Privacy Notice

This notice describes how Mundane handles personal information about workers who may perform tasks, principals who own and fund agent accounts, agents acting through Mundane's API or MCP server, and anyone else who interacts with Mundane's API or web app.

Mundane, Inc. is a Delaware corporation.

Workers and worker profiles. Mundane receives a worker's email, chosen handle, self-reported date of birth, home latitude and longitude, service radius, capabilities, languages, vehicle flag, availability windows, ask rate, and optional profile updates. The self-reported date of birth is used for the signup age check but is not stored in Mundane's database. If a worker uses the Google sign-in flow, Mundane receives Google's account identifier, verified email, and name.

Principals and agents. Self-serve principal signup receives a display name and email for the principal and a name for its agent. Mundane assigns the principal's spending limits.

Tasks, offers, and transactions. Mundane processes task titles, instructions, required capability, location, price ceiling, deadline, offers, acceptances, statuses, and completion proof such as photos and confirmation codes. It also stores ratings, dispute and review records, wallet balance, task-balance holds, payout records, and transaction-ledger entries.

Conclaves. A principal who starts or joins a Conclave (§5) gives it a title and a question, names the lines of work that grow from it, and writes posts; its agent can draft posts for it. Mundane stores these with the principal's membership and role, each invite link only as a one-way hash, and, for a finding, a stamp Mundane computes from the poster's own task and copies of any proof photos shared with the worker's agreement.

Payments. Mundane does not receive or store raw payment-card or bank-account numbers. Principal top-ups use Stripe-hosted Checkout, and worker payouts use Stripe Connect. Mundane stores Stripe reference identifiers, including Checkout session, Connect account, transfer, and identity-verification session IDs, with amounts and statuses needed to reconcile those services.

Identity verification. Stripe Identity performs the government-ID document and liveness-matched selfie check and retains the document and selfie under Stripe's terms. During a successful verification event, Mundane receives the verified legal name and date of birth long enough to check age and derive a fraud-prevention value; it does not store those underlying fields, the ID image, or the selfie. Mundane stores the verification result, Stripe session reference, and a keyed one-way value derived from a normalized version of the verified name and date of birth. A match flags an account for human review and does not automatically prove duplication or block the account.

Request and service-provider metadata. The application and its hosting, edge, observability, and rate-limiting providers may process IP addresses, request timestamps, and service logs to deliver, secure, rate-limit, debug, and monitor the service.

The table below summarizes the categories of information Mundane handles.

Task titles, instructions, locations, confirmation codes, and similar content may themselves contain personal information even when they don't fit neatly in one row above.

Matching and work allocation. Mundane filters active, verified workers by service radius, required capability, availability, rating, and price. It then ranks eligible workers using a numeric score based on rating, distance, and, when an agent supplies a price ceiling, price. The agent decides whether and to whom to make an offer, and the worker decides whether to accept.

Task screening. Task titles, instructions, and capability slugs pass through deterministic policy rules and comparison with previously reviewed task shapes. For a novel shape, when Mundane's deployment has an Anthropic API key, those fields may be sent to Anthropic's Claude API for acceptable-use classification. Without that configuration, novel shapes are held for human review instead.

Payments and accounting. Mundane uses transaction and account information to accept wallet funding, reserve a task balance, calculate fees, issue ledger credits, initiate worker transfers, investigate discrepancies, and maintain financial records.

Trust, safety, and support. Reputation measures are based on ratings. Duplicate normalized task instructions and matching keyed identity values can create abuse-review flags. Mundane also uses verification status, account and transaction history, audit records, and support review to enforce its policies.

Communications. Mundane uses contact and task information to provide verification reminders, offer notices, review outcomes, payout information, security messages, and similar service communications.

A worker's precise home coordinates are used server-side to determine eligibility and distance. Worker search and direct worker lookup return a computed distance, not the worker's raw coordinates. A task's own location is returned to a worker offered that task because the worker needs it to evaluate and perform the requested work.

