Privacy Policy

1. Short Summary

2. Who Is Responsible

This policy is issued by MultiTasker LLC, a limited liability company formed in the State of Wyoming, United States, with its registered office at 30 N Gould St, STE R, Sheridan, WY 82801, United States. For the purposes of European and United Kingdom data protection law, we are the controller of the personal information described in section 3.

Privacy inquiries: privacy@multitasker.llc.

3. Information We Collect

3.1 Information You Give Us

• Contact and inquiry details — your name, email address, company name, telephone number if you provide one, and the content of your message.
• Client and engagement details — billing name and address, purchase order or tax registration numbers, the scope of work, and correspondence about the engagement.
• Access credentials — where you choose to give us access to your domain registrar, hosting, website, analytics or social accounts so that we can perform the Services.
• Client portal account — if you register for the client portal, your sign-in email, the business profile you fill in, and your two-factor sign-in settings.

3.2 Information Collected Automatically

Our web server keeps a standard access log for security, abuse prevention and diagnostics. Each entry records the requesting IP address, the date and time, the page requested, the HTTP status code, the number of bytes sent, the referring page if any, and the browser user-agent string. These logs are kept on our own server, are not used to build a profile of you, are not shared for advertising, and are deleted on a rolling basis (see section 10).

If you sign in to the client portal, we also record the IP address and browser of each sign-in session, and the IP address against changes made in the account, so that we can keep accounts secure and investigate problems. Sign-in sessions are deleted when they expire; the record of account changes is kept with your client records.

When you accept the terms of a subscription in the portal, we keep a record of that acceptance: who accepted, when, the plan and price, the versions of our Terms of Service and Refund & Cancellation Policy that applied, and the IP address and browser used. California law requires us to keep it for at least three years.

3.3 Payment Information

Card payments are handled by our payment processor, Stripe. We receive confirmation of payment and limited details such as the card brand, the last four digits, the expiry date and the billing country. We do not receive or store your full card number, and we never store card security codes.

If you keep a card on file in our client portal, Stripe stores the card and we keep only Stripe’s reference to it and the details above, so that we can charge the invoices and plans you have agreed to on the day they are due. You can remove a card at any time from Billing in the portal, after which nothing is charged to it.

Paid Findable plans are sold through Stripe’s Managed Payments service, in which Stripe, through its Link service, is the seller of record. For those purchases Stripe collects your payment and billing details itself and handles them under its own privacy policy; we receive the same limited details described above.

3.4 Tilly Call Information

Tilly is our AI phone receptionist. When it answers a call for a business that uses it, it processes what the caller says in order to take their inquiry: the calling number, the name, callback number, suburb and request the caller gives, a written transcript of the conversation, and the call’s time and length. That record is kept for the business that the caller rang, which decides how it is used; for that information we act for the business as described in section 15. Calls reach Tilly through a telephone carrier in the United States. The receptionist’s speech recognition, voice and replies are provided by an AI model provider, which processes the call in the United States. The call audio itself is not recorded or stored. Callers are told at the start of the call that they are speaking to an AI and that the call is transcribed. The call record is held on our server in Australia for the period the business chooses (30 days unless it sets between 7 and 365 days) and is then deleted automatically.

3.5 Buildable Chats and Files

Buildable is our AI builder. When you use it, what you write in a Buildable chat, the files you share there and the files it produces are processed by an AI model provider in the United States to run the service. We keep each chat and its files with your client account so that our engineers can review the work and answer you.

3.6 Information We Do Not Want

Please do not send us sensitive personal information — such as government identification numbers, health information, biometric data, precise geolocation, or details of racial or ethnic origin, religious beliefs, political opinions, trade union membership or sexual orientation — unless we have specifically asked for it and explained why it is needed.

4. Cookies and Tracking

We set no analytics cookies unless you accept analytics, and we set none for advertising under any circumstances. We do not fingerprint visitors, run no heatmaps or session recording, and sell nothing about you to anybody.

The only cookies we set without asking are ones the site needs to do what you asked: if you sign in to the client portal, a sign-in cookie that keeps you signed in (up to 30 days), a short-lived one while you set up two-factor sign-in, and one that remembers you have dismissed the portal’s welcome tour; and, if you choose a currency, the currency cookie described in section 4.1. None of them is used for analytics or advertising, and none is shared with anyone.

