Privacy Notice — Taktic
Draft for review (version 2026-10-24) — Written from a review of the system's code and documentation as of the drafting date.
Must be reviewed by legal counsel / the DPO before publication · Text in[[...]]is information still to be filled in.
Last updated: 24 October 2026
GSF Robotics and AI Co., Ltd. (the "Company", "we") provides and operates Taktic, a project management system (the "System"). This notice explains how we collect, use, disclose and look after the personal data of System users, in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Who this notice applies to
- Employees, contractors, and customers or business partners for whom the Company creates an account to use the System ("Users")
- Individuals mentioned in work data, such as names appearing in a task, comment or document
- People who open a project status summary page through a shared link (share link) without signing in
The System is for work use only. It is not designed for use by persons under 20 years of age, and we do not intend to collect sensitive personal data (under Section 26). Users should not record this type of data in the System.
2. Data controller and contact details
| Data controller | GSF Robotics and AI Co., Ltd. |
| Address | 52/9 Suchawadee Moo 3 Soi Sukha Prachasan 3, Tiwanon Road, Bang Phut, Pakkret, Nonthaburi, 11120 |
| Email for personal data matters | contact@gsf-company.com |
3. Personal data we collect
| Category | Details | Source |
|---|---|---|
| Account data | Name, email, password (stored only as a one-way bcrypt hash; we never see the actual password), System role (Admin / Member), account creation date | Created by the Company's system administrator (Admin); the System has no self-sign-up |
| Project role data | Role (PM / Dev), discipline (e.g. SA, BA, Dev, Tester, Designer), responsibilities | The project's PM or Admin |
| Work data | Tasks the user creates, is assigned to, or reviews; comments; @mentions; documents (Docs) and their edit history; checklists; attachments (file name and uploader); notifications | Recorded by Users and their colleagues while using the System |
| Activity log | Who changed a status, assigned work or edited what, and when | Recorded automatically by the System |
| Preference data | Theme, colors, font size and screen layout | Set by the User |
| Push notification data (if turned on) | Push endpoint address and the browser's encryption keys, browser type (user agent) | The User's browser, when the User clicks "Turn on" |
| Connection tokens (MCP) | Token name, token prefix, hash value and last-used time (we do not store the full token) | Created by the User |
| AI feature usage data (if enabled) | User, project, feature used and number of tokens used | Recorded by the System when a User uses an AI feature |
| Technical data | Cookie that keeps the User signed in, and server logs: the IP address, time, URL and browser type of requests, recorded by our hosting providers (AWS Amplify keeps the website's logs until the website is removed from it; Supabase keeps its logs for 1–90 days depending on the plan). The API itself logs errors only | Browser and server |
Free text, such as task descriptions, comments, documents and attachments, may contain personal data of other people that Users type in or attach. Users must record only data that is necessary for the work.
4. Purposes and legal bases
| Purpose | Legal basis (PDPA Section 24) |
|---|---|
| Create and manage accounts, verify identity at sign-in, assign permissions | Performance of a contract / employment contract (24(3)) and the Company's legitimate interests in managing its operations (24(5)) |
| Provide System features such as assigning work, comments, notifications and documents | 24(3) and 24(5) |
| Log activity, track progress and summarize individual workloads for PMs / Admins | Legitimate interests in project management (24(5)) |
| Send push notifications to devices | Consent — Users choose to turn it on themselves and can turn it off at any time (Section 19) |
| AI features that help draft tasks, break documents into tasks, generate test cases and produce weekly summaries (when enabled by the Company) | 24(5) · For transfers abroad, see Section 6 |
| Share project status summaries with customers via a link | Performance of the contract with the customer (24(3)) and 24(5) |
| Maintain security, detect unusual activity and fix System problems | 24(5) |
| Comply with the law or orders of government authorities | Legal obligation (24(6)) |
We do not use Users' data for marketing, we do not sell data, and we do not use third-party tracking or analytics (such as Google Analytics).
5. Disclosure of data
Within the System
- Project members can see the names, roles and work of other members of the same project.
- PMs can see the names and email addresses of users in the System (within the same organisation) in order to add them to a project.
- Admins can see the names, emails and roles of all users, and can see all projects.
- Users who are not members of a project cannot see that project's data.
Project status share link
- A PM or Admin can create a link. Anyone with the link can see the project name, the task list (title, description, status, priority, due date), task attachments and the Company's contact details, without signing in.