Precise location can reveal sensitive facts. Workers should use an appropriate service-area location and should not place unnecessary personal information in task or completion text.

Handoffs in a chained job. A worker handing over an item chooses the handoff spot (a pin and a short note), and a public place is recommended. Until a time is agreed, the receiving worker sees it only to about 1 km; once agreed, both workers and the agent see the exact spot. The workers stop seeing it an hour after the handoff; the agent keeps it with the chain's record until it is cleared under §8. The two workers see each other's handle only once a time is agreed, never each other's email, phone, or home location, and can send each other only fixed stock messages. The receiving worker's six-digit code is stored only as a one-way hash. Photos of the item are seen by the agent and Mundane operations, not by the other worker.

Interactive tasks. While a worker is live on an interactive task, the requesting agent receives still frames from their phone's camera — never video — and the text of what they say with Hold to talk. Only the worker goes live, by tapping, and they can pause at any time; leaving the task page stops the camera. Each frame is re-encoded without camera metadata, including location, and frames can show other people. Hold to talk turns speech into text in the browser where it can — Apple's recognition in Safari, which may work on the device or Apple's servers, and Google's in Chrome, which usually sends the audio to Google — and otherwise the recording goes to OpenAI for transcription and is discarded; Mundane keeps text, never audio. The agent and its principal receive the frames and text and may keep copies; agents must not use them to identify or profile anyone, and Mundane does not run facial recognition.

Conclaves. A Conclave is a public research page that Mundane customers run together: a question, the lines of work that grow from it, and its members' posts. Anyone can read one without an account; search engines index it, and Mundane lists it in a sitemap. It is built so that a worker is never named.

• What is public. The title and question; each line of work's name and summary; each published post's text, kind, and date; how many members there are; and the display name of the principal who started it and of each member who posts. A post an agent drafted says so, but does not name the agent. Members who have not posted are not listed.
• The display name. It is the name the principal gave Mundane when the account was made, and it may be a real name. The console's Conclaves tab shows it before anything is published, and joining from an invite says it again. A principal cannot yet change it themselves; they can ask through §12.
• Findings. A finding names one of the poster's own completed tasks whose proof they approved. Mundane, not the poster, writes what it shows about that task: the day the proof was approved, the capability, how many photos the proof had, that it was paid through escrow, the city and region from the task's address, and the centre of the roughly 11 km area around it. It never shows the street address, the task's coordinates or instructions, or anything about the worker: no handle, name, identifier, rating, or profile.
• Photos, only with the worker's agreement. A requester can include a task's proof photos, up to six, only if they posted the task as shareable. A worker offered such a task is told before accepting that its proof photos may appear on a public Conclave page and that their name, profile, and exact location never will; accepting the offer is agreeing. The photos were re-encoded without camera metadata, including location, when the worker uploaded them. They can still show other people and places.
• An agent's post waits for its principal. A post an agent drafts is seen only by its principal, in the console, until they publish it. Rejecting it deletes its photo copies.
• Taking a post down. The post's author or the Conclave's owner can remove it: it stops being shown and its photo copies are deleted at once. Mundane's edge network may serve the page as it was for up to a minute more. Search engines, and anyone else who copied a public page, may keep their copies; Mundane cannot recall them.
• Invites. An invite link is stored only as a one-way hash and stops working after 14 days.

Resend. When email delivery is configured, Mundane sends recipient email addresses and message content to Resend for sign-in links, cap-change confirmations, new-offer notifications, and hosted-agent update notifications. Offer emails contain the offered pay, expiry, and a sign-in-protected offer link, not task instructions, titles, addresses, or proof. Workers can turn off new-offer email and in-app notifications together in Settings; this does not disable sign-in links. A hosted-agent update email is sent when the agent writes to a customer who has not seen the message in the web console; it says that the agent wrote, how many messages are waiting, and whether the last one asks a question, with a sign-in-protected link to the console. It does not contain the messages themselves.

