Privacy Notice

Version: v0.4.0 Authority version: privacy.v0.4.0 Last updated: 2026-10-12 Status: Initial-cohort active privacy notice Target path: docs/public/privacy_notice.v0.4.0.md

This Privacy Notice explains what data Undertake may collect, use, store, display, disclose, retain, delete, or anonymize during the initial cohort.

Operator: Michael McCartney, a Montana sole proprietor.

Undertake is the service name used in this notice. This notice describes data handling; it is not a contract acceptance or a hidden grant of consent. Reading it, accepting an invite, creating an account, silence, or continued use does not record consent to an optional purpose. Using a requested feature necessarily asks Undertake to perform the processing described for that feature. Do not take the action if you do not want that necessary processing.

Any optional data use or communication that requires consent must use a separate, unselected choice that can be declined and later withdrawn without blocking unrelated service use. Undertake must record the exact purpose, notice version, choice, action, and time; it may not bundle that choice into a Work Contract, payment, schedule, invite, account, or oath action.

1. Scope

This notice applies to Undertake’s initial-cohort app, invite flows, account flows, Work Contract flows, payment-related flows, proof flows, review flows, and reporting/contact flows.

This notice does not replace:

• Terms of Use;
• Work Contract terms;
• payment-provider terms;
• Stripe terms;
• any separate written agreement that applies to a specific relationship or transaction.

2. Data Undertake may collect or create

Undertake may collect or create the following categories of data.

Account data

• email address;
• password/authentication data handled through the authentication provider;
• handle;
• display name;
• account ID;
• member ID;
• account state;
• oath state;
• invite/access state;
• deletion or exit state.

Invite data

• invite token;
• invite type;
• invite issuer;
• invite recipient or intended recipient;
• invite status;
• invite expiration;
• invite use history;
• invite-linked work or mission context;
• technical signals related to invite use, such as request timing or network metadata.

Work Contract data

• offers;
• requests;
• Work Contract scope;
• buyer/requester identity;
• seller/carrier identity;
• price;
• currency;
• platform fee snapshot;
• payment path;
• proof requirements;
• verification topology;
• acceptance state;
• cancellation, refund, lock, dispute, or reconciliation state;
• contract event history.

Proof and completion data

• submitted proof;
• completion packets;
• links, files, text, metadata, or other proof materials submitted by a member;
• verifier actions;
• buyer acceptance or rejection actions;
• proof review state;
• timestamps and event history.

Review and service-record data

• reviews;
• accepted work summaries;
• contribution records;
• value event records;
• continuity records;
• member-visible service summaries;
• related operational metadata.

Payment and payout data

• Stripe checkout/session references;
• payment intent references;
• payment status;
• refund status;
• chargeback or dispute state;
• transfer or payout-related state;
• connected-account references;
• payout readiness state;
• platform fee records;
• provider event metadata;
• payment reconciliation records.

Undertake does not need to store full card numbers. Card and payment method details are handled by the payment provider.

BeaCredits and reward data

• pending, spendable, spent, reversed, restored, expired, or blocked credit state;
• credit source;
• credit amount;
• credit use history;
• credit reversal or adjustment history;
• related Work Contract or value event references.

Operational data

• logs;
• error records;
• route access records;
• rate-limit records;
• audit records;
• moderation or review records;
• support records;
• safety or abuse review records;
• system integrity records.

Member Direct Contact data

• an optional contact email a member deliberately saves separately from authentication identity;
• whether that contact email was copied from the member's then-confirmed Undertake sign-in email or was separately self-provided;
• the specific Known Members the owner has chosen to let Undertake reveal that contact email to;
• grant, revoke, and update timestamps needed to show the owner who currently has access and preserve a non-value disclosure ledger.

Direct Contact is private by default. Known Member status, an invite, a Work Contract, payment, organization membership, or other Undertake context does not by itself reveal it. A member may revoke future disclosure through Undertake, but Undertake cannot erase an email address that a recipient already received, copied, saved, screenshotted, exported, or otherwise retained outside Undertake. Direct Contact does not create marketing consent.

