Privacy Policy

Last updated: November 10, 2026

1. Introduction and Our Role

Workforce Technologies Inc., doing business as OnTask.AI ("OnTask.AI," "we," "us," or "our"), provides a business-to-business workforce-monitoring and productivity platform. This policy covers our website and related business interactions, and describes our handling of information through the platform and applications (the "Service"). "Personal information" includes information that identifies, relates to, or can reasonably be linked to an individual, directly or indirectly.

Employer customers ("Customers") configure and deploy the Service to their workers and authorized administrators ("Users"). "Customer Data" means information submitted, collected, or generated through the Service by or on behalf of a Customer, including recordings and customer-specific derived records, as defined in the applicable Service agreement. Under the Master Subscription Agreement, it excludes underlying Service technology and qualifying Statistical Data meeting Section 5.4. Customers ordinarily determine the purposes of workforce monitoring. We process Customer Data on their documented instructions as a processor or, where the applicable law and contractual requirements are satisfied, a service provider or contractor. Our obligations depend on the processing activity, applicable law, and Customer agreement.

We determine the purposes of processing information for our own website inquiries, business relationships, account administration, billing, and related business activities. Where GDPR or UK GDPR applies to that processing, we act as a controller. A person may have both Customer-directed records and information we handle for our own business purposes; requests are addressed according to the relevant role.

If you are a monitored worker or another person whose information appears in Customer Data, this policy describes our handling of that information but does not replace the Customer's workplace-monitoring notice or privacy policy. Ask the Customer about its monitoring purposes, settings, access permissions, employment decisions, and lawful basis.

This policy is a notice, not blanket consent to recording or other processing. Consent, when legally required, must be obtained separately. Website and Service terms are addressed separately in our Terms of Use, Master Subscription Agreement, and Acceptable Use Policy. This policy does not authorize a Customer to collect information unlawfully.

2. Information We Collect

• Trial inquiries: Our free-trial lead form requests your full name, business email, phone number including country information, company size, and website. Our contact, careers and investor inquiry forms request your name and email address together with the details you choose to share, such as company or firm, topic, phone number, a link to a professional profile, and your message. Our server also records the submission's IP address, user agent, referral/source information, and timestamp.
• Accounts and business communications: Information provided when establishing or administering an account, contacting us, requesting support, or working with us as a Customer or partner, including contact details, account identifiers, and correspondence. Customers and their administrators may provide information about their Users. We also keep records of administrative and delegated-access events, such as when an authorized Partner uses "log in as" to access an account, including who accessed which account and when, for security, auditing and account administration.
• Sign-in and preferences: Information used to authenticate sessions and maintain selected preferences. If you choose Google sign-in, Google handles authentication and shares the sign-in information authorized through that process.
• Payments: Stripe processes payments. We store a Stripe customer identifier; we do not collect full payment-card numbers or card security codes through our own payment form. Payment information submitted to Stripe is handled under its applicable terms and privacy notice.
• Customer Data: Screen and webcam recordings, screenshots, webcam snapshots, face-reference photos, transient face embeddings and face scans, face-verification results, worker notice and written-release records, on-screen information, OCR text, activity assessments, and other derived records described in Section 4. Sources include the Customer, its authorized administrators and Users, monitored screens and webcams, and processing performed by the Service. Face embeddings and face scans are not persisted.
• Provider interactions: Google Fonts requests, Google Analytics measurement and Google reCAPTCHA checks on our public website, optional Google sign-in, and demo booking through Calendly involve the relevant provider. Information supplied through these interactions is handled as described in Sections 3 and 7 and the provider's own notice.

Information displayed on a monitored screen may concern coworkers, clients, family members, or other third parties, not only the monitored User. It may also contain sensitive information that neither we nor the Customer intended to request. Collection should be limited to what is lawful and necessary for the Customer's stated monitoring purposes.

3. Cookies and Other Technologies

The logged-in application uses cookies for session/authentication functions and to retain a selected preference. Browser settings can restrict or remove cookies, but doing so may disrupt sign-in, sessions, or saved preferences. This section is our cookie notice; there is no separate Cookie Policy.