- A PM / Admin can revoke the link at any time.
Service providers that process data on our behalf (data processors)
| Provider | Purpose | Data location |
|---|---|---|
| Amazon Web Services (AWS Amplify, Lightsail) | Hosting the website and API | Singapore (ap-southeast-1) |
| Supabase | Database, attachment storage, real-time updates | Singapore (ap-southeast-1) |
| GitHub | Stores the application's container images (no user data) | United States |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Deliver notifications to devices, only for Users who have turned on push · Content is encrypted in transit (actor's name, task title and unread count) | Depends on the provider (mostly the United States) |
| Anthropic or OpenAI (only when the Company enables AI features) | Process text that Users ask the AI to help with | United States |
We may disclose data when required by law, or when a government authority issues a lawful order.
6. Sending or transferring data abroad
- All System data is stored on servers in Singapore.
- When the Company enables AI features and a User uses them, the relevant data is sent to the AI provider in the United States, namely:
- Draft a task: project name, and the task's title, type and description
- Break a document into tasks / generate test cases: the entire document content
- Weekly summary: task titles, due dates and assignee names
- Push notifications are sent through the browser's provider, which may be located outside Thailand.
We send or transfer data abroad only in accordance with PDPA Sections 28–29 and the relevant notifications of the Personal Data Protection Committee, for example under a data processing agreement (DPA) or standard contractual clauses with the provider. [[Specify the safeguards actually in place]]
7. Retention period
| Data | Retention period |
|---|---|
| User accounts | For as long as the account is in use, and deleted within 60 days after the relationship ends (e.g. employment ends or the project with the customer is completed) |
| Work data (tasks, comments, documents, files) | For the life of the project and 1 year after the project is closed, or until a PM / Admin deletes it |
| Document edit history and activity logs | 2 years after the project is closed |
| Notifications and AI usage logs | Notifications 90 days · AI usage logs 1 year |
| MCP tokens and push registrations | Until the User revokes them or the account is deleted |
When an account is deleted:
- Account data, tokens, push registrations, notifications, AI usage logs and records of accepting the Terms of Use and this notice are deleted.
- Tasks previously assigned to the User no longer have an assignee.
- Activity logs and document history are kept, but are no longer linked to that User's name.
8. Security
- All connections use HTTPS.
- Passwords are stored as bcrypt hashes, and connection tokens are stored only as hash values.
- AI provider API keys are encrypted with AES-256-GCM.
- Permissions are checked on the server side every time data is requested.
- There is no self-sign-up; every account is created by an Admin.
If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee ("PDPC Office") within 72 hours of becoming aware of it, unless the breach poses no risk to the rights and freedoms of individuals, and we will notify the data subjects without delay if the risk is high.
9. Cookies and browser storage
- Essential cookies: only the cookie that keeps the User signed in (session). The System cannot work without this cookie.
- Browser settings (localStorage): theme, colors, font and board / backlog views. These are stored only on the User's device and are not sent to the server.
- We do not use advertising cookies, tracking cookies or third-party analytics tools, and all fonts are loaded from our own servers.
Because only essential cookies are used, the System does not need to ask for cookie consent.
10. Data subject rights
You have the following rights under the PDPA:
- Request access to and a copy of your data (Section 30)
- Receive your data in a machine-readable format, or have it sent to another controller (Section 31)
- Object to processing based on legitimate interests (Section 32)
- Request that your data be deleted or destroyed, or made non-identifiable (Section 33)
- Request that the use of your data be restricted (Section 34)
- Request that your data be corrected so it is accurate and up to date (Sections 35–36)
- Withdraw consent at any time, for example by turning off push notifications (Section 19), without affecting processing carried out before the withdrawal
- Lodge a complaint with the PDPC Office (Section 73)
Send requests to contact@gsf-company.com. We will respond within 30 days of receiving a request and may ask you to verify your identity first. We may refuse a request where the law allows, for example where we must keep the data to comply with the law or to exercise legal claims, and we will tell you the reasons.
Users can do the following themselves in the System:
- Change their password
- Turn push notifications on / off
- Create / revoke connection tokens
- Change display settings
To change a name or email, an Admin currently has to make the change.
11. Changes to this notice
We may update this notice from time to time. If a change is material, we will announce it in the System before it takes effect. The latest version is available at /privacy.