Coordination identity and temporary meeting data

• an optional self-provided recognition photo used only when a member chooses to share it for an in-person Work Contract;
• the private storage reference and technical metadata needed to store, replace, remove, and serve that recognition photo;
• contract-scoped records showing whether a recognition photo was requested, shared, declined, replaced, or revoked;
• temporary coordination information a member intentionally shares for a Work Contract, which may include a phone number, exact meetup point, exact address, pickup instruction, delivery instruction, or temporary access note;
• expiration, revision, and review state for temporary coordination information.

A recognition photo is self-provided. It is not identity verification, a background check, a credential, a safety certification, or a public profile. Undertake re-encodes supported recognition-photo uploads before private storage so embedded image metadata such as EXIF data is not retained in the stored copy.

Contact and report data

• messages sent to support or reporting channels;
• privacy requests;
• payment/refund/payout reports;
• conduct reports;
• vulnerability reports;
• attachments or context included in those messages;
• response and resolution history.

3. How Undertake may use data

Undertake may use data to:

• create and manage accounts;
• process invites;
• determine member access;
• record oath state;
• create, show, update, lock, cancel, refund, reconcile, or review Work Contracts;
• route proof and verification;
• process payments, refunds, transfers, payouts, and related provider events;
• determine payout readiness;
• calculate, block, reverse, restore, or apply BeaCredits;
• generate member-visible operational records;
• show counterparties relevant contract, proof, payment, review, or service-record information;
• let a member explicitly share a recognition photo with the counterparty for one in-person Work Contract and later revoke that share;
• provide temporary contract coordination information and notify a counterparty when previously reviewed coordination or recognition information changes;
• let a member selectively reveal Direct Contact to chosen Known Members and later stop future Undertake disclosure;
• detect misuse, fraud, abuse, route bypass, payment inconsistency, or system-integrity issues;
• provide support;
• respond to privacy, payment, conduct, safety, or vulnerability reports;
• comply with legal, tax, accounting, payment-provider, dispute, audit, or operational requirements;
• maintain internal records needed for system operation.

Undertake does not use this notice to promise that every feature, access path, data field, deletion path, or display state is available at all times.

4. Who may see data

Visibility depends on role, route, Work Contract state, invite state, member state, and system rules.

You

You may see account data, invite state, Work Contract data, proof, payment state, review state, reward state, or service-record summaries made available to your account.

Counterparties

A buyer/requester, seller/carrier, verifier, or other Work Contract party may see data needed for the applicable Work Contract, such as scope, proof, verification state, acceptance state, payment state, cancellation state, refund state, or review state.

For an onsite or hybrid Work Contract, one counterparty may request a recognition photo. The other member chooses whether to share it for that Work Contract. Exact phone, address, meetup, access, or similar temporary coordination details are shared only through the applicable Work Contract coordination record and may expire under the selected policy. A Work Contract does not by itself open either member's private account information.

Known Members and Direct Contact

A member may separately choose to reveal an optional Direct Contact email to selected Known Members. Each reveal is an explicit member-controlled disclosure and is not implied by being a Known Member. The owner can see which Known Members Undertake currently reveals the email to and can revoke future disclosure through Undertake. Revocation cannot erase information a recipient already received or copied outside Undertake.

Operators and reviewers

The Operator and authorized reviewers may access data needed for support, operations, payment reconciliation, dispute handling, abuse review, safety review, legal compliance, audit, debugging, or system integrity.

Payment providers

Stripe or another payment provider may receive payment, checkout, connected-account, payout, refund, dispute, identity, compliance, or provider-event data needed to provide payment-related services.

Service providers

Authentication, hosting, database, email, logging, analytics, storage, or infrastructure providers may process data as needed to operate Undertake.

Legal or compliance recipients

Data may be disclosed if required or appropriate for legal process, tax/accounting obligations, payment-provider requirements, fraud prevention, abuse response, rights protection, or system-integrity review.

5. Public visibility

Undertake is not intended to be a public member directory or public services marketplace during the initial cohort.

Some information may still become visible through member surfaces, invite-scoped surfaces, Work Contract surfaces, proof/review surfaces, or generated summaries.

Do not submit content you need to keep outside all counterparties, reviewers, operators, providers, or applicable system records.

6. Payment-provider data

Payment and payout flows may use Stripe.

Stripe may collect, process, store, review, or require payment, identity, tax, compliance, account, payout, refund, chargeback, or dispute data under its own terms and privacy materials.