Our public marketing pages load Google Fonts. Loading those fonts sends requests to Google that disclose information such as your IP address and browser request information. Google sign-in is optional in the application.

Our public website uses Google Analytics to understand how visitors find and use it. Google Analytics sets first-party cookies and collects information such as the pages you view, the page that referred you, approximate location derived from your IP address, and device and browser details. We switch off Google Analytics advertising features (Google signals and ad personalization), and we remove invite codes, password-reset codes and e-mail addresses from page addresses before they are sent. Forms on the website are protected by Google reCAPTCHA, which collects device and interaction information to tell people from bots. Google processes this information under its own privacy policy (policies.google.com/privacy). You can block or delete these cookies in your browser settings or use Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout). Our public pages do not use advertising pixels, ad tags, or session replay. Before introducing tools that require consent or additional privacy choices, we will update the relevant disclosures and obtain consent or provide the required choices. This also applies to new cookies or similar technologies that require consent under applicable law.

The website links to Calendly for demo booking and to YouTube. Following an external link subjects your interaction with that service to its own collection practices and privacy notice. An external link is not itself a statement that the linked provider receives your screen recordings.

4. Workforce Monitoring and AI Analysis

Monitoring is configured by the employer Customer. The Service can record screens through browser screen capture and a desktop application, covering up to three monitors, and capture periodic screenshots. Recordings and screenshots may reveal applications, documents, websites, messages, images, credentials, and other information visible on those screens. Video exports use the .webm format. Depending on the Customer's configuration, the desktop application can start when the user signs in to the device and record automatically or in the background, including while minimized to the system tray.

The Service runs OCR and AI analysis of screen activity to produce on-task/off-task classifications, stories or summaries, timesheets, violations, and searchable embeddings. AI chat and search allow authorized account users to retrieve or analyze screen activity. Embeddings and other derived records can remain personal information even when they do not reproduce a complete screenshot.

Screen-activity AI inference runs through Amazon Bedrock on AWS, using models including OpenAI-family and Google Gemma models. Requests go through AWS rather than directly to those model developers. We do not use Customer Data to train third-party or general-purpose AI models. Any use of Customer-derived data to improve the Service is limited to Statistical Data meeting Section 5.4 of the Master Subscription Agreement and applicable law. Such data must not identify a Customer or individual, reveal Customer confidential content, or remain personal information under applicable law. Pseudonymization or conversion to an embedding alone does not make information de-identified.

The Service is not designed to make automated employment decisions. Its outputs are informational for human review and may be incomplete, inaccurate, or lack context. Customers are responsible for reviewing source information and outputs, addressing disputed assessments, and ensuring that any employment decision and use of AI complies with applicable law. A classification or violation label is not a verified finding of misconduct.

Optional webcam recording: Available in Bronze tier and above, this feature allows workers to broadcast their webcam alongside their screens. Customers enable the feature and may configure it as required for individual workers only where lawful. Webcam recordings may reveal the worker, other people, and the worker's surroundings. Customers must limit unnecessary capture and provide any required recording notices and obtain any required permissions.

Optional face verification: Marketed as "facial recognition" in Silver tier and above, this feature is off by default and enabled by the Customer per worker. Following the worker's separate written release, the worker takes a reference photo, which is stored in AWS S3 and approved by a Customer administrator. While the worker is broadcasting, the feature takes a webcam snapshot approximately every 60 seconds. InsightFace runs on our own AWS workers, computes face embeddings of the snapshot and reference photo in memory, and compares them using cosine similarity. Face embeddings and face scans are not persisted. A match, no-match or no-face result is stored on the recording and alerts are provided to the Customer. This processing does not use Bedrock or a third-party face API. Face embeddings or scans can constitute legally protected biometric identifiers or information even when they are not stored. Biometric data is used only for authorized face verification and legally required compliance, is never sold, leased, traded or otherwise profited from, and is not used to train any models. Its disclosure is subject to the specific limits in Section 7, and retention and destruction are described in Section 6 and our public Biometric Data Retention and Destruction Policy. These biometric restrictions limit the Statistical Data permission described above.

