Privacy policy
What information we collect about customers and Taskers, why, and your rights.
TaskPly · Last updated: 2026-11-05
Who we are
TaskPly (contact@taskply.com) decides how your personal data is used for the TaskPly app and website, in line with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, as it applies. TaskPly is currently run by an individual in Sri Lanka. If it moves to a company, we will tell you first, and that company will then be responsible for your data. The main duties in the Act on how personal data is handled start on 1 January 2027 (Gazette Extraordinary No. 2498/16 of 22 July 2026). The Data Protection Authority’s Personal Data Protection Circular No. 01/2026 of August 2026 explains how the Act applies in the public sector. TaskPly is not a public body, so the circular is not addressed to us, but we use it as a guide.
What we collect from everyone
Name, date of birth, address, NIC or ID number, mobile number, email (if given), district and town, language, the tasks, offers, questions, messages, photos and voice notes you add, ratings and reviews, notification settings, device push tokens and basic security logs.
Extra information from Taskers
For verification: NIC number, NIC front and back images, selfie, address proof, work experience, service categories and, for professional categories, registration or licence details. NIC and ID numbers and documents are encrypted when stored. Only authorised staff can open them, and each view is recorded. Staff review them by hand; we do not use automated face recognition. After staff review and accept your documents, they can permanently delete the images from our system, to protect your privacy and lower the risk of a data breach. We keep a record that the documents were checked, by whom and when. Deleted images may stay in encrypted backups for up to 14 days. If your details need checking again later, we may ask you to upload them again.
How we protect sensitive details
Your name, NIC or ID number, date of birth and address are encrypted when saved on our servers. They cannot be read from the database or its backups without our encryption key, which is kept apart from the database. They are decrypted only when needed to run the service, for example to show your name to people you deal with. Your phone number and email address are not encrypted, because we use them to sign you in and contact you. Encryption lowers the risk, but no system can be guaranteed completely secure.
Why we use it
To run accounts and sign-in, match tasks with Taskers (by interests and district), verify Taskers, keep the marketplace safe, handle support and disputes, send notifications and SMS, and meet legal duties.
Legal basis
We use your data because it is needed for our agreement with you (accounts, tasks, offers, messages, support and agreement copies); to meet legal duties (accounting records and lawful requests); for our legitimate interests in keeping TaskPly safe and preventing fraud and misuse, which you can object to; and with your consent for optional things such as phone location, camera, photos, microphone and notifications, which you can turn off at any time.
What you must give us
Your name, mobile number, email, date of birth, address and NIC or ID number are needed to make the agreement with you, so we cannot open an account without them. Taskers must also give the verification details above, or they cannot be approved to make offers. Other things, such as photos, voice notes and location, are your choice, and you can use the rest of the app without them.
Automated decisions
We do not make decisions with a legal or similarly serious effect on you by automated means alone. The app uses your interests and district to choose which task alerts to send you, and the AI assistant answers support questions, but staff decide Tasker approval, account holds, suspensions and disputes. You can ask for a person in the support chat.
Who can see it
Other users see your public profile, ratings and the tasks you post. Exact contact and location details are shared only as needed for a booked task. Our service providers process data only for TaskPly: a cloud hosting provider, Notify.lk (SMS), Google Firebase (push notifications), Google Gemini (support assistant) and Zoho (business email). We never sell your data. We may share information with the police, courts, regulators or our legal advisers where the law requires it, or where reasonably needed to protect people’s safety or to bring or defend legal claims. A member who receives your details for a booking is responsible for how they use them.
Support chat
Messages you send to the support chat are processed by an AI assistant (Google Gemini) to answer you and are kept with your support history. Do not share one-time codes, passwords or NIC numbers in chat.
How long we keep it
Account details and verification documents: while your account is active, and deleted when the account is deleted. Tasks, messages, payment and audit records: kept for accounting, disputes, fraud prevention and legal duties for up to 7 years, without your personal details once your account is deleted. Support chats are deleted with your account. Accounts not used for 24 months are closed after notice, and old records are deleted automatically when the 7 years end. Database backups are encrypted and replaced within 14 days, so deleted data can remain in them until then. Verification images can be deleted earlier, after staff review and accept them.
Website visits
When you visit taskply.com, we count the pages viewed, the website you came from, your type of device and browser, and your approximate town and country. A location service outside Sri Lanka (ipapi.co or ipwho.is) works out the place from your internet address, and we do not store that address. We use no tracking cookies for this. The visitor code we keep changes every day and is not used to identify you. We do this for our legitimate interest in understanding and improving the website, and we delete these records after 13 months. If your browser sends a Global Privacy Control signal, we do not count your visit.
Location, camera, microphone and photos
The app uses your location only when you choose to pin where a task is, and never in the background. The camera and photos are used only when you add photos to a task or upload verification documents. The microphone is used only when you record a voice note. You can refuse these permissions and still use the rest of the app.
Payments
Customers pay Taskers in cash, so the app does not collect card or bank details from customers. We keep a record of each job price.
Where your data is stored
Our servers are hosted by a cloud hosting provider in Singapore, so your data is stored and processed outside Sri Lanka. Some service providers may also process data in other countries. Data is sent over encrypted connections, and we use providers only for the purposes in this policy.
Deleting your account
You can delete your account in the app under Account, then Delete my account, or at taskply.com/en/delete-account. This deletes your name, date of birth, address, NIC or ID number, phone number, email, profile, Tasker verification documents, work preferences, support chats and notifications. Past tasks, payment and audit records needed for accounting, disputes, fraud prevention and legal duties are kept without those personal details.
Under-18s
TaskPly is only for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has an account, please tell us at contact@taskply.com and we will remove it.
Data breach notification: What a data breach is
A data breach is when personal data is lost, seen, changed or shared without permission, for example through a hacked account or a mistake by staff or a service provider.
Data breach notification: What we do
We act at once to stop it, find out what happened and which data and people are affected, fix the cause and keep a record.
Data breach notification: Who we tell
We notify the Data Protection Authority of Sri Lanka as the Personal Data Protection Act requires. If the breach is likely to put you at real risk, we also tell you without undue delay by SMS, email or in the app.
Data breach notification: What we tell you
What happened, what data was involved, what we are doing, what you can do to protect yourself, and how to contact us.
Data breach notification: What you can do
Never share one-time codes, and tell us at once at contact@taskply.com if you think your account or data has been misused. You can also complain to the Data Protection Authority.
Inactive accounts and deletion: Inactive accounts
If you have not signed in for 24 months, we may close your account. We will send a notice by SMS at least 30 days before. Signing in during that time keeps your account open.
Inactive accounts and deletion: Deleting your account yourself
In the app, go to Account, then Delete my account. On the web, use taskply.com/en/delete-account. If you cannot sign in, email contact@taskply.com from your registered email or give your registered mobile number, and we will reply within 30 days.
Inactive accounts and deletion: What is deleted
Your name, date of birth, address, NIC or ID number, phone number, email, profile, Tasker verification documents, work preferences, support chats and notifications. Your open tasks are cancelled and pending offers are withdrawn.
Inactive accounts and deletion: What is kept
Past tasks, payment and audit records needed for accounting, disputes, fraud prevention and legal duties are kept for up to 7 years, without those personal details.
Inactive accounts and deletion: When an account cannot be closed yet
Booked work and open disputes must be dealt with first. We will tell you what is outstanding. Your right to complain is not affected.
Your rights
You may ask to see, correct or delete your data, withdraw consent for optional uses, or object to processing, by emailing contact@taskply.com. We normally reply within one month, and will tell you if we need longer or cannot agree and why. You can also complain to Sri Lanka’s Data Protection Authority. If we have a data breach affecting you, we follow the data breach steps in this policy. To ask for a copy of your own data, go to Help Centre, then Ask for a copy of my data, or email us. We check that it is you, and the copy contains only your own data. We reply in writing within one month, or up to three months if we tell you why before the month ends. We may refuse or limit a request only where the Act allows, for example to protect other people’s rights, for a legal inquiry or crime prevention, where the law requires us to keep the data, or where we cannot confirm who you are. Requests are free of charge unless the Authority’s rules allow a fee. If we refuse, we give our reasons unless the law prevents it, and tell you that you can appeal to the Data Protection Authority.
Questions about these policies: contact@taskply.com