Privacy Policy

CG-TODO · Effective date: 16 September 2026

This Privacy Policy describes how Charles Technologies ("we", "us", "our") collects, uses, stores and protects information when you use the CG-TODO mobile and web application (the "App"). CG-TODO is a workplace task-management application provided to employees and authorised members of an organisation. Accounts are created and administered by your organisation, and your use of the App is governed by this Policy together with your organisation's own workplace policies.

1. Information we collect

Information provided by you or your organisation

• Account details — your name, work email address, role, department and login credentials. Passwords are stored only in irreversibly hashed form; we cannot read them.
• Profile photo (avatar) — if you choose to upload one.
• Work content — tasks, sub-tasks, comments, lists, calendar events, and file attachments you create or upload while using the App.

Information collected automatically

• Device and push information — if you enable push notifications, a device push token (Firebase Cloud Messaging registration token), your device platform, and an app installation identifier, used solely to deliver notifications you have opted into.
• Technical and log data — basic request logs (such as timestamps and IP addresses) generated in the ordinary course of operating and securing the service.

The App does not collect your location, contacts, browsing history or any advertising identifiers, and it contains no advertising or analytics SDKs from ad networks.

2. How we use information

• To operate the App: authenticate you, display and synchronise tasks, delegation, comments, attachments and dashboards within your organisation.
• To send in-app and (if enabled by you) push notifications such as task assignments, reminders and status updates, in accordance with the notification preferences you set inside the App.
• To maintain security, prevent abuse, troubleshoot problems and keep the service reliable.

We do not sell, rent or trade your personal information, and we do not use it for advertising or profiling.

3. Permissions the App requests

• Notifications — to deliver task reminders and updates. Optional; the App works fully without it.
• Camera / photo library / files — only when you choose to upload a profile photo or attach a file to a task. The App accesses only the items you select.

4. Where information is stored and shared

Your data is stored on Microsoft Azure cloud infrastructure (Azure Database for MySQL and Azure Blob Storage). File attachments and avatars are kept in a private storage container and are served only through short-lived, access-controlled links. We use Google Firebase Cloud Messaging solely to deliver push notifications to devices that have opted in.

Beyond these infrastructure providers, information is shared only:

• within your organisation, according to the App's role-based permissions (for example, task content is visible to colleagues involved in that task, and administrators can view organisation-level dashboards);
• where required by law, regulation or valid legal process.

5. Security

All communication between the App and our servers is encrypted in transit using HTTPS. Access to the service is protected by token-based authentication with short-lived access tokens, passwords are stored using industry-standard bcrypt hashing, and stored files are accessible only through time-limited signed links. While no system can be guaranteed absolutely secure, we apply reasonable security practices and procedures appropriate to the nature of the data.

6. Data retention and deletion

Your information is retained for as long as your organisation maintains your account and as needed to provide the service. Work content (tasks, comments, attachments) forms part of your organisation's records and is managed under its direction. When your account is removed by your organisation's administrator, or upon a valid deletion request, associated personal data is deleted or anonymised within a reasonable period, except where retention is required by law.

To request access, correction or deletion of your personal data, contact us at the address below or ask your organisation's administrator.

7. Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may request access to, correction of, or erasure of your personal data, and you may withdraw consent for optional features (such as push notifications) at any time through your device settings or the App's notification preferences. We will respond to verified requests within a reasonable timeframe.

8. Children

CG-TODO is a workplace application intended for use by adults in a professional context. It is not directed to, and we do not knowingly collect personal information from, anyone under 18 years of age.

9. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the App or by other reasonable means, and the "Effective date" above will be revised. Continued use of the App after changes take effect constitutes acceptance of the updated Policy.

10. Contact us

If you have questions, concerns or grievances regarding this Policy or the handling of your personal data, please write to the email address above and we will endeavour to resolve them promptly.