits and type of the payment instrument.

We do not store full payment card numbers. Payments are processed by Razorpay, who handles card data as an independent controller under their own terms.

4.3 The structure of your tools and tasks

When you build a tool or a task in TaskStudio, we store its definition — the structure of what you built, so that it is backed up to your account, available across your devices, and restorable if you reinstall. A definition consists of:

• which connectors and tools are enabled, and their versions;
• the steps in a task, their sequence, and the conditions and loops that connect them;
• the parameters and field mappings each step uses, expressed as names and data types rather than values;
• the schedule on which the task runs.

A definition is your set of instructions. It is not the data those instructions operate on. Storing the definition of a task that reads a spreadsheet does not give us the spreadsheet, or its contents, or the account it lives in.

We store the shape of your data, not the data itself. A task definition records that a step expects, for example, a text field named "candidate email" of type email address, and a list of rows with three numeric columns. It does not record the email addresses, the rows, or any other values you or your data supply. Values are stripped at the point the definition is saved and are not transmitted to us.

We do this because it is what the product needs: a task runs against new data each time, so the values from any one run have no bearing on the next. Keeping the schema and discarding the values gives us everything required to store, restore and version your task, and nothing more.

4.4 Run statistics and diagnostics

For each account and installation, we also receive:

• run statistics: counts of runs, start and end times, durations, step counts, success/failure outcome, retry counts;
• error and failure classifications, HTTP status categories and schema-validation failures per connector (used as an early-warning signal when a third-party tool changes and breaks a connector);
• credit and quota consumption;
• application version, operating system and version, device locale and timezone, and a pseudonymous installation identifier.

Together, the definitions in 4.3 and the statistics in this section are what we refer to elsewhere in this policy as operational metadata.

4.5 What stays on your machine

Your credentials. Credentials for the third-party tools you connect — passwords, API keys, OAuth access and refresh tokens, browser session cookies — are stored locally on your machine, in your operating system's secure credential store or an encrypted local database. They are used by the application on your device to act on your behalf. They are never transmitted to DeccanLogic and we have no means of retrieving them. If you lose access to your machine, we cannot recover them for you.

The data your tasks read and write. Every read and write your tasks perform happens directly between your machine and the third-party tool, using your own session. We do not receive the contents of the pages your tasks visit, the files they read or write, the data they extract, the records they create or update in third-party tools, or the recipients and bodies of the messages they send. That data never traverses our infrastructure, is never stored by us, and is not something we could produce if asked to.

The only exception is a diagnostic bundle you deliberately choose to send us, which may contain fragments of task context (see 4.6).

4.6 Support and diagnostic data

When you contact support or choose to submit a diagnostic report, we receive what you send us — your message, screenshots, and any log bundle you attach. Log bundles can contain fragments of task context. You control whether to send one, and we ask you to redact sensitive content before you do. Diagnostic bundles are deleted after 90 days.

4.7 Website and marketing data

On our website we collect IP address, browser and device information, referring URL, pages viewed and interaction events, via cookies and similar technologies (see Section 10). If you sign up for our mailing list, book a demo or download content, we collect the details you provide.

We also use IP-based location as a signal to determine which regions a visitor is browsing from, so that we can apply Section 2 and direct visitors in regions we do not yet serve to the right place. This signal is approximate and you can tell us if it is wrong.

4.8 What we do not collect

We do not knowingly collect special-category / sensitive personal data, and the Service is not designed to transmit any to us. We do not collect data from children — the Service is for business use by adults.

5. Why we use your data

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), where your consent is the applicable ground we obtain it by clear affirmative action at the point of collection, in plain language, and you may withdraw it at any time (see Section 9). Where we rely on a legitimate use permitted by the Act — providing the service you have signed up for, maintaining its security, and meeting our legal obligations — we process only what those purposes require.

We process operational metadata rather than your business content, which keeps the amount of personal data involved in running TaskStudio deliberately small.

We do not use your data to train our own AI models, and our AI providers are contractually prohibited from training on it.

6. AI providers and automated processing

Certain TaskStudio features use third-party large-language-model providers to interpret your instructions, plan task steps, and interpret the structure of pages and tools.

What is sent: the instructions you write, the structure and visible context of the tool or page the task is operating on at that moment, and the parameters needed to complete the step.
What is not sent: your stored credentials, and any data outside the scope of the step being executed.
Contractual protections: our AI providers are engaged as sub-processors under terms that prohibit the use of your content for model training, and require deletion after processing or after a short abuse-monitoring retention window.

Depending on the tool being automated, the context sent may include personal data of individuals whose records you are processing. You should account for this in your own privacy notice and in your assessment of the grounds on which you process that data. If your policy or your clients' contracts do not permit this, you can select a self-hosted model, or use API-based connectors only.

