Privacy Policy

This Privacy Policy explains how TaskFuel collects, uses, shares and protects personal data when you visit taskfuel.ai, use app.taskfuel.ai, connect an AI agent or other client, buy credits, contact us, or use TaskFuel to access a paid third-party tool or API. Together, these services are called the Service.

Your use of the Service is also governed by our Terms of Service.

1. Who is responsible for your data

The controller responsible for personal data processed through the Service is:

In this policy, “TaskFuel,” “we,” “us,” and “our” refer to that operator.

2. Personal data we collect

We collect the following categories of data. The examples given under each are illustrative rather than exhaustive:

• Account and sign-in data: your name, email address and profile image, plus the session information that keeps you signed in. If you sign in with Google or GitHub, those services provide this according to your settings with them.
• Device and technical data: your IP address, browser and device information, the pages you request, and cookie or local-storage identifiers.
• Account connection data: your API keys and the connections you approve for AI or MCP clients, including when each is used. TaskFuel stores API keys in hashed form after delivery. A connected client may hold its own access token or API key.
• Payment and credit data: your balance and the ledger of what you add and spend, including which provider was called, refunds and disputes. Card payments are handled by Stripe. TaskFuel does not receive or store your full card number.
• Tool-call data: details of each call, such as the provider and endpoint, status, price and duration. TaskFuel processes the request and response content needed to route a call between your client and the selected provider. Where a call was paid for, we briefly hold the successful response so your client can fetch it if the connection dropped, currently for one hour; free and failed calls are not held this way. For troubleshooting, limited text from a failed provider response may be retained, currently up to 512 characters.
• Website and product analytics: how you use the site and app, such as pages viewed, features used, and errors. This includes session recordings, and linking an anonymous visit to your account once you sign in.
• Contact and support data: what you send us by email or support chat, including attachments.
• Provider application data: what you submit through the provider application form, such as your company name, website and service description.

You are not required to provide most of this. An email address is necessary to hold a TaskFuel account, so without one we cannot provide the Service. Card details are necessary to buy credits, and go to Stripe rather than to us. The rest is optional, or is generated automatically as you use the Service.

If you submit personal data about another person through a tool call, you are responsible for having permission or another lawful basis to do so.

3. How we use personal data

We use personal data to:

• create and secure accounts;
• connect authorized agents and clients;
• discover, quote, route, pay for, and return results from third-party tools;
• maintain balances, receipts, payment records, refunds, and disputes;
• provide support and respond to provider applications;
• detect abuse, fraud, security incidents, and technical failures;
• measure and improve the Service;
• send service messages and, where permitted, product communications;
• comply with legal, tax, accounting, and regulatory obligations; and
• establish, exercise, or defend legal claims.

Where the GDPR, UK GDPR, or a similar law applies, our legal bases are:

• performance of a contract when we provide your account, credits, connected clients, and paid tool calls;
• legitimate interests in securing, operating, troubleshooting, and improving the Service, provided those interests are not overridden by your rights;
• consent, where we ask for it, for product communications and other optional processing; and
• legal obligations for records we must keep or disclosures we must make.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

4. When we share personal data

We share personal data only as needed for the purposes described above:

• Tool and API providers you select: TaskFuel forwards your request to the provider shown for that call. The provider receives the URL, method, permitted headers, request body, and technical information needed to answer. Its own privacy policy and terms apply. A quote or dry run also contacts the provider, even if no payment is made. Use dummy data when requesting a quote, and do not send personal, proprietary, or customer data unless it is necessary and authorized.
• Sign-in providers: Google and GitHub process information when you use their sign-in services.
• Payment provider: Stripe processes card, billing, fraud-prevention, and transaction data on its hosted checkout service.
• Hosting and network providers: Cloudflare and Fly.io process traffic and operational data to host, protect, and deliver the Service.
• Analytics and diagnostics providers: PostHog processes analytics, product events, and session recordings. Sentry processes application errors and performance traces.
• Support and communications providers: Chatwoot processes support-chat data. Customer.io receives email addresses, account identifiers, and communication events through PostHog, and uses them to deliver service or product messages.
• Connected clients: an AI client or MCP application that you authorize may access your TaskFuel account and make calls within the granted permissions.
• Professional advisers, authorities, and transaction parties: we may disclose data when reasonably necessary for legal advice, compliance, security, enforcement, or a merger, financing, acquisition, or sale of assets.

TaskFuel does not sell personal data.

5. Cookies, local storage, and session replay

The Service uses:

• necessary cookies set by TaskFuel itself for sign-in, account sessions, security, and requested functionality;
• PostHog cookies and local storage shared across taskfuel.ai and app.taskfuel.ai to recognize visits, connect anonymous activity to an account after sign-in, measure product use, and support session replay; and
• storage used by the Chatwoot support widget to maintain chat functionality.

You can block or delete cookies through your browser, although this may affect sign-in, support chat, or other functionality.

6. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including providing the Service, maintaining security, meeting legal and accounting obligations, handling disputes, and enforcing agreements.

We retain account and connection data until you ask us to delete your account by emailing [email protected]. After verifying the request, we delete or anonymize personal data associated with the account unless we need to retain it for legal, accounting, fraud-prevention, security, or dispute-resolution purposes.

Stored responses to paid calls expire automatically after a short period, currently one hour. Payment and ledger records may be retained for as long as applicable tax, accounting, payment, or dispute rules require. Support, analytics, diagnostic, and provider-application data is kept according to operational need and the configured retention periods of the relevant service providers. Backup copies may remain for a limited period after deletion.

7. International data transfers

TaskFuel and its providers may process data in countries outside the one where you live. Where required, we use a recognized legal mechanism for these transfers, such as an adequacy decision or standard contractual clauses.

The provider you select for a tool call may operate in another country. Review that provider’s privacy information before sending personal data.

8. Security

We use technical and organizational safeguards designed to protect personal data. These include encrypted network connections, restricted access, hashed API-key storage, and security monitoring. No online service is completely secure, so we cannot guarantee absolute security.

If a personal data breach occurs that is likely to result in a high risk to your rights, we will notify you without undue delay, and we will notify the relevant supervisory authority where the law requires it.

Keep TaskFuel API keys and connected-client credentials private. Revoke a key or connection if you believe it has been exposed.

9. Your choices and rights

Depending on where you live, you may have the right to:

• access personal data we hold about you;
• correct inaccurate data;
• request deletion;
• restrict or object to processing;
• receive portable account data;
• withdraw consent; and
• complain to your local data protection authority.

These rights can be limited where the law allows or requires us to retain data, including payment, tax, security, or dispute records.

To exercise a right or ask a privacy question, email [email protected]. We may need to verify your identity before acting on a request.

You can also sign out, revoke API keys, and revoke connected clients through the Service. To request account deletion, email [email protected] from the email address associated with your account.

10. Children

The Service is for adults. Our Terms of Service require you to be at least 18, or the age of legal majority where you live. The Service is not directed to children, and we do not knowingly collect personal data from anyone below that age. If you believe someone below it has provided personal data, contact us so we can review and delete it.

11. Changes to this policy

We may update this policy when the Service, our providers, or legal requirements change. We will post the updated version here and change the “Last updated” date. If a change materially affects your rights, we will provide additional notice where required.

12. Contact

For privacy questions or requests, contact: