Privacy Policy
This policy explains, in plain language, what personal data NineBox collects when you use our 9-box talent review tool, why we need it, where it lives, how long we keep it, and the rights you have over it. It is written for HR teams that run reviews — and for the employees whose data is being reviewed.
On this page
1. Who we are and who is responsible
NineBox (“NineBox”, “we”, “us”) provides a collaborative talent review application that helps organizations run 9-box performance-and-potential discussions: organizers upload a roster, evaluators cast their votes, the team discusses each person, and the results are placed on a nine-box grid that can be exported.
Data controller: NineBox. Contact: privacy@ninebox.app. Please note that our ninebox.app domain is launching shortly; this mailbox goes live together with the domain, and the address will remain the standing privacy contact afterwards.
Responsibility for data is shared in a simple way. For the service-level data that NineBox handles on its own behalf — such as organizer and administrator accounts — NineBox is the data controller. For the talent review content that a customer organization uploads into its rooms (rosters, ratings, votes, notes), the customer organization is the data controller and NineBox acts as its processor under our Data Processing Addendum. If you are an employee whose data appears in a room, you may contact either your employer or us directly at the address above.
2. What data we collect
We deliberately collect the minimum needed to run a review. There are no analytics scripts, no advertising pixels and no third-party trackers anywhere in the application.
| Data | Examples | Where it comes from |
|---|---|---|
| Employee review data | Employee name, employee number or ID, department, job title, and the performance and potential ratings — the 9-box coordinates and the resulting box placement or conclusion. | Uploaded by your organization’s room organizer. |
| Evaluation activity | Evaluators’ pre-meeting and live votes, per-dimension scores, skip choices, and free-text discussion notes attached to a person or room. | Created by evaluators during the review. |
| Account data | Organizer and administrator usernames, roles, and credentials. Passwords are stored only as a scrypt hash — we never see or store your plain password. | You, when an account is created. |
| Licence data | Email address and order reference shared by our payment provider so we can unlock the plan you purchased. | Paddle, our Merchant of Record. |
| Local device data | A session cookie while you are signed in, plus your language preference and small UI states (such as the last room you opened) stored in your browser’s localStorage. | Your browser. |
If an organizer uploads employee photos together with the roster, they are treated as employee review data and follow exactly the same rules. See also our Cookie & Local Storage Notice.
3. Special category data: not collected
NineBox does not collect special categories of personal data under Article 9 GDPR — such as data revealing health, disability, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or orientation, or biometric data. The product contains no fields for such data, and our systems are not designed to process it.
We also recommend using employee numbers rather than full names wherever your review process allows it — a simple step that keeps the 9-box discussion focused and reduces exposure.
4. How we use data, and our legal bases
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Running your review rooms — rosters, voting, live discussion, 9-box placement and export. | Employee review data, evaluation activity. | Performance of the contract with your organization — Art. 6(1)(b). |
| Keeping accounts secure and the service available. | Account data, session cookie. | Contract, and legitimate interests in security and reliability — Art. 6(1)(b) and (f). |
| Delivering the plan you purchased. | Email address, order reference. | Performance of the contract — Art. 6(1)(b). |
| Answering support, privacy and legal requests. | Contact details and request content. | Legitimate interests, and compliance with legal obligations — Art. 6(1)(f) and (c). |
In plain terms: “contract” means we need the data to deliver the service you signed up for; “legitimate interests” means we rely on running a secure, working product, balanced against your interests and rights.
We do not use your data for advertising, profiling, or selling. There is no automated decision-making in NineBox: the 9-box placement is decided by your team in discussion — the tool only aggregates the votes.
5. Where your data is stored
NineBox runs on Cloudflare Workers. Each room’s data is held in its own isolated Durable Object on Cloudflare’s global edge network. Primary processing takes place in the United States and the European Union, with the possibility of access from other regions for support and maintenance.
Because the edge network is global, personal data may be transferred outside the EEA or the UK. These transfers are protected by Cloudflare’s Data Processing Addendum and by the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), together with the UK International Data Transfer Addendum where it applies. All data is encrypted in transit using TLS.
6. Deletion and retention
Before deleting a room, organizers can export the results. Once exported, the file is yours: it leaves NineBox and is governed by your own organization’s data policies.
| Data | Why we keep it | Retention |
|---|---|---|
| Session cookie | Keeps you signed in. | Until you log out or close your browser. |
Language preference (talentLang) and other localStorage UI state (for example, the last room you opened) | Remembers your choices between visits. | Stored only on your device, until you clear your browser storage. |
| Room data | The review itself. | Until the organizer deletes the room — there is no automatic hidden copy. |
| Account credentials | Access control. | Until the account is closed, then deleted. |
| Billing and tax records | Legal and tax obligations. | Held by Paddle in line with its policy and applicable tax law. |
7. Who we share data with
We share personal data only with the two providers below. We do not sell personal data, and we do not share it with advertisers or data brokers.
| Provider | Role | What they do | Policy |
|---|---|---|---|
| Cloudflare, Inc. | Our sub-processor | Hosting, global edge compute and Durable Object storage for all room data. | Cloudflare DPA |
| Paddle.com Market Ltd | Independent controller | Payments, checkout, invoicing, tax and refunds as Merchant of Record. Paddle controls your payment data; NineBox receives only the email and order reference needed to unlock your plan. | Paddle privacy policy |
We may also disclose data where we are legally required to, or to protect the rights and safety of our users — and we will notify you where the law allows.
8. Your privacy rights
Depending on where you live, you have some or all of the following rights over your personal data:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — ask us to delete your data (for room data, deleting the room achieves this instantly).
- Portability — receive your data in a structured, commonly used format.
- Restriction and objection — ask us to limit processing, or object to processing based on legitimate interests.
- Complain — lodge a complaint with your local data protection authority.
To exercise any right, email privacy@ninebox.app. We will verify your identity (lightly — we only ask what is necessary) and respond within 30 days. If your data sits inside an employer’s room, we may need to involve that organization, since it is the controller of the review content.
9. Children
NineBox is a workplace tool and is not directed at children. We do not knowingly collect data from anyone under 16, and rosters should never include minors. If you believe a child’s data has reached us, contact us and we will delete it.
10. Changes to this policy
We may update this policy as the product evolves. The date at the top of the page always shows the current version, and material changes will be announced by email or in-product notice at least 14 days before they take effect where feasible. If you keep using NineBox after a change, the updated policy applies.
11. Contact us
Questions about privacy? Email privacy@ninebox.app — our ninebox.app domain is launching shortly and the mailbox goes live with it. You may also find these useful: our Terms of Service, our Data Processing Addendum for customers, and the Cookie & Local Storage Notice.