Worker notice and choice: We provide an in-app biometric notice and written-release flow using a checkbox and typed-name electronic signature, with an "I do not consent" option. We record the notice version, SHA-256 hash of its text, typed name, time, IP address, and user agent. No reference-photo capture or face comparison occurs without the worker's release; this requirement is enforced server-side and in the worker application. Workers may withdraw consent at any time in-app, stopping further face comparison and immediately destroying the reference photo. This release does not itself authorize webcam recording, replace the Customer's employer-side notices or policies, or establish that employment consent is valid under every applicable law.

Customers must not enable or use webcam recording or face verification for workers under 18. They must not enable face verification where they cannot lawfully do so, or for workers in the EEA or UK unless a separate written agreement with us addresses a lawful Article 6 basis, an applicable Article 9 condition, and other required safeguards. Customers must satisfy applicable employer-side notice, policy, labor consultation, and collective-bargaining requirements and must not bypass consent or withdrawal controls. Face-verification results may be inaccurate and must not be used as the sole basis for adverse employment decisions; a result is not a verified finding of misconduct. Each party remains responsible for its independent legal obligations.

Audio recording, keystroke logging, and emotion recognition are not features of the Service. Captured content may nevertheless reveal images, communications, health or financial information, or other sensitive content.

QR authorization: Where a Customer uses QR authorization, an image of the worker's screen or webcam is captured, stored in AWS S3, and sent to Google Cloud Vision to locate the QR code, which is then read on our own systems. These images can show the worker, their surroundings, or screen content. Google Cloud Vision is not used for face verification.

Customers are responsible for establishing a lawful monitoring purpose and basis; providing required notices before monitoring, including for any enabled webcam recording or face verification; obtaining acknowledgments, consents, or other authorization where required; and complying with applicable employment, communications-recording, biometric, and data-protection laws. These may include New York Civil Rights Law § 52-c, Connecticut and Delaware employee-monitoring laws, federal ECPA and state communications-recording laws, and applicable labor consultation requirements. An employee-monitoring acknowledgment does not necessarily satisfy every communications-recording consent requirement. Customers should define and communicate monitoring boundaries, including any personal-device or private-use restrictions.

Customer Data processing is subject to applicable Customer agreements, documented instructions, and law. Customers may request information about applicable data-processing terms and subprocessors at privacy@ontask.ai. We assist Customers with applicable privacy obligations as required by law and the relevant agreement.

5. How We Use Information

For our own website and business activities, we use relevant information to:

• Respond to inquiries, arrange demonstrations, and administer trial requests and business relationships.
• Create and administer accounts, authenticate access, process billing, and provide support.
• Communicate about the Service, maintenance, security, and changes to applicable terms or notices.
• Operate and protect our website and business, investigate misuse, prevent fraud, and enforce applicable agreements.
• Keep required business records, comply with legal obligations, and establish or defend legal claims.
• Market our Service where permitted by law and subject to your choices and any required consent.

Customer Data is used to provide, secure, support, and otherwise process the Service in accordance with authorized Customer instructions, applicable agreements, and law, including the monitoring and AI functions described above. The business-purpose list above does not authorize unrestricted reuse of Customer recordings for marketing or unrelated purposes.

Submitting a trial inquiry does not by itself provide consent to unrelated marketing or any consent that the law requires to be separately obtained. If we send marketing emails, they will include an unsubscribe method. You can also contact privacy@ontask.ai to opt out. We honor applicable opt-out deadlines; essential account, transaction, security, and legal communications may continue.

