Last updated: 1 August 2025 · Effective: 1 August 2025
TasksMatic Pty Ltd (ACN 685 136 930 / ABN 56 685 136 930) ("TasksMatic", "we", "our", or "us") is an Australian private company registered in Victoria. We operate the platform available at tasksmatic.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service.
By accessing or using the Service you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.
Summary: We collect only the information necessary to deliver our logistics automation platform. We do not sell your personal data. You have full rights to access, correct, and delete your data.
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email address, password (hashed) | Authentication and account management |
| Business / company data | Company name, ABN/business number, address, contact details | Customer profile, invoicing, compliance |
| Payment data | Credit/debit card details, billing address | Processed securely by Stripe — we never store raw card numbers |
| Email & document content | Emails connected via OAuth, attached shipping documents (PDFs, images) | AI-powered workflow automation — extracting logistics data for processing |
| Configuration data | API credentials for third-party integrations (e.g. CartonCloud), workflow settings | Enabling integrations you configure |
We do not use your email content or shipping documents to train AI/ML models for any purpose other than processing your own workflows.
If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following lawful bases:
| Processing activity | Legal basis |
|---|---|
| Providing the Service and fulfilling our contract with you | Contractual necessity (Art. 6(1)(b)) |
| Processing payments | Contractual necessity (Art. 6(1)(b)) |
| Sending transactional emails | Contractual necessity (Art. 6(1)(b)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Security monitoring, fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Product analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
We do not sell, rent, or trade your personal data. We share data only in the following circumstances:
| Provider | Purpose | Data shared |
|---|---|---|
| Stripe | Payment processing | Payment & billing information |
| Mailgun | Transactional email delivery | Email address, email content |
| Google Cloud / Aliyun OSS | File storage | Uploaded documents |
| Heroku / AWS | Cloud hosting & infrastructure | All data hosted on platform |
| Good Job (PostgreSQL) | Background job processing | Job payloads (may include document metadata) |
All sub-processors are bound by data processing agreements and are prohibited from using your data for any purpose other than providing services to us.
When you configure integrations (e.g. CartonCloud, Discord), we send relevant data to those services on your behalf. You control which integrations are active.
We may disclose data if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will provide notice before your data becomes subject to a different privacy policy.
TasksMatic is headquartered in Australia. Your data may be processed in countries outside your country of residence, including Australia, the United States, and Singapore, where our service providers operate.
For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure your data receives adequate protection.
You may request earlier deletion at any time (see Your Rights below).
We use the following types of cookies:
| Type | Examples | Purpose | Deletable? |
|---|---|---|---|
| Strictly necessary | Session cookie, CSRF token | Authentication and security — the Service cannot function without these | No (required) |
| Functional | User preferences, locale | Remember your settings between sessions | Yes |
| Analytics | Usage metrics | Understand how the platform is used to improve it | Yes |
You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from using the Service.
Depending on where you are located, you may have some or all of the following rights:
Request a copy of the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Request deletion of your personal data ("right to be forgotten").
Ask us to limit how we process your data in certain circumstances.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests or for direct marketing.
Not to be subject to solely automated decisions that significantly affect you.
Withdraw consent at any time where processing is based on consent.
California residents (CCPA/CPRA): You have the right to know, delete, correct, and opt out of the sale or sharing of your personal information. TasksMatic does not sell or share personal information for cross-context behavioural advertising.
Australian residents (Privacy Act 1988): You may request access to, or correction of, personal information we hold about you under the Australian Privacy Principles.
To exercise any of these rights, contact us at privacy@tasksmatic.com. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling a request.
If you believe we have not adequately addressed your request, you have the right to lodge a complaint with your local data protection authority.
The Service is not directed at children under 16 years of age (or the relevant age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We implement appropriate technical and organisational measures to protect your data, including:
No method of transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law (within 72 hours for GDPR purposes).
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice within the Service at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We aim to respond to all privacy enquiries within 5 business days.