Privacy Policy

Who we are

Monster Task LLC (“Monster Task”, “we”) operates this website and the Monster Task platform. Atlanta, Georgia, USA. Data Protection Officer: Michelle Conde, m.conde@monstertask.com. General privacy contact: hr@monstertask.email. We process personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

What we collect and why

When you apply for a role (careers.monstertask.com): full name, email address, WhatsApp/phone number, birthday, home address, how you heard about us and any referrer’s name, whether you have stable internet and your provider, whether you can start immediately, your resume (PDF), a video recording link and optional portfolio link, and your assessment answers where a role includes one. Purpose: to evaluate your application, contact you about it, and decide whether to match you with a client. Legal basis: your consent, and the steps necessary before entering into an engagement with you.

Screening. We derive screening scores from the text of your resume and, where applicable, your assessment answers, using rules configured by our recruitment team. These scores help our recruiters prioritise; every decision about your application is made by a person. You may ask us to explain a decision.

If you are engaged as a virtual assistant: your work email, start date, schedule, attendance (clock-in and clock-out times), end-of-day reports, check-ins, performance notes, and payment-related records needed to administer your engagement.

If you are a client or lead: your name, company, email, phone, community or partnership, the package and services discussed, contract and payment records, and check-in notes.

Automatically: server logs (IP address, browser, pages requested) kept briefly for security, and performance measurements (page timings) that do not identify you.

We do not collect government ID numbers, health information, marital status or similar sensitive personal information through this website.

Who has access

Only Monster Task staff whose role requires it, under role-based access controls enforced in our database. Clients see information about virtual assistants proposed or assigned to them. We do not sell personal data.

Third parties and cross-border transfer

We use service providers to run the platform. Some are located outside the Philippines, including in the United States and Australia, so your data may be transferred there with safeguards under their terms:

• Supabase (database, authentication, file storage; servers in Sydney, Australia)
• Vercel (website hosting; functions in Sydney, Australia; edge network worldwide)
• Resend (transactional email, e.g. application confirmations)
• Cloudflare Turnstile (spam protection on forms)
• Grain (interview recordings, where an interview is recorded with your knowledge)
• GoHighLevel (lead and client communication records)
• Deel (contractor payments for virtual assistants)
• Google Workspace (email and documents used by our staff)
• ClickUp (internal project management)
• Notion (internal documentation; being phased out)

How long we keep it

Applications that do not proceed: 90 days after the decision, after which the application, resume and assessment are deleted unless you ask to stay in our talent pool. Engaged virtual assistants and clients: for the duration of the engagement and five (5) years afterwards for legal, accounting and dispute-resolution purposes. Server logs: up to 30 days.

Your rights

Under RA 10173 you may: be informed; access your data; correct it; object to processing; ask for erasure or blocking; receive a copy in a portable format; be indemnified for damages; and file a complaint with the National Privacy Commission (privacy.gov.ph). To exercise a right, email hr@monstertask.email or the DPO. We respond within 15 working days.

Security

Encryption in transit and at rest, access limited by role, audit logs of changes, private file storage with time-limited links. In the event of a personal data breach likely to cause harm, we will notify the National Privacy Commission and affected individuals within 72 hours of discovery.

Other laws

If you are a resident of a US state or of the EU/EEA, additional rights may apply under that law (for example the CCPA/CPRA or GDPR). [LEGAL REVIEW: confirm applicability and add required disclosures.]

Changes

We will post updates here with a new “last updated” date. Material changes affecting applicants will be shown on the application form.