6. Retention and Deletion

We retain personal information only for as long as reasonably necessary for its identified purposes, applicable Customer instructions and agreements, and lawful recordkeeping or legal needs. Retention criteria differ by category:

• Trial, contact, account, support, and billing records: The time needed to address the inquiry or relationship, administer the account or transaction, and satisfy applicable accounting, legal, dispute-resolution, or compliance requirements.
• Screen and webcam recordings, screenshots, webcam snapshots, OCR, searchable embeddings, AI outputs, face-verification results, and other Customer Data: The duration needed to provide the Customer-authorized Service, subject to the Customer's lawful instructions, applicable agreement, and any required deletion or return obligations. Webcam snapshots are kept with recordings under the Customer's retention settings and deleted on account deletion, subject to any earlier legally required destruction. Derived records must be considered alongside their source content when implementing deletion.
• Face-reference photos and transient biometric processing: Reference photos are destroyed at the earliest applicable trigger: worker decline or withdrawal (immediately); the Customer disabling face verification for the worker; account deletion; 30 days after worker deactivation; three years after the worker's last interaction; or, for legacy references lacking recorded consent, 30 days after they are flagged. Destruction must occur earlier when the original collection purpose has been satisfied or applicable law requires. The legacy deadline does not authorize unconsented processing or unlawful retention. We operate a daily destruction job to enforce the applicable schedule. Face embeddings and face scans are processed in memory and are not persisted. See our Biometric Data Retention and Destruction Policy.
• Worker notice and written-release records: The period reasonably necessary to document the notice and worker's choice and satisfy applicable legal, dispute-resolution, and compliance requirements, subject to the applicable agreement and law.
• Session and preference information: The duration needed for the session or selected preference, subject to applicable legal requirements.

Relevant factors include whether an account or inquiry remains active, the nature and sensitivity of the information, the purpose for retaining it, applicable limitation periods, and legal holds. A legal hold or statutory recordkeeping requirement may require limited retention despite a deletion request. Customer Data return and deletion remain subject to the applicable Service agreement and any applicable DPA; those provisions, including any Customer choice between return and deletion and limits on legally required retention, control over these general criteria. The specific biometric use, disclosure, retention, and destruction requirements in Section 2.8 of the Master Subscription Agreement apply notwithstanding any longer general retention criterion, Customer setting, retrieval period, or routine backup schedule.

Deletion may involve separate live-system and backup processes. Any retained backup copies must remain protected, restricted from ordinary use, and subject to deletion within a period limited to what is reasonably necessary under applicable retention requirements and, for Customer Data, the Service agreement and any applicable DPA, unless law requires retention. If restored, previously deleted Customer Data remains subject to deletion obligations. Backups are not a basis for indefinite retention or ordinary reuse of deleted information. Contact us or, for Customer Data, the Customer for applicable retention and deletion details.

7. Disclosures and Providers

We disclose information as necessary for the purposes described in this policy, subject to applicable law, instructions, and contractual restrictions. Providers and recipients include:

• Amazon Web Services: Hosting, databases, S3 storage, Amazon Bedrock screen-activity AI inference, and Amazon SES email. Screen videos and screenshots are stored in S3 in the U.S. region us-east-1. AWS S3 also stores webcam recordings, webcam snapshots, and face-reference photos. Face verification runs using InsightFace on our own AWS workers, not Bedrock or a third-party face API.
• Ably: Realtime presence functionality.
• Stripe: Payment processing.
• Google: Optional Google sign-in; Google Fonts; Google Analytics (measuring how visitors use our public website, with advertising features off); Google reCAPTCHA (telling people from bots on website and portal forms).
• Google Cloud Vision: Locating QR codes in screen and webcam images submitted for QR authorization. These images can show the worker, their surroundings, or screen content. Google Cloud Vision is not used for face verification.
• Xirsys: Relaying live-view video connections between workers and authorized viewers when a direct connection is not possible. The video is relayed in encrypted form; Xirsys receives IP addresses and connection information.
• Telnyx: SMS delivery, including recipients' phone numbers and message content.
• Calendly: Demo booking when you choose to use that service.
• Customers and their authorized administrators: Access to their workspace and Customer Data consistent with their account permissions and instructions.
• Authorized reseller/MSP partners: Administration of Customer workspaces they administer, including through authorized "log in as" access. Such access can expose recordings, screenshots, OCR, AI outputs, search results, and exports available within the workspace. Relevant account, contact, and commission information may also be processed for the partner relationship.

Each provider receives information relevant to its function; this list does not mean every provider receives every category of information. Providers acting on our behalf must be subject to appropriate confidentiality, security, and data-use obligations. Some providers also act independently for their own services or legal obligations, such as payment compliance, and their notices apply to that processing. Partner access must be authorized and limited to the relevant administrative role; reseller status alone does not authorize unrestricted access to worker data.

Biometric disclosure limits: Biometric data used or generated for face verification is disclosed only to the Customer and its authorized personnel, AWS as processor, other recipients covered by the worker's legally valid consent, or as legally required. The general provider, Partner, adviser, legal-rights, and business-transfer disclosures in this section do not expand those limits. Customer authorization of a Partner does not by itself supply any separately required worker consent to a biometric disclosure.

We may also make disclosures you request or lawfully authorize; disclosures required by applicable law or valid legal process; and proportionate disclosures permitted by law to investigate fraud or security issues or protect legal rights. Customer Data disclosures remain subject to applicable Customer agreements and law. For legally compelled disclosure of Customer Data, we will give the Customer advance notice where legally permitted, consistent with the applicable agreement.

Information may be disclosed to appropriate advisers or transferred in connection with an actual or proposed merger, acquisition, financing, restructuring, or sale of a business or assets, subject to appropriate safeguards and applicable law. A business transfer does not itself authorize incompatible new uses without any legally required notice, legal basis, or consent.

8. Choices and Privacy Requests

Contact privacy@ontask.ai, call +1 (800) 460-4631, or write to our mailing address in Section 10 to submit a privacy request. Identify the relevant account or Customer, if known, and describe your request. Do not send sensitive documents unless needed and requested through an appropriate channel.

If your request concerns Customer Data, the Customer ordinarily decides how the request is fulfilled. Contact the Customer directly where possible. You may also contact us for help routing the request; we will assist as required by law and the applicable agreement. This applies to monitored workers and other people whose information appears in Customer Data. These routing arrangements do not limit your direct in-app choice to decline face verification or withdraw consent at any time. Withdrawal stops further face comparison and immediately destroys the reference photo. Contact privacy@ontask.ai if you need help with that choice or believe it has not been honored. We retain any duties that applicable law imposes directly on us.

We may seek proportionate information to verify identity or an authorized agent's authority when permitted or required. Verification information is used only for legally permitted verification and security purposes. Applicable opt-out requests do not require identity verification. We may limit a request only on grounds permitted by law, such as protecting another person's rights or satisfying a legal retention requirement, and will explain a refusal where required.

Rights and deadlines depend on the applicable law and our role. Sections 12, 15, and 16 provide additional information. Marketing choices are separate from statutory access, correction, deletion, and other requests. We do not require acceptance of new privacy terms to exercise a nonwaivable privacy right.

9. Security

We maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature and risks of the information processed. No system or transmission method is completely secure. This statement does not limit our applicable statutory or contractual security obligations.

Security concerns can be reported to abuse@ontask.ai. We make breach notifications required by applicable law and Customer agreements. For Customer Data, notification to the Customer is made without undue delay where required by applicable law or agreement.

10. Contact and Complaints

Privacy requests, preferences, and complaints: privacy@ontask.ai.

General inquiries and legal notices: hello@ontask.ai.

Security and abuse reports: abuse@ontask.ai.

Telephone: +1 (800) 460-4631. Support information is available on our Support page.

Mailing address:
Workforce Technologies Inc. (dba OnTask.AI)
2810 N Church St PMB 28466
Wilmington, Delaware 19802, USA

Contractual legal notices must be emailed to hello@ontask.ai with a copy to the mailing address above, Attn: Legal, in accordance with the applicable agreement. This duplicate-delivery instruction does not apply to ordinary privacy rights requests.

