Privacy Policy

Last updated: September 2026

About This Policy

This policy describes which personal data the FreelancersHome platform processes, for what purpose, who receives it, how long we keep it and what rights you have. Where something is not yet settled, we say so explicitly: such passages begin with “Still open” and will be completed once the information is settled.

Data Controller

The controller responsible for processing your personal data is:

Data We Process

Account: your email address, your password (we store only a hash, never the password itself), your language setting, your role (freelancer or recruiter) and your display name. We need this information to set up an account.

Sign-in and use: for every sign-in we store a session with its start, expiry time, IP address and browser identifier (user agent), as well as the time of your last activity. To protect against abuse, we count sign-in and search requests in short-lived counters.

Profile (freelancers): information you enter yourself, such as photo, headline, short bio, city and country, phone number, years of experience, hourly and daily rates, work model, willingness to travel with radius, languages, availability, skills, industries, education, certifications and projects with reference images, as well as your CV as a file.

Recruiters and companies: company details such as company name, VAT identification number, billing address and billing email, plus project postings, team members, watchlists and saved searches.

Content and records from using the platform: applications and their history, messages with attachments, quotes, reviews, recommendations, documents for electronic signature including their audit trail (times, IP address and browser identifier of the signing steps), emails you write via the platform, files in your file library, conversations with the AI assistant, suggestions from the AI analysis and reports to support. In addition, requests to have your profile checked by the operator, with the decision and any reason given, your status checks in the compliance wizard (bogus self-employment, temporary agency work), your plan, your credit balance, vouchers and unlocks, such as which freelancer profiles a recruiter has unlocked.

Data about other people: if you invite someone to sign, ask someone for a recommendation, invite someone to your team, name someone as a reference for a project or write to someone via the platform, we process that person's name and email address. Conversely, other users may provide information about you, for example in a review, a recommendation or an invitation.

Technical data: when you open a page, our server processes your IP address and browser identifier to deliver the page. We record technical errors in our own error log. It contains the type of error, a cleaned-up error message (without email addresses, tokens or query parameters), the place in the program code and the affected page pattern, but no full address and no request data.

Purposes and Legal Bases

To perform our user agreement with you (Art. 6(1)(b) GDPR), we process your data for your account, profile, search and matching, applications, messages, quotes, electronic signature, file library, email delivery and notifications, the check of your profile at your request, the status check, plans, credits, vouchers and unlocks, and for the AI features you call up yourself (AI assistant, cover-letter draft, analysis of a project description).

Based on your consent (Art. 6(1)(a) GDPR), we analyze your CV with AI. Without your explicit consent this analysis does not take place.

Based on our legitimate interest in secure operation (Art. 6(1)(f) GDPR), we process session data, limit requests to protect against abuse, keep the error log and log interventions by administrators and moderators as well as emails sent via the platform.

Still open: the legal bases named here are subject to legal review; terms of use have not yet been published. After this review we will also add here the legal bases for the statistics on profile visits and searches (see below), for keeping data after an account is deleted and for processing the data of other people, such as signers, authors of recommendations, invited people, reference contacts and recipients of your emails.

Who Sees Your Data

Freelancer profiles are public: anyone who knows the address of a profile can open it without signing in. It shows display name, photo, headline, city and country, work model, years of experience, short bio, hourly and daily rates, willingness to travel with radius, languages, skills, industries, education, certifications, projects with client and reference images, reviews with the names of their authors, a level calculated from the reviews, recommendations with the name and company of the person recommending and, where applicable, a note that the operator has checked the profile, with the date of the check. In search, visitors who are not signed in see only headline, country and a skill overview, without name or photo.

Recruiters' project postings, including the company name, are visible to all signed-in users, together with the reviews freelancers have written about the recruiter. Whoever writes a review appears there by name.

Your CV is visible only to you and to the recruiter teams you have applied to. Applications, messages, quotes and signature documents are visible only to the parties involved. The operator's administrators can access accounts for operations and support. Signing in on behalf of a user and changes made by administrators are logged; individual reads of data are not.

FreelancersHome is one of several brands of the same platform. All brands share one data set: your profile can also be opened via the platform's other brands and found in their search.

Use of AI

Analysis of your CV (only with consent): if you agree, we send the text of your CV to the AI provider. From it, suggestions are created for skills, industries and profile details such as name, phone number, city, country, headline and stated years of experience. The full text extracted from the file is not stored. For industry and profile suggestions we keep the short passage of the CV they are based on; skill suggestions contain only the recognized term. The suggestions are labeled as AI suggestions and are added to your profile only once you confirm them: skills and industries through a selection in which you can also tick all of them at once, profile details one at a time.

AI features you call up yourself: when you use the AI assistant, your messages go to the AI provider together with the data the assistant retrieves to answer. For freelancers this is information from their own profile (headline, short bio, city and country, hourly rates, years of experience, profile completeness), their own skills, and matching open project postings with the company name and external job ads. For recruiters it is their own project postings, their own company details (company name, industry, website) and brief details of matching freelancers without name, email address or photo: headline, country or city, rate and years of experience. For a cover-letter draft, the headline, top skills, years of experience and languages from your profile and the project posting go to the provider; for the analysis of a project description, its text.

In addition, we send individual skill terms without any further information about you to the AI provider in order to match them to the skill graph, and the text of external job ads in order to tag them.

Provider: AI processing runs on the AI Model Hub service of IONOS SE in data centers in Germany. According to IONOS, inputs and outputs are neither logged nor stored there. If this service is unavailable, we use AI models on the operator's own hardware, connected over an encrypted private network connection.