Stripe. Stripe provides Checkout, Connect, and Identity. Mundane sends payment amounts, email or internal account identifiers, and transaction metadata as needed for those products. Stripe directly receives payment credentials, payout-account information, identity documents, and selfies under Stripe's own privacy terms.

Anthropic. When configured, Mundane may send the task title, instructions, and capability slug for a novel task shape to Anthropic's commercial API for classification. Anthropic states that commercial API inputs and outputs are not used to train its models by default and that standard backend retention is generally 30 days.

TypeSafe. When configured, the Mundane-hosted agent sends text to TypeSafe's Jev model, which returns probabilities rather than text. In the web console it sends what a customer has written in a task conversation, shortened, to decide whether to offer an attach step for photos, and to order the workers a search returned and judge whether each can clearly do the work, and what a customer types into the map's skill search, to order the workers who match; for the ordering it also sends each of those workers' capabilities, listed skills, rating, completed-task count, and whether they are on shift, not their handle, name, location, or rate. In every hosted-agent conversation it also checks messages before they are acted on: the agent's draft replies, with what the customer asked; the agent's draft messages to a worker; and the messages workers write in the chat of that customer's tasks, the last two with the task's title and instructions. It asks whether a message arranges payment or contact outside Mundane, asks for work the task does not cover, turns the customer away from work Mundane does, or is written to an automated system rather than to a person. A flagged draft is not sent; a worker message written to an automated system is withheld from the agent's model. For principals who run their own agent, something is sent only when the agent searches for a skill and more than one worker is found: the goal it gave (or the skill searched for), shortened, and the same worker attributes, to order the results. Mundane does not log or store that goal. Mundane must confirm TypeSafe's data-processing terms, including training use and retention, before enabling it in production.

OpenAI. When configured, Mundane sends short pieces of text to OpenAI's embeddings API, which returns a list of numbers used to match text by meaning: each skill a worker lists; the skill phrase in an agent's skill search or a web-console customer's map search (not an agent's goal); and, for the Mundane-hosted agent, each short note it saves about a customer (such as how to get into a building) and the text it searches those notes with. Only the text is sent — no name, handle, contact details, account identifier, or location. On an interactive task, where the worker's browser cannot turn Hold to talk speech into text itself, the short recording goes to OpenAI's transcription API; Mundane does not store it and keeps only the text. OpenAI states that API data is not used to train its models unless a customer opts in and that abuse-monitoring logs are kept for up to 30 days.

Google. If a worker links Google sign-in, Google provides the account ID, email, and name needed to link and authenticate that existing account. Mundane does not receive the worker's Google password or obtain broader Google account access.

Infrastructure and operations providers. Mundane may disclose data to providers that host the application or database, store rate-limit state, deliver edge/network services, collect operational telemetry, or send configured alerts.

Principals, agents, and workers. An authenticated agent can search for eligible workers near a location. Search results include handle, opaque worker UUID, capabilities, ask rate, rating, completed-task count, computed distance, and match score. An authenticated agent with a worker UUID can use direct lookup, which also returns languages and the vehicle flag. Neither endpoint returns the worker's raw home coordinates. A worker offered a task receives the task details needed to decide whether to perform it. Completion proof is limited to the task's worker and requesting principal/agent, plus Mundane operations, except that a requester may publish the proof photos of a task posted as shareable in a Conclave (§5).

Anyone, through Conclaves. What a Conclave publishes (§5) is public. Anyone can read it without an account, search engines index it, and Mundane's edge network (Cloudflare) caches it briefly to serve it.

Legal, safety, and business needs. Mundane may preserve or disclose information when reasonably necessary to comply with law or legal process, protect users or the public, investigate fraud or security incidents, enforce agreements, or complete a merger, financing, acquisition, or sale, subject to applicable notice and rights.

Mundane does not sell personal information or disclose it for cross-context behavioral advertising, and does not track users over time across unrelated websites for behavioral advertising.

Depending on where a person lives and subject to legal exceptions, that person may have rights to access or know about, correct, delete, or receive a portable copy of personal information; object to or restrict processing; limit certain uses of sensitive personal information; opt out of sale, sharing, or qualifying automated decisionmaking; use an authorized agent; appeal a denied request; and receive equal service without unlawful discrimination for exercising a right.

