This Privacy Policy explains how Anh Tuan Nguyen trading as Spot On Task (ABN 12 755 798 605) (SpotOnTask, we, us, or our) handles personal information when you use spotontask.com, our applications, and related marketplace services (together, the Services).

Effective date: 4 September 2026
Privacy contact: [email protected]
Business location: Northern Territory 0820, Australia

This policy should be read with our Terms and Conditions and the notices shown when particular information is collected.

1. Scope and applicable privacy law

This policy applies to personal information handled by SpotOnTask in connection with the Services. We aim to handle personal information transparently and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent they apply to us, as well as other applicable privacy, communications, and record-keeping laws.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. Some identity, biometric, health, criminal-record, or other information may be sensitive information under applicable law.

2. Information we collect

Account and profile information

• name, email address, contact email, phone number, date of birth or age confirmation, password hash, account identifiers, and sign-in information
• profile photo, banner, suburb, city, state, postcode, country, introduction, languages, experience, skills, categories, and portfolio content
• notification, task-alert, location, currency, marketing, and other account preferences
• information received from Google, Facebook, or Apple if you choose an enabled social sign-in option

Task and marketplace information

• task titles, descriptions, categories, budgets, schedules, addresses, coordinates, images, and task status
• offers, invitations, follows, accepted scope, fees, cancellations, completion records, ratings, reviews, and uploaded evidence
• private task messages and attachments, including metadata such as sender, recipient, task, and time

Payment and payout information

• payment and payout references, provider identifiers, payment status, amount, currency, card brand and last four digits, invoices, credits, cash-outs, refunds, disputes, and chargeback information
• billing and payout-address information
• fraud, risk, compliance, and payment-verification results received from payment providers

Payment providers collect and process full card, bank, wallet, and other financial credentials under their own terms and privacy notices. SpotOnTask does not intend to store full card numbers or online-banking passwords.

Worker verification and credentials

• Worker country and payout-currency preference
• identity-verification session, status, error, and completion information
• Australian Business Number, tax-verification status, and related business details
• trade licences, police checks, Working With Children documents, badge submissions, expiry dates, and review decisions

Stripe Identity conducts the current government-ID and selfie check. Stripe may collect identity-document and biometric information directly. SpotOnTask records the verification session and result needed for the Worker flow; information Stripe handles is also governed by Stripe's privacy notice.

Support, safety, and administration

• support enquiries, reports, complaints, dispute evidence, account-closure requests, and communications with us
• moderation decisions, restrictions, security events, audit records, and administrative actions
• referral and campaign attribution information

Technical and usage information

• IP address, browser, device, operating system, session, cookie, request, error, and security-log information
• pages and tasks viewed, clicks, searches, categories of interest, referral URLs, campaign parameters, and feature interactions
• approximate location inferred from an IP address and location supplied for profiles, alerts, or tasks

3. How we collect information

We collect information directly from you, automatically from your use of the Services, from other users involved in a task or report, and from service providers such as payment, identity, social sign-in, communications, fraud-prevention, analytics, and location providers. We may also obtain public business or licence information from official registers, including ABN Lookup.

4. Why we use information

We use personal information where reasonably necessary to:

• create, authenticate, secure, administer, and close accounts
• publish profiles and tasks and operate offers, matching, invitations, alerts, messaging, reviews, and portfolios
• fund tasks, calculate fees, maintain transaction records, release payments, issue credits, facilitate cash-outs, and manage refunds, disputes, and chargebacks
• verify identity, ABNs, licences, badges, and payout eligibility
• provide support, investigate complaints, moderate content, enforce rules, prevent fraud, and protect users and the Services
• send transactional, security, task, support, and permitted marketing communications
• measure campaigns, understand service use, troubleshoot errors, develop features, and improve relevance and performance
• comply with law, court or regulator requirements, tax and accounting obligations, and legitimate record-keeping needs

If required information is not provided, we may be unable to open or verify an account, publish or assign a task, process a payment or payout, investigate a problem, or provide part of the Services.

5. Matching, moderation, and automated assistance

SpotOnTask uses rules and scoring to recommend tasks or Workers, rotate invitations, detect prohibited or risky content, and limit abuse. Signals can include categories, profile details, location, task history, ratings, licences, recent task views, and cancellations. These systems support marketplace operations; a match is not an automatic assignment.

Optional AI-assisted features can improve task descriptions, offers, or other text. When you use them, relevant text and limited task or profile context may be sent to OpenAI for generation or classification. Do not submit secrets, identity documents, TFNs, card or bank details, health information, or other unnecessary sensitive information to an AI feature. Review generated content before using it.

6. Public information and messages

Depending on the feature, profile names, photos, general locations, skills, portfolios, badges, task content, ratings, reviews, and task history may be visible to users or the public. Do not publish private contact or sensitive information in public fields.