Automated decision-making: TaskStudio does not make decisions producing legal or similarly significant effects about individuals on its own. Your tasks may assist you in such processes; Clause 4.3 of the Terms requires meaningful human review.

7. Who we share data with

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share it only as follows:

7.1 Sub-processors and vendors

7.2 The third-party tools you connect

When your tasks run, data flows directly from your machine to those tools using your credentials. That flow does not pass through us, and each provider's own privacy policy governs it.

7.3 Legal and corporate

We may disclose data where required by law, court order or a valid request from a public authority, and to establish, exercise or defend legal claims. In a merger, acquisition or sale of assets, data may transfer to the successor, who will remain bound by this policy or one materially no less protective; we will notify you.

8. International transfers

We are based in India. Our hosted services and vendors are located in India and the United States, and your account and operational metadata may be processed in those locations.

Under the DPDP Act, we may transfer personal data outside India except to territories restricted by the Central Government from time to time. We contract with each vendor listed in Section 7.1 on terms requiring them to protect the data they process on our behalf and to use it only for the purposes we specify.

9. Your rights

9.1 If you are in India (DPDP Act, 2023)

As a Data Principal you have the right to: obtain a summary of the personal data we process and our processing activities; correction, completion, updating and erasure of your personal data; nominate another individual to exercise your rights in the event of your death or incapacity; withdraw consent where consent is the ground on which we process; and grievance redressal — first with us, and then with the Data Protection Board of India if you are not satisfied.

You also have a duty under the Act not to furnish false particulars or file frivolous complaints.

9.2 If you are outside India

We will handle requests to access, correct or delete your account data on the same basis as those described above, wherever you are. This is how we choose to operate; it does not create rights under any law that does not otherwise apply to you, and it does not mean we offer the Service in a region listed in Section 2.

9.3 How to exercise your rights

Write to privacy@deccanlogic.com. We will verify your identity and respond within 30 days (or such shorter period as law requires). There is no charge unless a request is manifestly unfounded or excessive.

Important: if your request concerns data processed by one of our customers using TaskStudio — for example, if you are a job candidate whose record was handled through the platform — we do not hold that data. Please contact the business that processed it; we will assist them where we reasonably can.

9.4 Grievance Officer (India)

Sandeep Tendulkar
Grievance Officer, DeccanLogic Private Limited
B-405, City Vista, Fountain Road, Kharadi, Pune-411014, Maharashtra, India

Email: grievance@deccanlogic.com
We will acknowledge grievances within 24–72 hours and resolve them within the period required by law.

10. Cookies and website tracking

Our website uses:

• Strictly necessary cookies — authentication, session security, load balancing. Always on.
• Functional cookies — remembering preferences such as language.
• Analytics cookies — understanding how the site is used. We use Google Analytics.
• Marketing cookies — none.

You can manage your preferences at any time at https://taskstudio.in/app/cookie-settings, and most browsers also allow you to block or delete cookies. Blocking strictly necessary cookies may prevent parts of the site from working.

The TaskStudio desktop application does not use advertising or cross-site tracking technologies.

11. Security

We implement technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS 1.2+) for all communication with our hosted services;
• encryption at rest for account and telemetry data;
• local storage of your third-party credentials in your operating system's secure credential store or an encrypted local store, never transmitted to us;
• cryptographic signing of connector definitions, verified on your device before use, so that only definitions we published can run;
• per-connector host restrictions enforced on your device, so a connector cannot direct credentialed requests to hosts outside its declared scope;
• least-privilege access controls and role-based access for our personnel, with access to production limited to those who need it;
• logging, monitoring and alerting; vulnerability management and dependency scanning;
• background-checked personnel bound by confidentiality obligations.

No system is perfectly secure. If a personal data breach affecting you occurs, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act, and any other authority to which we owe a notification obligation.

You also play a part: keep your account credentials secure, keep your device and operating system patched, and restrict who can use the machine on which TaskStudio is installed, since that machine holds your connected credentials.

12. Retention

Data your tasks process is retained by you and by the third-party tools you use, under their retention rules — not ours.

13. Changes to this policy

We may update this Privacy Policy. For material changes we will give at least 30 days' notice by email or in-application notice before the change takes effect, and we will update the "Last updated" date above.

We expect to update Section 2 as we open new markets. If we begin offering the Service in the European Economic Area or the United Kingdom, we will publish the additional rights, representative details and transfer safeguards that apply there before doing so.

14. Contact us

DeccanLogic Private Limited
B-405, City Vista, Fountain Road, Kharadi, Pune-411014, Maharashtra, India

Privacy enquiries and rights requests: privacy@deccanlogic.com
Grievance Officer (India): grievance@deccanlogic.com
Security reports: security@deccanlogic.com