Who is responsible
Nadine Pierre LTD, trading as TaskPilot AI, company 17235708, 128 City Road, London, EC1V 2NX, England and Wales. Contact hello@taskpilotai.co.uk. We act as controller for account, support, payment administration and security information. Cleaning businesses normally act as controllers for their customers; we process their enquiry records on documented instructions. They must link their own privacy notice on their form.
Information and purpose
We store account contacts, password hashes, session records, service configuration, enquiry contact details and notes, manually entered quotations, bookings, follow-ups, payment references and security/audit records. Founders may register passkey public keys; biometric information and authenticator private keys do not reach us. Stripe handles card entry. Avoid access codes, card data and unnecessary sensitive details.
Lawful bases
Contract where the individual is a contracting party, legitimate interests for corporate relationships and service security subject to a balancing assessment, and applicable legal obligations for required accounting records. Cleaning-customer processing follows the customer controller’s lawful instructions. Acknowledging this notice is not blanket consent or marketing permission.
Providers and transfers
Vercel hosts the application in London, Neon stores the database, Stripe handles payments, and Resend (Plus Five Five, Inc.) delivers transactional emails. GitHub stores encrypted recovery snapshots with 14-day artifact retention. Our existing Microsoft 365 mailbox handles support. We send Resend the recipient address and relevant account, enquiry, quotation, booking or payment-notification content. Its shared account sends delivery callbacks to TaskPilot and Fire Risk Experts endpoints: each authenticates the event and discards foreign events before database access. This is processing isolation, not exclusive transport. Providers and their support/subprocessors may process data outside the UK, including the US; London hosting or Ireland email sending does not mean UK-only storage. Provider data-processing terms include applicable UK transfer clauses; copies and current subprocessor information are available on request. Optional AI processing remains disabled.
Retention and rights
We retain business records during the service under the business controller’s instructions. On termination, 30 days are allowed for export, followed by active-system deletion within a further 30 days, unless earlier deletion is requested or a documented legal hold applies. Sent job bodies are cleared after processing; unresolved failed jobs retain their content for investigation. Delivery receipts and suppression records are retained only as needed for delivery, complaint prevention, disputes and security, reviewed on account closure. Unverified accounts and unresolved jobs are reviewed at least monthly; information no longer needed is removed through an authorised scoped procedure. These reviews are operator duties, not automatic deletion guarantees. Encrypted recovery artifacts expire after 14 days; restored data must reapply completed erasures before service resumes. Providers may retain separate service/security records under their published terms. Contact us for access, correction, deletion, restriction or portability; we verify identity and the responsible controller. We normally respond within one month, explaining any lawful extension. An organisation export is not automatically a complete individual access response.
Your right to object
Where processing relies on legitimate interests, you may object based on your circumstances. You may also withdraw consent where consent is actually used. Contact hello@taskpilotai.co.uk. You can complain to the Information Commissioner’s Office at ico.org.uk. We will explain any applicable exception or extension.
Cookies, decisions and incidents
Only necessary session/security storage is used by the application; no optional analytics or marketing is enabled. No enquiry is automatically priced or confirmed. Historical shared-email disclosure assessment remains outstanding and is not represented as resolved by the current receiver corrections.