We address privacy complaints in accordance with applicable law. You do not have to contact us before making a complaint to a regulator where the law permits you to do so. Nothing in this policy requires arbitration or limits nonwaivable privacy remedies.

11. Children

Our website and Service are intended for business and workforce use, not directed to children. Children under 13 should not submit website inquiries or open an account. Customers must not deploy the Service to monitor children under 13 and must not enable or use webcam recording or face verification for workers under 18. Any otherwise permitted use involving minor workers must be lawful and subject to required protections; employer authorization does not automatically satisfy children's privacy laws.

Information about a child may appear incidentally in Customer screen content. If you believe we have collected children's information unlawfully, contact privacy@ontask.ai. We will investigate and take appropriate action, including deletion where required by law and coordination with the relevant Customer where applicable.

12. EEA and UK Privacy Rights

Where GDPR or UK GDPR applies, you may have rights to access and obtain a copy of personal data, correct inaccurate data, request erasure, restrict processing, and obtain or transmit qualifying data in a portable format. These rights have legal conditions and exceptions.

You may object to processing based on legitimate interests on grounds relating to your situation. You may object to direct marketing at any time, and the related marketing processing must stop. If processing depends on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Where applicable law provides protections concerning automated decisions, you may have rights to information, human intervention, to express your view, or to contest a decision. These protections depend on the decision and applicable legal regime; not every AI-generated classification is a legally significant automated decision. The Service is not designed to make automated employment decisions.

Submit requests through Section 8. We ordinarily respond within one month, taking account of legally permitted clarification procedures, extensions, and exceptions. Any refusal or fee must meet the applicable legal standard, such as the rules for manifestly unfounded or excessive requests, rather than mere inconvenience.

You may complain to a competent EEA supervisory authority, including where you live or work or where an alleged infringement occurred, or to the UK Information Commissioner's Office, as applicable.

For EEA or UK privacy questions, including requests for any applicable representative or data protection officer contact details, contact privacy@ontask.ai.

13. International Processing and Transfers

We process information in the United States, including video and screenshot storage in AWS S3 in us-east-1. Other provider processing or authorized access may occur outside your country. Data-protection laws and government-access rules can differ between countries.

Transfers requiring safeguards must be covered by an appropriate legal mechanism. Depending on the transfer, this may include the European Commission's applicable Standard Contractual Clauses, together with the UK Addendum or UK International Data Transfer Agreement for qualifying UK transfers, and any required transfer assessment and supplementary measures. Applicable onward-transfer obligations must also be addressed.

This policy does not itself establish a transfer mechanism. Before a transfer requiring safeguards begins, the applicable mechanism, required assessments, and necessary supplementary measures must be in place. Information about relevant processing or access countries and copies of applicable transfer safeguards may be requested at privacy@ontask.ai.

14. Lawful Bases

Where GDPR or UK GDPR applies to information we process as controller, the relevant basis depends on the purpose:

• Contract: Processing necessary to perform a contract with you personally or take steps at your request before entering one. A Customer's contract does not automatically make each worker or business contact a party to that contract.
• Legitimate interests: Responding to business inquiries, administering business relationships, providing support, protecting systems and legal rights, and lawful marketing where permitted, subject to the required balancing of interests and individual rights.
• Legal obligation: Processing necessary to comply with applicable legal duties, including required business recordkeeping.
• Consent: Processing for which valid consent is required, including relevant electronic marketing or technologies. Consent must be separate, informed, and withdrawable.

Required information may be necessary to respond to an inquiry, authenticate access, or provide a requested transaction; without it, the relevant function may not be available. For Customer-directed monitoring, the Customer must identify and establish its lawful basis and any additional condition for special-category or criminal-offence data. Employee consent is often unsuitable because of the employment power imbalance. Our processor instructions do not replace the Customer's legal basis.

15. California Privacy Disclosures

This section addresses the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and applicable regulations ("CCPA"), where they apply to our processing. It does not assume that every activity makes OnTask.AI a CCPA business. For Customer Data handled as a service provider or contractor, the Customer ordinarily handles business-side rights requests, with our required assistance. California employment and business-contact information is not categorically exempt.

