This Privacy Policy explains how Tasky Portal Est. collects, uses, shares and protects personal data on the Tasky platform. It covers two kinds of user: a company running its operations on Tasky, and a customer who is served by a company through Tasky.
For most of the personal data described here, the company you deal with is the controller and Tasky is the processor acting on its instructions. For account and platform level data, such as login credentials and platform usage, Tasky is the controller in its own right. Section 3 sets out which applies where.
If anything in this policy is unclear, contact our privacy team at contact@tasky.ae.
1. Data we collect
From companies. Business and trade licence details, authorised signatory information, staff records including names, contact details, roles and permissions, and the operating data a company enters or generates on the platform: work items, schedules, invoices, service catalogues and prices.
From customers. Name, phone number and, where a customer chooses to create one, an account with an email and password. Location, provided or approximate, so a technician can reach the right address and so tracking works during a visit. Details of the work requested: description, photos, timing and address. Communications sent through the platform, including chat with a company and support messages, logged for safety and quality.
From everyone. Device and usage data: app and site activity, device identifiers, IP address and cookies. See our Cookies Policy.
Payment data. Payment for a company's services is handled between the customer and the company through the company's own payment provider. Tasky does not receive or store full payment card details. Where Tasky charges a company directly, for its subscription or for a chargeable introduction, that payment is handled by Tasky's own payment provider, and Tasky receives limited information such as card type, last digits and transaction status.
2. How and why we use data
To create and operate company and customer accounts and provide the platform.
To connect a customer to a company: showing service listings, enabling a customer to search, and disclosing a company's identity at the point the customer asks for an introduction.
To let a company run its operations: dispatch, scheduling, invoicing, staff management and the tracking link a customer receives.
To verify companies against their UAE trade licence, and to prevent fraud and maintain platform safety.
To operate the AI layer, where a company has enabled it, using that company's own operating data to prepare drafts for a person to approve. Data from one company is never used to serve another company.
To send service messages, and marketing only where consent has been given.
To improve and secure the platform, and to meet legal obligations.
3. Who controls what
Tasky is the controller for account credentials, platform usage data, and data needed to operate the discovery layer before a reveal.
The company is the controller for the personal data of its own customers and staff once that data is in its company space, including task detail, service history and communications about the work. Tasky processes that data as the company's processor, under its instructions, and does not use it for any other company or for its own purposes.
4. Who we share data with
The company you are working with. Once you ask for an introduction, or if a company has invited you directly, it receives the contact and location detail needed to do the work.
Service providers acting on our behalf. Hosting, payment, mapping, communications, analytics and support, under contracts that protect the data.
Authorities, regulators or courts, where required by law or to protect rights and safety.
A successor entity, in the event of a merger, acquisition or reorganisation, subject to this policy.
We do not sell personal data.
5. Retention
Personal data is kept only as long as needed for the purposes above, to meet legal, tax and accounting obligations such as transaction records, and to resolve disputes and enforce agreements. When no longer needed, it is deleted or anonymised. A company can export its own operating data at any time and for 30 days after closing its account.
6. Data residency and international transfers
Company records, documents, audit trails and usage logs are stored in the United Arab Emirates. Where an AI request involves personal data, such as customer or staff details, it is processed on models running inside the UAE and does not leave the country. Where a request contains no personal data, prompt text may be processed by a model running outside the UAE. It is encrypted in transit, processed, then discarded, and never used to train any model. Any other international transfer relies on the conditions permitted under the UAE Personal Data Protection Law, such as transfer to a jurisdiction with adequate protection or under appropriate contractual safeguards.
7. Security
We apply technical and organisational measures to protect personal data, including encryption in transit, access controls, secure cloud hosting, logging and monitoring, and staff confidentiality obligations. Every AI action is checked against a company's permissions before it runs, and no AI agent can read or reason over another company's data at any level. No system is perfectly secure, but we work continuously to protect data and will notify affected users and the regulator of a qualifying personal data breach as required by law.
8. Your rights
Subject to the conditions in the UAE PDPL, you have the right to:
Access. Obtain confirmation of, and a copy of, the personal data we hold about you.
Correction. Ask us to correct inaccurate or incomplete data.
Erasure. Ask us to delete your data where there is no lawful reason to keep it.
Restriction and objection. Ask us to limit or stop certain processing, including profiling and direct marketing.
Portability. Receive certain data in a structured, machine readable format, or have it transferred where technically feasible.
Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting earlier processing.
Complain. Lodge a complaint with the UAE Data Office, the federal data protection regulator.
Where a company is the controller of your data, some of these requests may be directed to that company. We will tell you where that applies. To exercise any right, contact contact@tasky.ae. We may need to verify your identity before responding.
9. Children
The platform is intended for companies and customers aged 18 and over. We do not knowingly collect data from children. If we learn that we have, we will delete it.
10. Changes
We may update this policy and will post the revised version with a new last updated date. Material changes will be notified where required.