Privacy Policy: taskCNX

taskCNX syncs your HubSpot tasks into Microsoft To Do. This policy explains exactly what we access, why, and how we protect it. We keep it short because we collect as little as possible.

If you are reviewing taskCNX for your organization, Security & data handling has the scope-by-scope detail: every permission we hold, a field-level table of what moves, and what we store.

What we access

HubSpot (with your admin’s consent): your tasks, and the names of the contacts, companies, and deals a task is linked to, so we can show that context in To Do. We read your account’s owners to map each person to their tasks. We write task completion, due date and priority back to HubSpot. If the owner of your HubSpot account turns on notes sync, we also write the notes you edit in To Do into that task's Notes in HubSpot. If the owner turns on follow-up tasks, completing a task whose notes contain #follow-up creates a new follow-up task in HubSpot for the same person.
Microsoft (with each user’s consent): your To Do tasks and task lists, and your basic profile (name, email) so we know whose tasks to sync.
Your Outlook calendar — optional. When you connect, an “Also watch my calendar” box is ticked by default; untick it and we don't ask. You can also allow it later by switching on a feature that needs it. We read it only while you have reminder scheduling or absence notices switched on. We ask for Calendars.ReadBasic, the narrowest permission that answers the question, and we read only when you are busy and whether a block is marked out-of-office. We never read the subject, location, or attendees of any meeting, though the same response carries them. Decline it and everything else still works.

We never read your CRM notes, emails, deals pipeline, or anything outside the tasks and the linked-record names above.

What we store

Encrypted OAuth tokens for your HubSpot portal and Microsoft account (needed to keep the sync running), and a record of which permissions you granted.
A mapping between each HubSpot task and its To Do task, plus a small activity log of sync actions.
Your name and email, your time zone, and the sync settings you choose — reminder timing, working hours, whether absence notices are on.
If you subscribe, your Stripe customer and subscription identifiers. Card details go to Stripe and never reach us.

We do not store the contents of your CRM records beyond what’s needed to render a task. Task links hold identifiers, dates and status — not the words in your tasks. Your calendar is read and used in the moment; the times we read are never written down.

How we use it

To run the sync you asked for, to support you, and to follow up with you about taskCNX (see If you contact us, or we contact you). We do not sell your data, use it for advertising, or train models on it.

We do not analyse your account. We don’t count your team’s overdue work, score anyone’s productivity, build reports about your portal, or use anything we can see in your CRM to market to you. Permission to read your tasks so they reach your To Do list is not permission to study them, and we treat those as different things. If we ever build something that does analyse your account, it will be a separate product you choose and consent to on its own — never an extension of this one.

If you contact us, or we contact you

This part covers people who fill in our contact form, email, text or call us, install taskCNX, or hear from us about it.

What we keep: your name, email address and company, your phone number if you text or call, what you wrote to us (and a voicemail recording and transcript if you leave one), and our replies. If you install taskCNX, we note whether you finished connecting it, never anything from your CRM. For businesses we think taskCNX could help, we may also collect a work name, role, company and business email from business data providers or the company’s own website.
How we use it: to answer you, to help you get set up, and to follow up about taskCNX. We write these messages with the help of AI tools, and a person at sthreelabs approves each message, or a whole series of follow-ups, before it goes out. The one exception is the instant “we got your message” reply, which uses wording we approved in advance.
Your choice: every follow-up email has an unsubscribe link, and replying STOP to a text ends texts. Once you opt out, we keep only your address or number on a do-not-contact list so we don’t contact you again. To have the rest deleted, email us.

To do this we use a few kinds of service providers: an email provider (sending and receiving mail), a text and phone provider, an AI service provider that helps draft and sort messages, a team chat service where we review drafts before they’re sent, and our CRM and hosting providers. They process your information only on our instructions, under contract, and not for their own purposes, and our AI providers do not use it to train their models. A current list of these providers is available on request at [email protected].

Who we share it with

We use a small set of subprocessors to operate the service: our cloud hosting provider, Stripe (billing; they never receive your task data), Postmark (transactional email), Cloudflare (off-site storage for our nightly database backups), Sentry (error monitoring; an error report can include the work email of the user it concerns), Google Analytics (anonymous visit statistics on our public marketing pages only; it does not run inside the app and never sees your task data), and PostHog (visit and click statistics on the same marketing pages only, stored in the US; if you follow a link we emailed you, it can tie your visit to your email address so we know the message reached you. It never runs inside the app and never sees your task data), and Apollo.io (our sales prospecting tool, on the same marketing pages only; it tells us which companies visit, and its partner LiveIntent may match your visit to a hashed version of your email address so we can see who looked. It never runs inside the app and never sees your task data). Each only receives what it needs for its function.

Cookies

Our public marketing pages use Google Analytics and PostHog, which set cookies to count visits and show us how people find taskCNX. PostHog does not record your session. Apollo.io and LiveIntent may recognize you from data they already hold about your email address; we use that only to know who is interested in taskCNX, never to sell or share it. The app itself sets only the session cookie needed to keep you signed in. No analytics or advertising cookies run once you are inside taskCNX.

If you are visiting from the EU, the UK or Switzerland, no analytics cookie is set and neither Apollo.io nor LiveIntent loads until you accept: we ask first, and declining is a single click. Your choice is remembered in your browser. To change it later, clear this site’s data in your browser and you will be asked again.

Security

All traffic is encrypted in transit (TLS). OAuth tokens are encrypted at rest. Access is limited to the systems that run the sync.

Retention & your choices

Uninstalling the app in HubSpot stops all syncing immediately. Thirty days later we erase your data. Every connected user, task link and sync record for your account is deleted automatically. The thirty days exist so that reinstalling, or fixing a broken connection, doesn’t lose your history; reinstall within that window and everything is exactly as you left it.

After the erasure we retain only your HubSpot portal ID and your billing history, which we need to keep prior invoices accurate and to stop the free trial being claimed repeatedly by the same account. Neither identifies an individual.

To have your data deleted sooner, or to request a copy, email us and we’ll take care of it.

Contact

sthreelabs LLC · [email protected] · Contact form