Privacy Policy

Effective 12 October 2026

This policy describes how MCC VENTURE (“we”) processes personal data in MCC TASK – on mcctask.com, admin.mcctask.com and in the iOS, Android and macOS apps. MCC TASK is a project and task management tool for teams; accounts are created by signing up (we approve every sign-up) or by an invitation from a team’s administrator. Each team works in its own workspace that other teams can’t see.

1. Controller and contact

The data controller is MCC VENTURE. For any privacy matter, contact us at task@mccventure.com.

2. Data we process

  • Account: name, email, role, language, profile photo (if you upload one), notification and appearance settings.
  • Content you create: projects, tasks, comments, attachments, labels, time entries, notes and voice recordings uploaded for task import.
  • Sign-in and security: one-time sign-in codes (stored hashed), sessions, passkeys (public key), IP address and device type in the security audit log.
  • Notifications: device push token in the mobile app (if you allow notifications).
  • API keys: your own Claude or OpenAI key if you add one – stored encrypted (AES-GCM) and never shown in full.

We do not collect location, phone contacts, health or payment data.

3. Why we process it

  • Running the service – sign-in, project collaboration, notifications (contract / legitimate interest of your team).
  • Security – auditing sign-ins and sensitive actions, abuse prevention (legitimate interest).
  • Product news by email – you can turn it off any time in Settings → Notifications.
  • AI features (turning notes and recordings into tasks, suggesting a project style) – only when you start them.

4. No ads, no tracking

We use no advertising, no third-party analytics or tracking, and we never sell data. We only use essential cookies (session, language, appearance).

5. Processors

The following providers process data solely to run the service:

  • Supabase – database and file storage, EU region (Ireland).
  • Railway – application server, EU region (Netherlands).
  • Vercel – web app hosting.
  • Resend – email delivery (sign-in codes, notifications).
  • Anthropic (Claude) – text processing for AI features, only when you start them.
  • OpenAI – speech-to-text for voice recordings, only when you upload one.
  • Apple / Google – push notification delivery to the mobile app.

If you connect MCC TASK to an AI app yourself (Claude, ChatGPT) in Settings → AI connections, that app reads and creates data on your behalf and processes it under the terms of your account with its provider. You can disconnect it any time in Settings.

Transfers to providers outside the EU rely on EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Under their API terms, Anthropic and OpenAI do not use this data to train models.

6. Retention

  • Account and content – while the account exists; project content belongs to the organisation and may remain after your account is closed, with your name anonymised on request.
  • Sign-in codes – 10 minutes; sessions – until sign-out or expiry.
  • Security audit log – as long as needed to keep the service secure.
  • Uploaded notes and voice recordings – kept with the import until you delete it; an import that produced no task is deleted together with its file.

7. Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. You can unsubscribe from product news at any time. Send requests to task@mccventure.com – we respond within 30 days. You may also lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

8. Account deletion

You can delete your account yourself in Settings → Delete account (on the web and in the apps). If you are the only person in your workspace, the whole workspace goes with it, including projects, notebooks and files; in a team, your work for the team stays with your colleagues as “Deleted user” and your personal data is deleted. You can also email task@mccventure.com from the address you sign in with – we then delete the account within 30 days.

9. Mobile and desktop apps

The app keeps its sign-in token in the device’s secure storage (Keychain / Keystore). It uses the camera and photo library only when you attach a file, and Face ID / Touch ID only for passkey sign-in. You can turn off push notifications in your device settings.

10. Children

The service is intended for work use and is not directed at children under 16.

11. Changes

We may update this policy; we will tell you about material changes in the app or by email.