Privacy Policy

Who we are

DivisionNine (“Division 9”, “we”, “us”) builds and runs automation systems for its clients, some inside the client’s own accounts and some in Division 9’s own environment. We operate from the Netherlands and act in line with the EU General Data Protection Regulation (GDPR). For any question about this policy or your data, contact us at division9agency@gmail.com.

What this policy covers

This policy explains how we handle personal data in two situations: people who visit this website or contact us, and clients we build systems for. These are deliberately different, because of how our builds are architected.

Website visitors and enquiries

When you submit the build-plan form or otherwise contact us, we process the details you provide, such as your name, email, company and message, to respond to you and to plan a possible engagement. The legal basis is our legitimate interest in answering enquiries and taking steps toward a contract at your request. We keep this information only as long as needed for that purpose and our normal business administration.

This site sets no cookies of its own. See our Cookie Policy for details.

Client and engagement data

Where a system runs depends on what you take. The Growth Systems, Automation and AI Systems packages run in Division 9’s environment and connect to your tools from there. Only Custom SaaS runs inside your own accounts and connects to your own tools. Either way, your data, logs and prompts remain yours. Where we act as a processor for personal data, we sign a Data Processing Agreement per engagement that sets out scope, purpose and safeguards.

Apart from what a system processes on your behalf, the information Division 9 itself holds about a client is your contact details, the build documentation and, if you work in our dashboard, the data described below.

The dashboard and creatives

What data: the name and email address of dashboard users, who wrote a piece of copy and when, and ad performance figures you supply. Product data from your webshop contains no personal data.

What for: only to deliver our service.

Do not enter personal data in text fields.

How long: we delete creatives within 30 days of delivery. We keep account data for as long as the account exists.

Who else is involved

The providers depend on where your system runs. A system in your own accounts uses your own cloud account (AWS or GCP) for hosting and storage; a system in Division 9’s environment is hosted and stored in the EU. Every system uses the Anthropic API for the AI model: to make an agent work, the context it needs is sent to the model, under Anthropic’s commercial terms, which exclude training on inputs and outputs. Code is kept in GitHub. Your existing tools are connected with scoped credentials you issue.

For the dashboard and the delivery of creatives, these parties process data for us:

• Supabase: database and storage, in the European Union
• Railway: the server, in the European Union
• Anthropic: generating copy suggestions, in the United States
• Google: delivering creatives via Google Drive
• Stripe: payments, where applicable

International transfers

Our database and server are in the EU. A system in your own accounts is hosted and stored in EU regions of your own cloud account. Copy suggestions go to Anthropic in the United States. Google and Stripe may also process data outside the EU, under those providers’ safeguards. The context sent to the AI model is processed under the model provider’s terms.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. To exercise any of these, contact us at the address above. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

How we protect the systems we build is part of every installation: scoped access, full logging, and reversibility.

Changes

We may update this policy. The date at the top reflects the most recent revision.