Your data stays yours

How your data is kept

• Your data is never used to train AI models.
• Each organisation’s data is kept apart in the database.
• Every page and form uses an encrypted connection (HTTPS).

Details of where and by whom your data is processed are shared with customers on request: use our contact form.

Who sees what

• Roles decide what each person can do: Agent Admin, Agent or Restricted Agent. Each team can have its own managers.
• A Restricted Agent sees and works only their own teams’ tasks.
• Teams can be private: their tasks are seen only by the team’s members and Agent Admins.
• Internal notes and @mentions stay inside the task. Customers never see them.
• Admins can view the app as a colleague, read only, to check what they see. It is recorded in the access log.

Signing in

• Two-step sign-in for everyone: an authenticator app or a passkey at every sign-in, with recovery codes. Text-message codes can be switched on too.
• Leaked passwords are refused.
• Nobody sets or shares another person’s password: each person chooses their own through a one-time invitation link.
• People are signed out after a quiet period and at the end of a session.

TaskReply support access

• Our support team does not look into your organisation on its own.
• Only your admin can give access, from inside TaskReply: View only or Make changes, for 1, 7 or 30 days.
• Support enters as “TaskReply Support (name)”, never as one of your people.
• Even with Make changes, support never emails your customers, sees passwords or two-step sign-in settings, exports your data or deletes your organisation.
• Access ends by itself, and your admin can end it at any time. Every step is recorded in your access log.

Safe email

• Emails are shown without running any scripts.
• Risky attachments, such as programs and scripts, are blocked. Your admin can block more file types.
• Emails that fail sender checks are marked “Unverified sender”.

Access log

• Who signed in and what changed, including every support visit and every view as a colleague.
• Kept for two years. Admins can export it to Excel or CSV to keep it longer.

Keeping and erasing data

• Choose how long the emails, notes and files of closed tasks are kept.
• Erase a contact’s personal data from every email it appears in. Tasks and reports stay whole.
• You can ask for a copy of your data in a common machine-readable format.
• When an organisation closes its account, its data is deleted 30 days later and leaves our backups after 35 days.

GDPR, UK GDPR and KVKK

• For your data you are the controller and we are your processor: we handle it only on your instructions.
• A data processing agreement under the UK GDPR, the EU GDPR and Türkiye’s KVKK is available on request: write to info@masaltech.com.
• If a security incident affects your data, we tell you without undue delay.
• We do not sell your data and do not use it for advertising.