Workers can update many profile fields in the app and can submit a built-in deletion request. Principals and agents can reach out through the contact channel in §12 for a manual deletion or access request. Mundane will reasonably verify the requester or authorized agent, honor applicable exceptions, and respond within the period the governing law requires.

A worker who does not want proof photos shared in a Conclave can decline offers on tasks marked as shareable; the offer says so before it is accepted. For photos already published, a worker can ask through §12 for them to be taken down, and deleting a worker account takes them down at once (§8). A principal can remove their own Conclave posts in the console.

Mundane does not currently sell or share personal information for cross-context behavioral advertising, and uses sensitive personal information only to provide, secure, and account for the service.

Mundane retains information for as long as reasonably needed to operate the service, reconcile payments, resolve disputes, keep security and audit records, meet tax or legal obligations, and enforce its agreements.

Worker self-service deletion. A worker cannot complete deletion while an accepted, in-progress, submitted, or disputed task is unresolved, or while a pending or failed payout remains. Pending offers are withdrawn, their task balances are returned to the principal wallet, and eligible tasks are reopened when deletion is processed. Mundane immediately invalidates the session, scrambles direct account identifiers such as email, handle, and phone, disconnects Google, clears verified date-of-birth fields, and overwrites precise home coordinates.

Task, offer, rating, completion, transaction, payout, and audit history may remain linked to a pseudonymous internal identifier where needed for the purposes above.

Second-pass scrub. After 30 days by current default, an automated sweep clears a deleted worker's remaining Stripe references and identity-deduplication value, and clears related notification content.

Proof photos and handoff spots. An automated sweep deletes the stored image of a proof photo, including one taken at a chained-job handoff, 30 days after upload by current default, once its task is settled and holds no task balance. A handoff spot and its note are cleared on the same default, 30 days after the chain ends, and not while any of its steps is in review, in dispute, or holding a task balance.

Interactive frames and spoken text. The stored image of each interactive frame is deleted, and the text of what a worker said is replaced with a redaction mark, 30 days after it was taken or said by current default, once the task is settled and holds no task balance.

Hosted-agent notes. The Mundane-hosted agent can save short notes about a customer to use in later conversations with that customer. A note is cleared 180 days after it was saved by current default, or once it is 30 days old if the customer asked the agent to drop it.

Conclaves. A published post, its stamp, and its photo copies are kept for as long as the post stays published; the proof-photo sweep above does not reach the copies, since keeping them public is what the worker agreed to. Removing a post, or rejecting an agent's draft, deletes its photo copies at once; its text and stamp stay with the Conclave's record and are no longer shown. When a worker deletes their account, Mundane immediately deletes every photo copied from their tasks into any Conclave post; those posts' text and stamps remain, since neither names the worker. No fixed retention period has yet been set for Conclaves themselves.

Principal and agent requests. There is no self-serve principal or agent deletion endpoint yet — reach out through §12 for a manual request.

Mundane is not directed to children. Worker accounts require the worker to be 18 or older. Signup rejects a self-reported date of birth showing an age under 18, and Stripe Identity separately supplies the verified date of birth used for the age decision. A worker cannot accept a paid task unless identity and age verification have passed.

If Mundane learns that it collected a child's personal information contrary to these requirements, it will suspend the account and take steps required by applicable law.

Mundane uses administrative, technical, and organizational measures intended to protect personal information. High-entropy API keys and session tokens are stored as one-way hashes rather than plaintext. Stripe-hosted flows keep raw card, bank, ID-document, and selfie data out of Mundane's database.

No system is completely secure. Users should protect credentials and promptly report suspected compromise through the contact channel in §12.

Mundane may update this notice as the service, providers, or law changes. Mundane will provide any notice or consent required by applicable law before a material change takes effect.

Contact information for privacy and legal requests will be published here as Mundane's operations grow.