What Runs Before You Choose

Every page loads Google Analytics 4 from Google's servers. Because that file is fetched from Google, Google receives your IP address and browser details as part of the request — the same as for any file loaded from another website. Until you accept, the tag runs in Google's consent mode with storage denied: it sets no cookie, keeps no identifier for you, and what it reports back is aggregated rather than tied to you or joined up across visits.

What Changes If You Accept

Accepting turns on analytics storage. Google Analytics then sets its own cookies (named _ga and _ga_ followed by our property id, which by default expire after two years) so repeat visits from the same browser can be counted as one visitor. We use this to see which pages are read and where visitors arrive from. Nothing else.

What We Never Turn On

Advertising storage, advertising user data and ad personalization are denied permanently and are not part of what the banner asks you. We run no advertising, no remarketing and no advertising conversion tracking on this website.

Preferences Kept in Your Browser

Two small values are held in your browser's local storage rather than as cookies, and neither is ever transmitted to us: the light or dark theme you picked, and your answer to the consent banner. Clearing your site data removes both, and the banner will ask again.

You can change your answer whenever you like using Cookie Settings at the bottom of any page.

4.1 Currency

We show prices in Australian dollars to visitors in Australia and in US dollars to everyone else. To decide, our server checks which country your IP address belongs to against a list kept on our own server (IP geolocation by DB-IP); the address is not sent anywhere and the result is not stored. If you choose a currency yourself, a cookie called mt_cur remembers that choice for a year. It is a preference, not tracking, and you can clear it at any time.

5. How We Use Information

We use personal information to:

• respond to your inquiry and correspond with you;
• prepare proposals and quotations;
• provide, maintain and support the Services;
• issue invoices, take payment and chase unpaid amounts;
• keep accounting, tax and corporate records required by law;
• secure our systems, prevent abuse, and investigate incidents;
• send service and administrative messages about work in progress; and
• establish, exercise or defend legal claims.

We will only send you marketing email if you have asked to receive it or are an existing client and the message concerns similar services. Every marketing email will identify us, include our postal address, and carry a working one-click unsubscribe link that we act on promptly, as required by the US CAN-SPAM Act. Unsubscribing from marketing does not stop necessary service messages about work we are doing for you.

6. Legal Bases (EEA / UK Visitors)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Contract — to take steps at your request before entering an agreement, and to perform an agreement with you.
• Legitimate interests — to run and secure our business, keep records of our dealings, prevent fraud and abuse, and pursue payment. We balance these against your rights and interests.
• Legal obligation — to meet accounting, tax and other statutory duties.
• Consent — for analytics cookies (section 4) and optional marketing email, either of which you may withdraw at any time without affecting the lawfulness of prior processing.

7. When We Share Information

We do not sell, rent or trade personal information. We disclose it only in these circumstances:

• Service providers we rely on — a small number of vendors who process information on our instructions and under contract, in the categories of: web and email hosting and infrastructure, including encrypted backup storage; email delivery; payment processing (Stripe); website analytics (Google Analytics, as described in section 4); telephone carriage for Tilly calls (a telephone carrier in the United States); speech recognition and AI language services (an AI model provider in the United States for Tilly calls, for Findable’s written reports and for Buildable); accounting and bookkeeping; and business software such as file storage and project tracking. They may use the information only to provide their service to us.
• Professional advisers — lawyers, accountants and insurers, where they need it and are bound by confidentiality.
• Legal and safety — where we are required by law, court order or valid legal process, or where disclosure is necessary to protect our rights, property or safety, or that of our clients or the public.
• Business transfer — if we are involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction. We will require the recipient to honor this policy or give you notice of any change.
• With your direction — where you ask us to share it, for example with a platform or another supplier of yours.

8. We Do Not Sell Your Information

MultiTasker LLC does not sell personal information, and does not share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and comparable state laws. We have not done so in the preceding twelve months, including in respect of anyone under 16. We do not use personal information for profiling that produces legal or similarly significant effects.

9. International Transfers

We are a United States company. Our personnel and operations are located in the Republic of the Philippines. The server that runs this website, the client portal and our email is located in the United States. Tilly call records are held on a server in Australia, and our encrypted backups are stored in Australia. Your personal information will therefore be stored and accessed in countries outside the one you live in, and their data protection laws may differ from those of your home country. Some service providers listed in section 7 process information in the United States, including Stripe for payments, Google for analytics, and the AI model provider and the telephone carrier behind Tilly calls.

Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards — normally the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with technical measures such as encryption in transit. You can request a copy of the relevant safeguards by emailing privacy@multitasker.llc.