The following categories describe information addressed by this policy. Sources are identified in Section 2. The purposes and recipient categories below apply only where the information is actually processed or disclosed; no recipient necessarily receives every item in a category.

Retention periods or criteria for these categories are described in Section 6: business and billing records follow the relationship and lawful recordkeeping criteria; screen activity, recordings, visual information, employment records, inferences, and incidental sensitive content follow the Customer Data criteria, subject to any earlier legally required destruction. Face-reference photos follow the specific earliest-trigger destruction schedule; face embeddings and scans are not persisted; webcam snapshots follow recording retention and account-deletion requirements. Worker notice and written-release records follow their compliance and recordkeeping criteria. Session and preference information follows the session/preference criteria.

You may use the request methods below for information about collection and disclosures concerning your personal information, including any applicable sale, sharing, or uses of sensitive personal information, and to exercise applicable opt-out or limitation rights.

Your rights, where applicable: You may request to know the categories and specific pieces of personal information collected, sources, purposes, and disclosure information; request deletion or correction; obtain information in a portable format; opt out of sale or sharing for cross-context behavioral advertising; and limit qualifying uses or disclosures of sensitive personal information. Access is not automatically restricted to the preceding 12 months where the law requires a longer period. You have the right not to be discriminated or retaliated against for exercising CCPA rights.

Submit requests by emailing privacy@ontask.ai or calling +1 (800) 460-4631. An authorized agent may use these methods. We may require legally permitted proof of authority and verification for applicable requests, recognizing valid powers of attorney. Opt-out and limitation requests do not require identity verification.

For applicable requests to know, delete, or correct, we confirm receipt within 10 business days and respond within 45 calendar days, unless a legally permitted extension applies and we provide the required notice. Applicable sale/sharing opt-out and sensitive-information limitation requests are processed as soon as practicable and no later than 15 business days. Requests are ordinarily free; any fee or refusal must be permitted by law and explained.

Before engaging in an activity that requires additional privacy-choice links, consent, or recognition of qualifying opt-out preference signals such as Global Privacy Control, we must provide the legally required mechanisms. A browser cookie setting or acceptance of this policy is not a substitute for those rights. Special opt-in requirements apply to any qualifying sale or sharing involving individuals under 16.

California residents may also request information about qualifying disclosures to third parties for direct marketing under California Civil Code § 1798.83, where applicable, through privacy@ontask.ai.

16. Other U.S. State Privacy Rights

Depending on your residence, the applicable law, our coverage under that law, and the processing involved, you may have rights to access, correct, delete, or obtain a portable copy of information; opt out of sale, targeted advertising, or qualifying profiling; and receive protections concerning sensitive data. Some laws provide additional rights to information about specific third-party recipients or qualifying profiling, including explanations, correction of underlying inaccuracies, or review and challenge of resulting decisions.

Many state comprehensive privacy laws exclude employment or business-contact contexts, but those exclusions do not necessarily cover ordinary website or consumer interactions. California has different rules. Applicable consent, minimization, and use restrictions may also limit processing even when information has been disclosed in a privacy notice.

Use the request methods in Section 8. Where an appeal right applies, email privacy@ontask.ai, identify the decision, and explain why you believe it should be reconsidered. We respond within the applicable legal period and provide required information about further complaints or regulator review. Authorized agents and qualifying universal opt-out mechanisms must be supported where required by the relevant law.

Nevada: Nevada residents may submit a verified request directing us not to sell their covered information as defined by applicable Nevada law, including NRS Chapter 603A, to privacy@ontask.ai. We respond to applicable requests within 60 days, with a permitted 30-day extension and notice where necessary. Nevada's definition of sale differs from CCPA sale and sharing.

17. Changes to This Policy

We may revise this policy and will post the updated version with a revised last-updated date. We provide additional notice, advance notice, or consent where required by law or an applicable agreement. Posting a revised policy does not itself authorize incompatible new uses of previously collected information or override required Customer instructions, existing rights, or consent requirements.