<p>Have a question about our security, terms of service, privacy policy, or GDPR compliance? Read on for answers:</p>
<div data-accordion="">
<h4>What is the GDPR?</h4>
<p>The <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation">General Data Protection Regulation</a> (GDPR) is a regulation designed to help citizens and residents of the European Union (EU) protect their personal data by specifying how such data may be collected, processed, and stored. At Doist, we're fully compliant as of May 25th, 2018.</p>
<h4>Is Doist GDPR compliant?</h4>
<p>Yes. Doist and our services, Todoist and Twist, are fully compliant with the GDPR as of May 25th, 2018.</p>
<h4>Are our customers able to use Doist products and services without risking a breach of the GDPR?</h4>
<p>Yes, from our end. Of course, if your customers are in a location where the GDPR applies, they need to make sure their business operation is compliant with the GDPR in its own right.</p>
<h4>What types of personal data does Doist collect?</h4>
<p>When registering for Todoist and/or Twist you voluntarily give us information such as your name and email address. You can access and update this information at any time in your personal Account Settings.</p>
<p>In addition, when you use our services, you give us consent to use the following data:</p>
<ul>
<ul>
<ul>
<li>Email</li>
<li>IP address</li>
<li>Device ID</li>
<li>Name and surname (optional, not processed)</li>
<li>Job (optional, not processed)</li>
<li>Phone number (optional, not processed)</li>
<li>VAT ID (optional)</li>
<li>Invoice address (for Pro and Business accounts)</li>
</ul>
</ul>
</ul>
<h4>Why does Doist collect personal data?</h4>
<p>The data we collect is required for us to provide you with our services and is used to improve Twist and Todoist.</p>
<h4>How can I access and export my personal data?</h4>
<p>To have your personal data exported, please <a href="https://todoist.com/contact" target="_self" rel="undefined">contact us</a>.</p>
<div class="box-note">
<p>We provide full access to data via our API, allowing you to obtain the personal data that was provided to us and/or transfer it to another controller. You can find our API for Twist and Todoist here:</p>
<p><a href="https://developer.todoist.com/sync/v7/#getting-started">https://developer.todoist.com/sync/v7/#getting-started</a></p>
<p><a href="https://developer.twistapp.com/v2/">https://developer.twistapp.com/v2/</a></p>
<p>Please note that payment information and integrations are not available via our API. In case you want to obtain this information, please <a href="https://todoist.com/contact" target="_self" rel="undefined">contact us</a>.</p>
</div>
<h4>How does Doist process data?</h4>
<p>Doist is considered a Data Processor which means that Doist controls how your user data is processed and is responsible for the data to be processed within GDPR regulations. Although Doist owns the code, databases, and all rights to the Todoist and Twist applications, you retain all rights to your data.</p>
<p>When it’s absolutely necessary, we use GDPR-compliant third-party services and hosting partners such as Stripe, AWS, and Google Workspace. In these cases, we take the necessary safeguards to ensure that we are GDPR compliant when sending and receiving data from a third party.</p>
<p>Check out Todoist’s <a href="http://todoist.com/security">security</a> and <a href="http://todoist.com/privacy">privacy</a> policies and Twist’s <a href="http://twist.com/security">security</a> and <a href="http://twist.com/privacy">privacy</a> policies for more information.</p>
<h4>Do you provide a list of relevant third-party services?</h4>
<p>Yes. When necessary, we use the following GDPR-compliant third-party services:</p>
<ul>
<li>Amazon Web Services</li>
<li>ChartMogul</li>
<li>CloudBees Rollout</li>
<li>Datadog</li>
<li>Meta (Facebook)</li>
<li>Firebase</li>
<li>Google Analytics</li>
<li>MailChimp</li>
<li>Mailgun</li>
<li>Microsoft Azure</li>
<li>Microsoft Visual Studio App Center</li>
<li>PartnerStack</li>
<li>ProfitWell</li>
<li>SendGrid</li>
<li>Sentry</li>
<li>Stripe</li>
<li>Zendesk</li>
</ul>
<h4>Do you process any Data outside the EU?</h4>
<p>Yes, we do. We process data in North Virginia, USA using Amazon Web Services (AWS). We only collect as little data as possible, and all data is encrypted using AES 256 encryption.</p>
<h4>Do you ever sell any data?</h4>
<p>No, we never sell data.</p>
<h4>Do you store any personal data once I've deleted my account?</h4>
<p>Upon <a href="https://get.todoist.help/hc/articles/203799822">deleting your account</a>, all your personal data will be removed from our production systems. Only an encrypted copy of your data will remain on our backup archives for 90 days. After this period, all data associated with your account will be deleted permanently. Please note that we don't provide the encrypted copy from our backup archives upon request. </p>
<h4>Does Doist offer a Data Processing Agreement (DPA)?</h4>
<p>Yes. We offer a DPA that has been pre-signed on behalf of Doist. It can be completed by filling out your details and signing it <a href="https://na2.docusign.net/Member/PowerFormSigning.aspx?PowerFormId=e9184e9b-eb12-49df-8e64-2c2a5b682f5c" target="_blank" rel="noopener">here</a>.</p>
<h4>How is personal data protected?</h4>
<p>We restrict staff access to personal data to a very small number of employees who need access for specific reasons to improve Todoist and Twist.</p>
<p>We regularly test, assess and evaluate the effectiveness of our processes and technology.</p>
<p>We use encryption to safeguard data.</p>
<h4>How is personal data encrypted?</h4>
<p>When user data is stored in servers and databases, Doist uses AES 256 encryption. When the data is being sent or received, it is encrypted with TLS 1.1 or above. Data backups on our servers are encrypted with AES256 and signed by RSA with 2048 key length.</p>
<p>Additionally, Todoist creates automatic backups within the app on a daily basis for Pro and Business users. We take the necessary safeguards to ensure that these are well protected by maintaining a security system that prevents unauthorized access.</p>
<p>Since GDPR has various requirements, your compliance needs will depend on your precise circumstances. If you have specific questions or needs, please <a href="https://todoist.com/contact" target="_self" rel="undefined">contact us</a>.</p>
<h4>How is my content protected? Can you read my content?</h4>
<p>User content, such as tasks and comments, resides in our data stores, which get shielded from internet traffic, and have a strict access policy inside the company. Access to it is audited, requires multiple layers of authentication, and is only allowed for a valid business purpose. In other words, there's no way for any entitled internal employee to access it without others knowing.</p>
<p>The need to access user content is pretty rare. However, it can happen that our customer service team requires access when troubleshooting content synchronization conflicts in shared (multi-user) projects.</p>
<h4><span>Are the deleted tasks also deleted from your servers?</span></h4>
<p>Yes, after a while. The system first marks records as deleted before actually deleting them. Soft deletions ensure content is inaccessible by client applications. Hard deletions occur later, deferred in time. The system's behavior supports our multi-device synchronization mechanisms. Records marked as deleted help synchronization algorithms to perform data state conflict resolution.</p>
<p>User content is also present in database backups. They exist for business continuity, in case we ever face a disastrous scenario of data loss, a long period of data unavailability, or data corruption. All data, including backups, are kept encrypted at rest. To date, we have never needed to use database backups.</p>
<p>Database backups do not allow access to each user's data. Instead, we can restore them into a live database, where regular data access controls apply. The backups are rotated automatically and won't last more than 94 days.</p>
</div>

Security, privacy and GDPR FAQ

Security, privacy and GDPR FAQ

Did you get the help you need?