Diese Seite gibt es nur auf Englisch.

Monday at Nine keeps your job search in one place. This page explains which personal data it stores, why, for how long, and what your rights are. In short: we store what you put in so the app can work for you. We don't sell your data or use it for advertising, and there are no tracking or advertising cookies.

Who is responsible

Ralf Stadtaus
Johann-Adolf-Hasse-Straße 8G, 21493 Schwarzenbek
Contact form

Use the contact form or write to the postal address with any question about your data.

Your account

When you sign up we store your name, your e-mail address and your password. The password is stored only as a hash (bcrypt), so nobody can read it, not even us. We also store your workspace and role, when you signed up and last logged in, and whether you confirmed your e-mail address. When you sign up we note the language and region your browser is set to, such as German (Austria), to set up your CV's language and format and to write our e-mails to you in your language. The language you pick for the app is stored with your account.

Why: to give you your account (Art. 6(1)(b) GDPR).

Your CV, jobs and files

Monday at Nine stores what you enter: personal details for your CV (which may include a photo, your address, date and place of birth and nationality), work history, projects, education, certificates, languages and skills; letter templates and files you upload; the jobs you save, with their status, notes, reminders and history; and the companies you apply to. When you save a job from a link, our server fetches that page to read the posting.

Why: this is the service you use (Art. 6(1)(b) GDPR). Photo, birth date and nationality are optional: add only what you want employers to see.

Who sees it: only you. If you belong to a workspace, for example of a career service, its owners and admins see your name, e-mail address, role, when you last logged in, and how many jobs you saved, applied for and got interviews for, but not the jobs, CV, letters or files themselves. Platform administrators can look at your account to help you when you ask for support.

Application photos made with AI

When you click “Make it an application photo” on your CV page and confirm it, we send the photo you uploaded for your CV to OpenRouter (OpenRouter, Inc., USA), which passes it on to the AI model of Google. The AI turns it into an application photo, which we store as your CV photo. OpenRouter processes the photo on our behalf. It doesn't use it for training and keeps image files only as long as it takes to pass them on, unless it needs them to fend off abuse. Google doesn't use the photo to train or improve its products, and keeps it only for a limited time to detect misuse. Both may process it in the USA. Transfers to OpenRouter are covered by the EU's standard contractual clauses, those to Google by the EU-US Data Privacy Framework.

So you can convert your photo again or go back to it, we keep the photo you uploaded, scaled down, next to your CV photo until you replace or remove it. To limit and keep track of costs, we count conversions per account: each one for 2 days for the daily limit, their number and what they cost in total with your CV details, and their number this month with your workspace.

Why: you asked for it (Art. 6(1)(b) GDPR).

E-mails you send through Monday at Nine

When you apply by e-mail, we store the e-mail (recipients, subject, text and the names of the attached files) with the job, so you can see what you sent. It goes out through your own mailbox if you connected one (we store its password encrypted), or else through our mail server, with your name as the sender and replies going to you.

To stop misuse of our mail server, we count e-mails per sender and recipient. For that we keep a fingerprint (hash) of each recipient's address, not the address itself, for 8 days. Every e-mail names its sender and lets the recipient refuse further e-mails sent through Monday at Nine; refusals are kept as a fingerprint, too. If an e-mail can't be delivered, we read the delivery report from our mailbox to tell you why. Delivery reports are kept for up to a year.

Why: to send your applications (Art. 6(1)(b) GDPR) and to protect recipients and our mail server from spam (Art. 6(1)(f) GDPR). The people you write to receive your e-mail and files; we use their address only to deliver it.

Payments

Workspace plans are paid through Stripe. You enter your payment details on Stripe's pages; we never see your card number. Stripe tells us your customer and subscription number, the plan, whether payments went through, and the amounts and numbers of your invoices, which we store with the workspace. Once the workspace is erased, so is our copy of these records. Stripe keeps the customer record and the invoices for us, because tax law obliges us to keep invoices.

Why: to sell and bill the plan (Art. 6(1)(b) GDPR) and to keep the records the law requires (Art. 6(1)(c) GDPR).

Contact form

When you write to us through the contact form, we send your name, e-mail address and message to our mailbox, so we can answer you. If you are logged in, we add which account you use. Monday at Nine itself doesn't store the message. We keep the e-mail as long as we need it for your request, and longer only where the law obliges us to keep business letters.

Why: to answer you (Art. 6(1)(f) GDPR; for questions about your account, Art. 6(1)(b) GDPR).

Cookies

We only use cookies the app needs to work. There are no tracking, analytics or advertising cookies, and our pages load no scripts, fonts or images from other sites.

• session: keeps you logged in, for 30 days or until you log out.
• flash: shows a message after an action, for 1 minute.
• lang: remembers the language you picked, for 1 year.

These cookies are strictly necessary, so they need no consent.

Server logs and security

Our server records each request: time, page, result and your IP address, to find errors and fend off attacks. The log is limited in size: old entries are overwritten by new ones, and it is cleared when the app is updated. To limit login, sign-up and contact form attempts, the server also counts requests per IP address for up to an hour.

When Monday at Nine calls another service for you (Stripe for payments and OpenRouter for AI photos), we log the call for 30 days: when, which service, whether it worked, how long it took and which account it was for, to find errors and keep track of costs. What was sent isn't logged.

Why: to keep Monday at Nine secure and working, and its costs in check (Art. 6(1)(f) GDPR).

How long we keep data

• Your data stays until you delete it, or your account.
• Deleted jobs and companies go to Deleted, where you can restore them.
• Deleting your account in Settings erases it and all its data right away. If we delete a workspace ourselves, for example because it broke the terms, we keep it hidden for 30 days, so it can be restored, and then erase it for good.
• Daily backups are kept for 31 days, with a copy on a separate backup server. Erased data is gone from them once the last backup holding it has been replaced.
• Sessions end after 30 days, password reset links after an hour, confirmation links after a day, and invitations after 7 days.
• The log of calls to other services is kept for 30 days.

Who else gets data

Your data is kept on our server and our backup server. Service providers who run these servers or deliver our e-mail for us process data only on our behalf and as we instruct them. Stripe, OpenRouter and Google receive data as described above. We don't give your data to anyone else, unless the law obliges us to.

Your rights

Under the GDPR you can ask us at any time to tell you which data we have about you (Art. 15), to correct it (Art. 16), to erase it (Art. 17), to limit its use (Art. 18), or to give it to you in a common format (Art. 20). You can object to processing based on our legitimate interests (Art. 21). Contact us as described above. Much of this you can do yourself: change or delete anything in the app, download all your data as a ZIP file (Settings → Your data), download your CV as a PDF, or erase your account in Settings.

You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work.

Changes

When this policy changes, the date at the top changes. Before we use your data in a new way, we ask you.