Undertake may store Stripe references and provider event data needed to reconcile payment state, payout readiness, refund state, dispute state, chargeback state, transfer state, and related Work Contract state.

Undertake does not control all payment-provider decisions, timing, requirements, or records.

7. Retention

Undertake may retain data for as long as needed for:

• account operation;
• invite operation;
• Work Contract lifecycle truth;
• proof and verification records;
• payment, refund, payout, chargeback, dispute, or reconciliation records;
• BeaCredits and reward records;
• tax, accounting, legal, or provider requirements;
• support;
• abuse, fraud, safety, or system-integrity review;
• audit and debugging;
• member-visible summaries;
• operational continuity.

Retention periods may vary by data type, legal need, provider requirement, dispute state, and system state.

Active recognition-photo access is revoked when the member removes or replaces the photo or closes the account. Temporary coordination values expire or are cleared according to their Work Contract expiration policy. Direct Contact email is cleared from the Direct Contact record when the member removes it or account closure begins; non-value grant/revoke history may remain for the member's disclosure record. Undertake may retain non-sensitive event history showing that a disclosure, change, expiration, or review occurred without retaining the expired sensitive value in that event history.

8. Account deletion and exit

You may request or use an available account deletion or exit path.

Account deletion or exit may remove some account data. Some data may be retained, anonymized, or preserved when needed for:

• payment records;
• payout records;
• refund records;
• chargeback or dispute records;
• Work Contract lifecycle truth;
• proof and verification records;
• tax, accounting, legal, or provider requirements;
• fraud prevention;
• abuse review;
• safety review;
• audit;
• system integrity;
• member-visible records that need to remain coherent after exit.

Deletion may not remove data already processed by payment providers, counterparties, service providers, legal recipients, backups, logs, or records that must be retained.

When account closure begins, Undertake ends active recognition-photo disclosure in its database and ends Direct Contact disclosure, clearing the stored Direct Contact email from that record. The account-closure cleanup process removes stored recognition-photo objects before provider-side account cleanup is recorded complete.

9. Corrections

You may request correction of account or profile information where an available route or support path permits it.

Some records, such as payment events, Work Contract events, proof submissions, verification actions, dispute records, audit records, or provider records, may be preserved as historical records rather than rewritten.

10. Communications

Undertake may send or display operational communications related to:

• account access;
• invites;
• Work Contracts;
• proof;
• verification;
• payments;
• refunds;
• payouts;
• disputes;
• reviews;
• account deletion;
• conduct or safety review;
• system changes;
• legal or policy updates.

Marketing communications are not required for initial-cohort use. This notice does not opt a member into marketing. Any later marketing program that relies on consent must use its own unselected, declineable, withdrawable choice.

11. Cookies and similar technologies

Undertake may use cookies, local storage, session storage, authentication tokens, or similar technologies for:

• login sessions;
• route access;
• invite flow continuity;
• security and abuse review;
• preference or state persistence;
• basic operation of the app.

If analytics or advertising tools are added later, this notice must be updated before those tools become active. Any use that requires consent must remain off for a member unless and until that member separately opts in; declining or withdrawing that choice must not block unrelated service use.

12. Children

Undertake is not intended for people under 18.

Do not use Undertake if you are under 18.

If the Operator learns that an under-18 account was created, the account may be removed or restricted, and related records may be retained or anonymized as needed for legal, safety, payment, dispute, or operational reasons.

13. Location and cross-border processing

Undertake, its providers, and payment providers may process data in different locations depending on infrastructure, provider systems, support needs, and legal requirements.

Do not use Undertake if you are not willing for data to be processed where Undertake and its providers operate.

14. Operational safeguards

Undertake may use access controls, route gates, audit records, provider controls, and review processes to operate the system and limit unauthorized use.

This notice does not promise that any system, provider, route, record, or communication is immune from error, interruption, misuse, unauthorized access, loss, or disclosure.

15. Changes to this notice

The Operator may update this Privacy Notice. A later version may describe future processing after conspicuous notice, but an update does not itself create member consent.

Material changes may be posted through the app, linked from public pages, or otherwise made available through the system.

Silence or continued use is not an opt-in. A new optional purpose that requires consent must remain disabled until the member makes the separate affirmative choice described above. An updated notice does not retroactively expand an earlier optional consent or rewrite preserved Work Contract, payment, proof, or audit history.