Security and data protection
How we look after the data in the tools we build and run: where it lives, who can reach it, how it is protected, and what we do if something goes wrong.
Who is responsible
TaskCaddy LLC owns this program. Our founder is accountable for security and data protection and is the only person with access to production systems. Questions or concerns go to hello@taskcaddy.io.
Where data lives
The tools we run are hosted on Render, in the United States (Ohio). Data stays in the United States. Render stores it on disks that are encrypted at rest, and keeps our settings and keys in encrypted storage. Every connection to our tools uses HTTPS; plain HTTP is redirected to it.
How we classify data
- Secrets: passwords, API keys and the access tokens a platform gives us. Kept only in our host’s encrypted settings or on the encrypted disk, never in code, chat or email, and never shown on screen.
- Client business data: the orders, products, stock and costs a tool needs to do its job. Visible only to the client’s own people and to us when we are supporting them.
- Personal data of our clients’ customers: we keep as little as the tool needs. Our TikTok Shop app keeps none at all: buyer names, addresses, phone numbers and emails are dropped the moment an order arrives.
Who can reach it
Access follows least privilege. Inside a tool, each person signs in with their own account, and roles decide what they can see and change. Passwords are stored only as salted hashes, and repeated failed sign-ins lock the account for a while. Behind the scenes, only our founder can reach the hosting, the code and the keys, and every one of those accounts uses two-step sign-in.
Our devices and daily habits
The laptop we work from runs antivirus. We do not keep client data on paper or on removable drives.
How we build and update
We write our own software and keep outside code to a minimum: our TikTok Shop app runs on the Node.js standard library with no third-party packages. Every change passes our automated tests and a code review before it ships, and releases go out on purpose, never automatically. Our host keeps the servers underneath patched.
If something goes wrong
Report a suspected problem to hello@taskcaddy.io. Our founder leads the response: we contain it, find out what happened and what data was involved, and fix the cause. We tell affected clients, and any platform whose data is involved (such as TikTok Shop), without undue delay and within 72 hours of confirming an incident, and we keep a written record of what happened and what we changed.
Deleting data
We delete or correct data when a client, or a platform acting for its users, asks us to, within 30 days. When a client disconnects a platform, its access tokens are deleted straight away. When our work together ends, we delete that client’s data within 30 days, including the copies our host keeps as backups once they roll over.
Reviewing this page
We review this page at least once a year and whenever a tool starts handling a new kind of data. How each tool uses personal data is set out in our privacy policy.
Last updated: October 25, 2026