Privacy notice
Last updated 21 October 2026
9cv9 is a job discovery and hiring platform for candidates and employers in Southeast Asia. This notice explains the data the service handles in this release and the choices available to you. It is not a substitute for your local law, and nothing here reduces a right you have under applicable data-protection law.
Data we collect
- Account details such as name, email address, password hash, role, country, and email-verification state.
- Candidate profile details you choose to add, including headline, experience, education, skills, preferences, links, and resume files when upload is enabled.
- Applications you submit, including the cover letter and the resume you select for that employer.
- Employer company details, memberships, job listings, and evidence submitted for company verification.
- Operational and security records such as session data, request logs, abuse-prevention counters, and error reports.
We do not ask for payment-card details in this release.
Why we use it
- Create and secure accounts, sign you in, and verify email addresses.
- Provide job search, applications, employer workspaces, matching, and moderation.
- Review company verification evidence and investigate reported listings.
- Maintain reliability, prevent abuse, and meet legal obligations.
What employers can see
When you apply, the employer receives the application details and the profile information the application shares, including your cover letter and selected resume. Employers do not receive your password, session records, privacy requests, or other applications. Their private notes and internal scoring are not included in your data export.
Sharing and providers
We use service providers for hosting, databases, email delivery, file storage when enabled, error monitoring, and security. They process data on our instructions. We do not sell personal data. We may disclose data when required by law or to protect the service and its users.
Retention and deletion
Account and application data is kept while the account is active and while needed for the purposes above. Account deletion is reviewed before it runs; some records may be retained where the law requires it or to resolve abuse. Draft or unsubmitted profile fields can be changed or removed from your account at any time.
Your choices
You can export your account data as JSON and request account deletion from Privacy and your data. The export is generated immediately and the deletion request is recorded for review. If you are a company owner, transfer ownership before deletion. You can also contact [email protected] to ask about access, correction, or other rights.
Cookies and sessions
Signed-in sessions use an HttpOnly server-side session cookie and a CSRF cookie. These are required for authentication and security. Optional analytics is not enabled by default in this release.
Security
We use access controls, transport encryption, password hashing, rate limits, and audit records. No service can promise absolute security. Report a suspected issue to [email protected].
Changes and contact
We will update this page when the product or law changes. The date above shows the current draft. For privacy questions, contact [email protected].