10. How Long We Keep It

• Web server access logs — up to 30 days, then deleted.
• Inquiries that do not become engagements — up to 24 months.
• Client records and correspondence — for the engagement and then up to 7 years, to meet US tax and record-keeping expectations and to defend potential claims.
• Invoices and accounting records — at least 7 years, as required by law.
• Records of your acceptance of a subscription’s terms — at least 3 years, or 1 year after the subscription ends if that is later, as part of the client records above.
• Client content and data held for hosting or SaaS — for the term of the service and then 30 days, after which it is deleted, unless you ask us to keep it or the law requires otherwise.
• Tilly call records — for the period the business that uses Tilly chooses (30 days unless it sets between 7 and 365 days), then deleted automatically.
• Marketing consent and unsubscribe records — kept for as long as needed to honor your choice.

We may keep information for longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

11. How We Protect It

We use measures appropriate to our size and the sensitivity of the information, including encryption in transit using TLS across the whole of this site, access control on a need-to-know basis, multi-factor authentication on our administrative accounts, hardened and patched servers, a firewall limiting exposed services, and regular backups.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and any regulator as required by applicable law and without undue delay.

12. US State Privacy Rights

Depending on where you live — including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — you may have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients;
• Correct inaccurate personal information;
• Delete personal information we hold about you;
• Obtain a portable copy in a readily usable format;
• Opt out of sale, of sharing for targeted advertising, and of profiling with legal or similarly significant effects — we do none of these, so there is nothing to opt out of;
• Limit the use of sensitive personal information — we do not collect it for this purpose; and
• Be free from discrimination for exercising any of these rights. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@multitasker.llc with the word “Appeal” in the subject. We will respond within 45 days with our decision and reasons, and will tell you how to contact your state Attorney General if you remain unsatisfied.

Authorized agents. You may use an authorized agent to make a request. We will ask for written proof of authorization and may ask you to verify your identity directly.

Global Privacy Control. We honor opt-out preference signals such as Global Privacy Control. Because we do not sell or share personal information, such a signal requires no change to how we handle your data.

California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes.

13. EEA, UK and Other Rights

If you are in the EEA or the UK you have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent. You also have the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner’s Office. We would appreciate the chance to address your concern first.

If you are in another country with equivalent legislation, we will honor the equivalent rights available to you under that law.

Australia. If you are in Australia, you may ask for access to the personal information we hold about you and ask us to correct it, under the Australian Privacy Principles in the Privacy Act 1988. If you believe we have mishandled your personal information, email us first at privacy@multitasker.llc: we will acknowledge your complaint, look into it, and give you our written response within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

14. How to Exercise Your Rights

Email privacy@multitasker.llc, or write to us at the registered office in section 19. Tell us what you would like us to do and give us enough detail to find your records.

We will verify your request, usually by confirming control of the email address on file or by asking for information we already hold. We will acknowledge within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where the request is complex — we will tell you if we need the extension and why. Where a shorter period applies, we meet it: a request under the GDPR or UK GDPR is answered within one month, extendable by up to two further months only where the law allows it for a complex request, and a request for access under the Australian Privacy Act within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

15. Data We Handle on Behalf of Clients

When we build, host or operate a website, platform or campaign for a client, that client decides what personal information is collected and why. In that situation the client is the controller and we act as a processor (a “service provider” under California law), handling the information only on the client’s documented instructions and not for our own purposes.

If you are an end user of a site or service we operate for a client, please direct your privacy request to that client in the first instance. If you contact us, we will pass the request on and assist the client in responding. We will enter a data processing agreement with any client who requires one — email privacy@multitasker.llc.

16. Children

Our website and services are directed at businesses and adults. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us with personal information, contact privacy@multitasker.llc and we will delete it promptly.

17. Do Not Track

We do not track visitors across other websites, and analytics cookies are set only if you accept them (section 4). The site does not change its behavior in response to a Do Not Track browser signal. To keep analytics cookies off, decline them in the banner or under Cookie Settings at the bottom of any page.

18. Changes to This Policy

We may update this policy. The current version is always published here, identified by the version number and “last updated” date at the top. If we make a material change to how we handle personal information, we will give notice by a prominent notice on this website or by email before the change takes effect. We will not apply a materially different use to information already collected without your consent where consent is required.

19. How to Contact Us

MultiTasker LLC
Attn: Privacy
30 N Gould St, STE R, Sheridan, WY 82801, United States
Email: privacy@multitasker.llc