Privacy Policy

This policy explains what TaskAssure Ltd does with personal information — yours, and that of anybody else who ends up in a task. It is written to the Data Protection Act, 2019 of Kenya.

TaskAssure Ltd of Nairobi, Kenya is the data controller. Reach us at privacy@taskassure.africa.

1. What we collect

Your account: name, email address, phone number, password (stored only as a hash, never in readable form), the city or country you are in, and how you signed in.

Your tasks: what you asked for, where, when, the notes you wrote, the messages on the thread, and what you were charged.

The people a task concerns: the name, phone number and any note you give us about a beneficiary — the relative, tenant, patient or contact the task is actually about.

Evidence: photographs, video, scanned receipts and documents, completion notes, signed confirmations, and the location and time of a check-in.

Payments: amount, currency, method, the reference the provider gave us, and which account the money landed in. We never see or store your full card number — that stays with the payment provider.

Field Partners: everything above, plus verification records, availability, and ratings.

Technical: the session cookie that keeps you signed in, and ordinary server logs — the pages requested, the time, the browser, the IP address. We do not run advertising or third-party tracking.

2. Why we use it, and what allows us to

To carry out the task you asked for. Performance of our contract with you.
To take payment and reconcile it. Performance of the contract, and our legal obligation to keep accounting records.
To keep evidence and an audit trail. Our legitimate interest, and yours, in being able to prove what was done.
To check Field Partners and keep people safe. Legitimate interest, and the obligation to take reasonable care of the people we send.
To email you about a task. Performance of the contract. Anything that is not about a task of yours is sent only with your consent, and stops the moment you unsubscribe.
To improve the service. Legitimate interest, using aggregate figures.

3. Beneficiaries and the people in the evidence

Some of the information we hold is about somebody who never used TaskAssure. That is the nature of the work, and we treat it carefully.

We only collect what the task needs. Field Partners are instructed to photograph the subject of the task, not bystanders. Evidence is visible to you, the Field Partner, and our ops desk — nobody else. Evidence marked internal is not shown to you at all. It is stored privately and served through a signed, expiring link, never a public address.

If you give us somebody's details, you are telling us you are entitled to. If you are that person and want to know what we hold, write to privacy@taskassure.africa and we will deal with you directly.

Visits that are not announced. Some tasks are exactly this: a landlord checking a property they own, a dated report on a plot nobody lives on. When you tell us the person at the other end has not been told we are coming, the task is handled as exterior observation only. Nobody is telephoned, nobody is approached, and the evidence does not include interiors or identifiable people. The system refuses to accept a signed confirmation on such a task at all, since producing one would mean somebody was asked to sign.

That is a limit on what we will do, not a service we offer against a person. We do not accept tasks whose purpose is to monitor, follow or intimidate someone, and we will decline or stop work on a task that turns out to be one — see the Terms. If a task concerns you and you want to know what we hold about it, the address above reaches us.

4. Location

A Field Partner's device records where a check-in happened, when the task calls for proof of presence. It is captured at that moment, for that task. We do not track Field Partners between tasks, and we do not collect your location.

5. Who else sees it

The Field Partner on your task — the brief, the address, and the contact they need to do it. Not your payment details.
Payment providers — Safaricom M-Pesa, your bank, and our card processor, for the payment itself.
Our suppliers, strictly to run the service: hosting and file storage, and our transactional email provider. They act on our instructions and may not use the data for anything of their own.
Google, if you choose to sign in with it — only to confirm who you are.
An authority, where the law requires it, or to establish or defend a legal claim.

We do not sell personal data. We do not share it for advertising.

6. Where it is held

Our hosting, storage and email suppliers operate outside Kenya. Where personal data leaves the country we rely on the safeguards the Data Protection Act allows — the supplier's contractual commitments and their own data protection terms — and we transfer only what running the service requires.

7. How long we keep it

Task records, evidence and payment records: seven years from completion. They are accounting records and the evidence behind any later dispute.
Your account: while it is open, and one year after you close it.
Field Partner verification records: while they are a Field Partner, and two years after.
Server logs: ninety days.
Unsuccessful applications: six months.

After that it is deleted, or irreversibly anonymised for statistics.

8. Your rights

Under the Data Protection Act, 2019 you may:

ask what we hold about you, and get a copy
have something inaccurate corrected
ask for deletion, where we have no overriding reason to keep it
object to a use we base on legitimate interest
withdraw consent you gave, without affecting what was done before
ask us to restrict how we use it while a dispute is open
receive the data you gave us in a portable form

Write to privacy@taskassure.africa. We reply within thirty days, without charge. We may ask you to confirm who you are first.

Some of these have limits: we cannot delete an accounting record we are required to keep, or evidence that is the subject of an open dispute. If we refuse, we will tell you why.

9. Security

Passwords are hashed. Sessions are signed tokens. Evidence sits in private storage and is reachable only through short-lived signed links. Access to the ops desk is limited to staff who need it, and every action on a task is logged against the person who took it.

No system is perfect. If a breach happens that puts you at risk, we will tell you and the Data Commissioner as the Act requires.

10. Cookies

We set the cookies that keep you signed in and keep forms safe from cross-site abuse. There are no advertising or analytics cookies, so there is no consent banner to dismiss — turn the essential ones off in your browser and signing in will stop working.