Data protection and security
Customer and provider responsibilities for information stored in TaskMaster Pro.
Version 1.0 · Updated 6 November 2026 · UK business service
Paid-launch review — technical checks remain open. Paid customer checkout remains closed until the agreement and operational checks are complete.
Who controls customer records
The business customer decides the purposes and lawful basis for personal information it enters, who may access it and when it should be removed. Fire Tree Digital processes that customer content to provide and support TaskMaster Pro. We separately control account, billing and support information as described in our privacy notice.
The customer must
- Give staff, clients and other people its own privacy information where required, and have a lawful basis for the information it enters.
- Restrict each user to the access needed for their work, remove departing users and protect sign-in accounts.
- Avoid unnecessary sensitive records and notify us promptly of suspected unauthorised access.
- Keep copies of records it must retain and verify any export before closing an account.
What Fire Tree Digital must do
We will use authenticated access controls, manage reported security incidents, assist with valid rights requests and process customer content under the agreed data processing terms. Base44 publishes platform security controls and its own data processing addendum. This does not replace our duty to verify TaskMaster Pro’s company boundaries, especially across HR and pay records.
Providers and locations
Base44, operated by Wix.com Ltd, hosts the app. Its public trust centre lists providers used for hosting, storage, backend functions, delivery and logs, including processing in the United States. Google may provide sign-in. Stripe handles billing data, with its own data processing terms and privacy roles. Provider arrangements and transfer safeguards must be checked against the final live configuration before paid launch.
Data processing agreement
A proposed customer data processing agreement is available on this site for review. It sets out the controller and processor roles, instructions, confidentiality, security, sub-processors, transfers, incident assistance, audits and return or deletion. It must be accepted with the final business subscription terms when checkout opens. It is not in force merely because someone visits this test site.
Open launch checks
Before accepting real paying customers, we must finish cross-company access tests, HR/payroll protection, the cookie inventory, a documented retention and deletion procedure, customer export, and the final provider and transfer schedule. Send data-protection questions or incident reports to digital@fire-tree.co.uk without attaching passwords or unnecessary sensitive files.