GDPR Compliance
Effective Date: August 10, 2026
1. Who This Applies To
If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) grants you specific rights regarding your personal data. Even though 9talks is an independent, unincorporated platform — not a registered company, corporation, or legal entity — we take these rights seriously and honor them to the best of our ability.
2. What Data We Process
9talks processes the following categories of personal data:
2.1 Account & Profile Data
- Email addresses — for registered users (OTP authentication) and newsletter subscribers.
- Profile data — display name, username, bio, avatar URL, cover image, location, website, social media links, and custom fields you choose to add.
- Account metadata — creation date, last update date, admin/verification status.
2.2 Content Data
- Article content — titles, body text, excerpts, tags, featured images, and SEO metadata published by writers.
- Comments — text content posted by users on articles, tied to their user account.
- Comment likes — records of which comments a user has liked.
- Uploaded images — article and profile images stored in Supabase Storage.
2.3 Subscriber Data
- Email address — provided voluntarily when subscribing to the newsletter.
- IP address — collected at subscription time for security and abuse prevention.
- User-agent string — collected at subscription time for security and abuse prevention.
2.4 Usage & Technical Data
- Article view data — anonymous/pseudonymous visitor IDs, article IDs, and view duration. No personal identity attached.
- Vercel Analytics — aggregated, anonymized traffic metrics (page visits, country-level geography, device type). No personal identifiers.
- IP addresses — processed by our hosting and database providers for security, uptime, and abuse prevention.
- Server logs — managed by Vercel (hosting provider) per their retention policies.
3. Legal Basis for Processing
Contract: When you create an account, we process your email address and profile data to provide the authentication service and platform features (comments, profiles) you have requested.
Consent: Email subscriptions are opt-in. You provide your email voluntarily and can withdraw consent at any time by unsubscribing.
Legitimate Interest: Our internal tracker and Vercel Analytics collect anonymized, aggregated data to understand platform usage and improve content. We do not use this data to profile individuals or for advertising.
Legal Obligation: We may process IP addresses and user-agent strings to prevent fraud, abuse, and unauthorized access, as required for platform security.
4. Your Rights Under GDPR
You have the following rights regarding any personal data we process about you:
Right to Access: You can request a copy of the personal data we hold about you, including account data, profile data, comments, and subscriber data.
Right to Rectification: If any data is inaccurate, you can request correction. You can also edit your profile directly at /profile.
Right to Erasure: "Right to be Forgotten" — you can request deletion of your account, profile, comments, and subscriber data.
Right to Restrict Processing: You can ask us to stop processing your data while a complaint is resolved.
Right to Object: You can object to our use of the internal tracker or Vercel Analytics at any time by contacting us.
Right to Data Portability: You can request your personal data (profile, comments) in a structured, machine-readable format.
Right to Withdraw Consent: For consent-based processing (email subscriptions), you can withdraw consent at any time by unsubscribing or contacting us.
To exercise any of these rights, contact us at team@9talks.com. We will respond within 30 days.
5. Data Retention
- User accounts — retained while active. Deleted upon request.
- Profile data — retained while your account is active. Removed upon account deletion.
- Article content — retained while published or in draft status. Removed when deleted by author or admin.
- Comments — retained while your account is active or until deleted.
- Email subscriber data — retained while subscribed. Removed upon unsubscribe request.
- Article view data — anonymous, expires within 30 days.
- Vercel Analytics data — aggregated, retained per Vercel's retention policies.
- IP addresses and user-agent (subscriber) — retained with subscriber record for security. Removed upon unsubscribe.
- Server/hosting logs — managed by Vercel per their retention policies.
6. Third-Party Data Processors
We use the following third-party services, each selected for their privacy-respecting practices:
- Supabase — database hosting (PostgreSQL), authentication (email OTP), and file storage. Processes email addresses, profile data, article content, comments, subscriber data, and article view data. Data is stored in Supabase-managed infrastructure.
- Vercel — website hosting and analytics. Processes minimal technical data (IP addresses, server logs) for security and aggregated traffic metrics.
We do not use advertising networks, social media trackers, or analytics platforms that share data with third parties. Data is not transferred outside of Supabase and Vercel infrastructure except where required for service delivery.
7. Data Security
- Authentication is passwordless (email OTP) via Supabase Auth — no passwords are stored.
- Article content is sanitized using HTML sanitization to prevent XSS attacks.
- Comments are validated, length-checked, and sanitized before storage.
- Image uploads are restricted by type (JPEG, PNG, GIF, WebP) and size (max 10MB).
- Admin access requires email + password + a secret key, with sessions stored in sessionStorage (cleared on browser close).
- While we take reasonable security measures, no method of transmission or storage is 100% secure.
8. No Legal Entity Status
9talks is not a registered company, corporation, LLC, partnership, or any other type of incorporated legal entity. It is operated as an independent, unincorporated project by its creator(s). While we honor GDPR principles in good faith, this may affect formal enforcement mechanisms. The operator(s) act in a personal capacity, not as agents of a corporate entity. If you have unresolved concerns, you may also contact your local data protection authority (DPA).
9. Automated Decision-Making
We do not use automated decision-making, profiling, or AI-based evaluation of personal data that produces legal or significant effects on you. All content moderation and account decisions are made manually by the platform operator(s).
10. International Data Transfers
Your data is processed by Supabase and Vercel, which may store data in various regions. Both providers offer appropriate safeguards (such as Standard Contractual Clauses) for international data transfers under GDPR. We encourage you to review their respective privacy policies for details on data location and transfer mechanisms.
11. Contact
For GDPR-related requests, questions, or to exercise your rights:
Email: team@9talks.com
Data Contact: M71 (Mritunjay)
9talks does not sell data, does not use third-party advertising trackers, and processes only what is strictly necessary to operate the platform. Your rights are respected in good faith by the platform operator(s).