Privacy Policy

This policy explains what personal data we collect, how we use it, and your rights under the UK GDPR and the Data Protection Act 2018.

Who we are

Data controller: 99 Developers Ltd, a company registered in England and Wales (company number 17257492), which owns and operates 99 Data Rooms. Contact: privacy@99developer.com.

What we collect

• Account data: email, display name, hashed password.
• Content: documents and data rooms you upload.
• Usage data: IP, user agent, country (from IP), event timestamps.
• Public page requests: on our marketing pages only, the network your request came from (its registered owner and country, for example a broadband provider or an organisation's own network), the page, the referring site's domain, and whether a known AI crawler made the request, and which AI assistant sent you if one did. We do not store the IP address itself and derive no identifier from it. A network that generated very little traffic in the period is never named in our reports; that is a threshold on traffic, not on the size of the organisation.
• Visit analytics on share links: pages viewed, dwell time, device.
• Billing data: collected directly by Paddle when you purchase a paid plan (we receive only the subscription status, plan and limited customer reference).

Lawful basis

• Contract: to provide the Service you signed up for.
• Legitimate interests: security, fraud prevention, aggregate cookieless product analytics (the page-view counters, which set no cookies and are not the Clarity processing above), and identifying at the level of an organisation's network who reads our public pages. We have carried out a legitimate interests assessment for that last one, and will provide a summary of it on request once that processing begins.
• Consent: session replay and heatmaps on our public marketing pages, through Microsoft Clarity. This runs only if you agree, never inside your account and never on a document somebody shared with you, and you can withdraw at any time from the footer of any page. What it collects, how long Microsoft keeps it, and the cookies it sets are described on our cookies page.
• Legal obligation: to comply with applicable law.

How we use data

To run the Service, secure it, communicate with you, and improve it. We do not sell your data and do not use it for cross-site advertising.

Sharing

We share personal data only with the following categories of recipients:

• Service providers and subprocessors: hosting, email delivery, and error monitoring.
• Merchant of Record (Paddle.com Market Limited): our reseller and payment processor. Paddle handles checkout, subscription billing, payment processing, tax compliance, invoicing, and refund handling. See Paddle's Privacy Notice.
• Microsoft Ireland Operations Limited: if, and only if, you agree to the optional session-replay analytics on our public marketing pages. It receives how those pages were used. It never receives your documents, the personal data inside them, your name, your email address or any account identifier, and it is never loaded inside your account or on a document somebody shared with you. Microsoft uses some of what it receives for its own purposes as well, so for this it is an independent controlleralongside us rather than our processor. See our sub-processor register.
• Professional advisers: legal and accounting advisers where necessary.
• Authorities: where required by law or to protect rights and safety.

Your account data and documents are stored in the UK (London). Backups are held in an EU jurisdiction. Any transfers outside the UK and EEA are protected by Standard Contractual Clauses or equivalent safeguards where applicable.

Retention

Account data is retained while your account is active and for 30 days after closure. Visit analytics are retained for 24 months. Backups are retained for 30 days. Public page request records are retained for 90 days, and the organisation-level counts derived from them for 36 months. A small network's name and number are discarded from those counts after 12 months.

Your rights

Access, rectification, erasure, restriction, portability, objection. Contact privacy@99developer.com to exercise rights. You can complain to the UK ICO (ico.org.uk).

Children

The Service is not directed at children. You must be at least 16 years old to create an account, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact privacy@99developer.com and we will delete it.

Objecting to legitimate-interest processing

Where we rely on legitimate interests, including the network-level record described above, you have the right to object at any time. You do not have to write to us to do it: if your browser sends a Global Privacy Control or Do Not Track signal, we record nothing about the request. That signal is how an objection to this record works: the record keeps no identifier for you, neither your IP address nor any identifier derived from it, so we could not pick out the rows about one person if you wrote to us. You can write to privacy@99developer.com to object to any other processing we base on legitimate interests.

Security

TLS in transit, encryption at rest, row-level security, short-lived signed URLs, rate limiting. Details on our security page.

Cookies

See our cookie policy.