Task messages are intended for the participants, but authorised SpotOnTask personnel may access them where reasonably needed for support, safety, fraud prevention, dispute handling, policy enforcement, system administration, or legal obligations. Messages are not appropriate for passwords, authentication codes, full identity documents, TFNs, or payment credentials.

7. Who we disclose information to

We may disclose relevant information to:

• other Posters and Workers where needed to display a listing or profile, assess an offer, coordinate an assigned task, or show a review
• payment and identity providers, including Stripe and, where enabled, Airwallex
• hosting, storage, security, email, SMS, mapping, social sign-in, analytics, advertising-measurement, and technical providers, which may include Amazon Web Services, Cloudflare, Google, Meta, SendGrid, and Twilio depending on configuration
• OpenAI when an AI-assisted feature is used or when configured safety/classification processing is required
• professional advisers, insurers independently engaged by us, auditors, and contractors under appropriate obligations
• courts, regulators, law-enforcement bodies, emergency services, or government agencies where required or authorised by law or reasonably necessary to address serious safety, fraud, or legal concerns
• a buyer, investor, financier, or adviser involved in a proposed business sale, restructuring, or transfer, subject to appropriate confidentiality and legal requirements
• another person with your consent or at your direction

We do not offer personal information for sale as a standalone product. Advertising and measurement providers may nevertheless receive online identifiers and usage events as described in this policy and their own notices.

8. Overseas handling

Some providers and their subprocessors operate outside Australia. Personal information may therefore be accessed or processed in countries including Australia and the United States, and in other countries identified by the relevant provider. The country can depend on the feature, provider configuration, support location, and subprocessor in use.

Where Australian Privacy Principle 8 applies to an overseas disclosure, we take reasonable steps required by law before disclosure or rely on an applicable exception. Contact us for current information about providers relevant to your account.

9. Cookies, Meta Pixel, and similar technologies

We use cookies and similar technologies for sign-in, security, preferences, service operation, performance, campaign attribution, analytics, and advertising measurement. The website uses Meta Pixel to record page views and selected campaign or conversion events. Third parties may combine information received through these technologies with information they already hold under their own privacy notices.

You can restrict cookies through your browser or device and use controls offered by the relevant provider. Blocking essential cookies can prevent sign-in, checkout, or other features from working. Browser controls do not necessarily remove information already collected.

10. Security

We use reasonable technical and organisational safeguards designed to protect personal information, including access controls, password hashing, authentication controls, upload validation, audit records, rate limits, and payment-provider security features. No internet or storage system is completely secure. Protect your credentials, enable two-factor authentication, and notify us promptly if you suspect unauthorised access.

11. Retention and account closure

We retain information for as long as reasonably needed for the purposes in this policy, including active accounts and tasks, payments and accounting, legal compliance, safety, fraud prevention, disputes, enforcement, backups, and establishing or defending claims. Different record types are retained for different periods, and provider records are subject to provider and legal requirements.

Account closure can be delayed while active tasks, held or disputed payments, cash-outs, or a non-zero balance require resolution. On completed closure, SpotOnTask's current process removes or anonymises reusable profile, contact, location, credential, support, and payment-method data and deletes associated uploads where practicable. It retains transaction, invoice, credit, cash-out, task, offer, review, and audit records where needed, with direct identifiers removed or restricted where practicable. Backups and provider-held records may expire on separate cycles.

12. Access, correction, and deletion requests

You can update many details in your account. To request access to or correction of personal information, account closure, or information about our handling practices, contact [email protected]. We may verify your identity and may refuse or limit a request where permitted or required by law. If so, we will explain the reason where required.

Deletion is not absolute. We may retain information required for active transactions, accounting, tax, fraud prevention, safety, disputes, legal claims, or other lawful purposes.

13. Communications and marketing

We may send messages needed to operate the Services, including verification, security, task, payment, payout, policy, and support notices. Where permitted, we may also send recommendations or marketing. Use an unsubscribe link or account notification settings to opt out of eligible marketing. Operational, transactional, security, and legal messages may still be sent.

14. Children

The Services are for people aged 18 or older. We do not knowingly permit children to create accounts. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

15. Data breaches

We assess suspected data breaches and take containment, investigation, remediation, and notification steps required by applicable law. Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

16. Complaints

Email [email protected] with the subject Privacy complaint and enough detail for us to investigate. We aim to acknowledge the complaint promptly and provide a response within a reasonable period, generally within 30 days where practicable.

If you are not satisfied, you may be entitled to complain to the Office of the Australian Information Commissioner or another applicable regulator.

17. Changes to this policy

We may update this policy to reflect legal, provider, or product changes. We will publish the new effective date and take reasonable steps to notify users of material changes, such as by website notice, account notice, or email. Where consent is legally required for a new use, publication alone will not replace that consent.