Still open: the location of this own hardware will be added here.

No automated decisions: on information about people, the AI only makes suggestions, which a person reviews. Recruiters search for and choose freelancers themselves via the skill graph; the AI does not assess people and does not decide on applications. No decision based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR takes place.

Withdrawal: you give your consent each time you start an analysis of your CV. You can withdraw it at any time with effect for the future by writing to the privacy address given in this policy. This does not affect the lawfulness of processing carried out before the withdrawal. Administrators can re-run an analysis you started in order to fix an error; no new consent is obtained for this. You can discard suggestions you do not want to adopt; discarded suggestions remain stored, industry and profile suggestions together with the related passage (see “Retention”).

Still open: how we ensure after a withdrawal that no analysis is re-run, and when we delete the suggestions and passages stored from earlier analyses, will be added here.

Statistics on Profile Visits and Searches

When someone opens a freelancer profile (other than the freelancer themselves), we store the time and a visitor identifier: for signed-in visitors a hash of their user ID, for visitors who are not signed in a hash of their IP address. This data is not anonymous but pseudonymous: as the operator, we can link entries of signed-in visitors to their account, and the hash of an IP address can also be traced back to the address with little effort. Freelancers only see numbers from it, such as how often their profile was opened, never who opened it.

We also store which freelancer profile was shown in a search for which skill, without recording who searched.

Both serve statistics that show freelancers how visible their profile is. We delete this data automatically after 90 days.

Still open: the legal basis for these statistics will be added here after legal review.

Recipients

The following service providers receive data because they provide technology for us:

Hosting: the platform runs in its own virtual machine on a dedicated server that Liauw Media (Malta) provides and manages for us; the server, including its network connection, is rented from Hetzner Online GmbH and located in a data center in Germany. We operate the database, search index, cache and file storage ourselves in this virtual machine. Until the move in September 2026, the platform ran on a server of Hetzner Online GmbH in Finland; Liauw Media also provides this server for us, and an inactive copy of the data is temporarily still kept there.

Email: we send all platform emails through a mail server that Liauw Media (Malta) operates for us on a server rented from Host Europe GmbH in Germany. The mailboxes through which you reach us by email run on the same server. The emails we send include password-reset links, notifications about applications, notices of new messages with the sender's name and a short text preview, search alerts, invitations, signature requests and emails you write yourself via the platform, including attachments.

AI: IONOS SE, Germany, with the AI Model Hub service; details under “Use of AI”.

Other users and the public receive data as described under “Who Sees Your Data”. People you invite or write to yourself receive the information needed for this, such as your name, the document to be signed or the content of your email.

Not in use: we use no content delivery network and no analytics, advertising or tracking services. We serve fonts ourselves, without requests to third-party servers. Sign-in with Google or LinkedIn and online payments are currently not active; if they are added, we will update this policy.

Transfers Outside the EU

The service providers named above process your data on servers in Germany; Liauw Media is based in Malta. The inactive copy from the move is kept in Finland. No transfer to countries outside the European Union or the European Economic Area is intended for them.

Still open: we are still checking the location of our own AI hardware, the service used to establish the encrypted connection to it, and the location and provider of backups. We will add the result here.

Retention

We store your account and profile data for as long as your account exists. We do not delete inactive accounts automatically.

When you delete your account, we immediately remove your profile from search and the skill graph, delete the uploaded files your account refers to, except those belonging to the signature documents named below, end your sessions and delete most of your data. We delete the remaining profile data after 30 days; your user record is then anonymized. If a file cannot be deleted, final deletion is postponed until the error is fixed.

Even after an account is deleted, records are kept that concern other parties or serve as evidence: applications and their history, message threads, quotes, documents for electronic signature with recipients and audit trail, share links to documents, reviews you wrote (without your name), your project postings that have applications, messages or quotes (archived and no longer visible as postings), records of companies (we delete the company data of sole traders), logs of interventions by administrators and moderators, of emails sent via the platform and of configuration changes, vouchers, news posts and confirmations of new skill terms.

Still open: no maximum period has been set for these records yet; it will be added here.

The platform enforces these periods automatically:

• Statistics on profile visits and searches: deleted after 90 days.
• Error log: deleted 30 days after an error last occurred.
• Support reports: deleted 180 days after closure; the browser information is removed after 90 days; reports that are never closed are emptied and closed after 730 days at the latest.
• Log of interventions by administrators and moderators and of emails sent via the platform (sender, recipient domains, number of attachments): IP address and browser identifier, where recorded, are removed after 180 days; the rest of the entry is kept.
• Counters limiting requests, for example for search and uploads: deleted after 60 minutes.
• Cookies: see the cookie policy for their lifetimes.

Still open: the platform does not yet enforce its own period for the following data: expired sessions and links for confirmation or password reset, conversations with the AI assistant, emails written via the platform, records of emails sent and of CV analyses carried out, and AI suggestions including the related passage from your CV, even if you discarded a suggestion. This data is kept until the account is deleted. Also still open are the periods for server and mail-server logs, for backups, for the inactive copy from the move and for the data of other people you give us, as well as whether deleting an account also deletes older, replaced or never-used uploads that your account no longer refers to. This information will be added here.

Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and to object (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). For requests, contact us at privacy@nexapto.com.

In the settings you can download your data yourself at any time as a file in JSON format and delete your account.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

Still open: the supervisory authority competent for us will be added here after legal review.

Contact

For privacy-related inquiries, contact the data controller at privacy@nexapto.com or at the postal address listed above.