Privacy Policy

Last updated: 19 September 2026

This policy explains what information TODO collects when you use the todo.work website, application and API (together, "the Service"), what we do with that information, and the choices you have. If anything here is unclear, write to us at mail@todo.work.

Who we are

TODO is a business work management platform: tasks, projects, customers, time tracking, chat, calls and business processes in one workspace. It is operated by Wizzo Software ltd. For anything concerning this policy or your data, the address is mail@todo.work.

What we collect

Account details you give us when you register or are invited to a workspace: name, email address, phone number, profile picture, job title, and the workspace you belong to.
The content you put into your workspace: tasks, projects, comments, files, chat messages, calendar events, time entries, customer and supplier records, and anything else you or your colleagues create in TODO.
Technical information collected automatically: IP address, browser and device type, operating system, language, the screens you open and the time of each request, and error reports when something breaks.
Cookies and similar technology, used to keep you signed in, to remember your preferences and to measure how the Service is used. You can clear or block them in your browser, but the Service cannot keep you signed in without them.
Payment details, when you buy a subscription. Card details are entered on the payment provider's page and are handled by that provider. We keep the record of the transaction, not your full card number.

What we use it for

To provide the Service: to show you your work, sync it between your devices and your colleagues, and send the notifications you asked for.
To keep accounts secure, prevent abuse and investigate problems.
To support you when you contact us.
To bill subscriptions and keep the records the law requires us to keep.
To improve the Service: to understand which features are used and to fix what is broken.
To send service messages (a password reset, an invoice, an important change). Marketing email is sent only where it is permitted, and every such message carries an unsubscribe link.

We do not sell personal information, and we do not use the content of your workspace to target advertising at you or at anyone else.

Your workspace and its administrator

TODO is a tool for organisations. When you work in a workspace that belongs to an employer or a client, that organisation controls it: its administrators can see the content created in it, add and remove members, change permissions, export data and close the workspace. If you use TODO under an organisation's account, that organisation's own policies apply to the content alongside this one.

Who else sees the information

Service providers who work for us and only on our instructions: hosting and file storage, email and SMS delivery, push notifications, payment processing, error monitoring.
Tools you connect yourself. You can connect TODO to outside tools (for example ChatGPT, Claude, Google Calendar, WhatsApp), or give an application access through our API. Such a connection is made by you, by hand, on a consent screen that states what the tool will be allowed to do, and it reaches only what the person who approved it is allowed to reach. Read only access can be chosen on that same screen. A connection can be disconnected at any moment under Settings, API keys, and it stops working immediately.
Authorities, where the law requires it, or to protect our rights, our users and the safety of people.
A buyer or a successor, if the business or part of it is ever transferred. The information stays subject to a policy no less protective than this one.

Artificial intelligence features

TODO includes assistants that can summarise a conversation, draft a reply, transcribe a call or answer a question about your work. To do that, the content you send to the assistant is processed by AI providers on our behalf. We use their business services, whose terms do not allow your content to be used to train their models, and an administrator can switch these features off for the whole workspace.

Where the information is kept, and how

Data is stored on secured servers rented from professional hosting providers in Europe, and is processed by our team in Israel. Traffic is encrypted in transit, passwords are stored hashed and never in readable form, and access by our staff is limited to the people who need it for support and maintenance and is logged. No system is perfectly safe and we do not claim that ours is. We do undertake to treat a security incident seriously and to notify those affected where the law requires it.

How long we keep it

Workspace content is kept while the workspace is open, and for as long as the organisation that owns it wants it kept. When an account or a workspace is closed we delete or anonymise the data within a reasonable period, except what we must keep for accounting, legal or security reasons. Backups are kept for a limited period and are overwritten in the normal course of work.

Your rights

You may ask to see the personal information we hold about you, to correct it, to receive a copy of it, or to have it deleted. Write to mail@todo.work from the address on the account and we will handle the request. Where the information lives inside an organisation's workspace we may need to refer the request to that organisation, which controls it. Residents of Israel have these rights under the Protection of Privacy Law, 5741-1981; residents of the European Union have them under the GDPR and may also complain to their local supervisory authority.

Children

The Service is a business tool and is not intended for children under 16. We do not knowingly collect information from them. If you believe a child has given us information, write to us and we will delete it.

Changes to this policy

We may update this policy. The current version is always on this page, with the date at the top. A change that materially affects your rights will also be announced inside the Service.

Contact

Questions, requests and complaints about privacy: mail@todo.work.

The full terms of use are here: Terms of Use.