9am.works9am.worksGo home

Privacy Policy

Last updated: 2026-07-23

This notice explains how 9am GmbH ("we", "us") processes personal data when you use nova.9am.works ("9am", "the Service"). It is our information duty under Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Controller

9am GmbH, c/o AchtBerlin, Schönhauser Allee 8, 10119 Berlin, Germany. Contact: support@9am.works. Full legal details are in our Imprint.

2. What data we process and why

Account

Email address, name, password hash (or Google OAuth identifier), IP address, timestamps. Purpose: create and secure your account. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Profile and CV

Uploaded PDFs, parsed profile fields, work history, education, skills, languages, avatar, hourly rate, links you add (GitHub, LinkedIn URL). Purpose: build and operate your freelancer profile and tailored CVs. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Applications

Recipient email, message body, attached CV, application status metadata. Purpose: send applications on your instruction and let you track them. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

CRM (companies & contacts)

Company and hiring-manager details you enter or that are attached to the jobs you apply to. Purpose: help you organise your job search. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); you are responsible for the lawfulness of contact data you enter about third parties.

References & testimonials

Reviewer name, email, LinkedIn URL, avatar, testimonial text. Purpose: collect and display references you request. Legal basis: consent of the reviewer (Art. 6(1)(a) GDPR).

Interviews, coach, and voice

Transcripts and, where enabled, audio of the AI-assisted interview and coaching sessions. Purpose: generate a tailored profile for a specific job. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Public profile

Fields you explicitly mark public are published at a public URL and can be indexed by search engines. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by making the profile private.

3. Recipients and processors

We use the following processors under data processing agreements (Art. 28 GDPR). Transfers to processors outside the EU/EEA rely on the Standard Contractual Clauses (Art. 46 GDPR) and, where available, the EU–US Data Privacy Framework.

  • Supabase Inc. (EU-hosted / US parent) — database, authentication, storage
  • Cloudflare, Inc. (US) — hosting and edge delivery of the app
  • Resend, Inc. (US) — delivery of transactional and application emails
  • OpenAI, LLC (US) — AI features (CV parsing, tailoring, coach, interview, reference cleanup)
  • Firecrawl, Inc. (US) — scraping of public job and company URLs you provide
  • EnrichLayer / Proxycurl (US) — enrichment of public LinkedIn profile data on your request
  • Google Ireland Ltd. (EU / US) — Google Sign-In (OAuth handshake only)

Where the same legal entity (9am GmbH) also operates the production marketplace at app.9am.works, application data may be shared internally between 9am and that system to keep your job list and identity in sync.

4. Automated decisions and profiling

9am scores jobs against your profile ("match score") and generates tailored CV text using AI. These outputs are suggestions; a human (you) always decides whether to apply or send. No decision with legal or similarly significant effect on you is made solely by automated means (Art. 22 GDPR).

5. Retention

  • Account and profile data: for the lifetime of your account. You can request deletion at any time.
  • Applications and CRM entries: until you delete them or your account.
  • Security and access logs: up to 90 days.
  • Backups: rotated within 30 days.

6. Cookies and local storage

We do not use cookies or storage for analytics, marketing, or tracking. We only store items that are strictly necessary to provide the service you request (§ 25 (2) No. 2 TDDDG):

  • sb-*-auth-token (browser localStorage) — your authenticated session with Supabase. Removed on sign-out.
  • i18nextLng (browser localStorage) — your language preference.

Because we set no non-essential cookies today, no consent banner is required. If we later add analytics or third-party tracking, we will first ask for your consent.

7. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and to object (Art. 21). Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing. To exercise these rights, contact us at support@9am.works.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

8. Security

Data is transmitted over TLS. Access to the production database is restricted and protected by row-level security so that each user can only read their own private data.

9. Changes to this policy

We may update this notice to reflect changes to the service or the law. The current version is always available at nova.9am.works/privacy. Material changes will be announced in-app.